A password alone is one thing standing between an attacker and your admin account, and if that password is ever guessed, reused from another breach, or phished, that’s the whole defence gone. Two-factor authentication adds a second, separate proof of identity — something on your phone, not just something you know — so a stolen password alone stops being enough.
Two-factor authentication setup
Two-factor authentication set up and tested, so a stolen password alone isn't enough.
- Full backup taken before we start
- If we can’t fix it, you get your money back
- We never ask for your own password
What we need from you
- Confirmation of every admin-level user who needs to be enrolled
- A preference for authentication method, if you have one (an authenticator app is the common recommendation)
- Access to configure the relevant plugin or built-in setting
This or something else?
| You want two-factor authentication set up for your WordPress login | This fix covers it |
| You want login attempts limited or brute-force protection, a related but different layer | Login attempt limiting & brute force protection |
| You already have 2FA but it’s locking legitimate users out | A configuration adjustment, worth describing to us specifically |
| You want SSO or social login set up instead of a second factor | SSO / social login integration errors, a different kind of login change |
What we do
- Choose and configure an appropriate two-factor method for your setup
- Enrol every admin-level user who needs it
- Test the login flow end to end, including a recovery path if a device is lost
- Confirm existing sessions and integrations aren’t broken by the change
- Document the recovery process clearly for future reference
- Verify at least one real login with the new method before finishing
What is included
- Two-factor authentication configured and tested for every specified user
- A documented recovery process for a lost device
- Verification that existing integrations still function
- A written note on how to enrol additional users later
Not included
- Enforcing 2FA for non-admin roles, unless specifically requested
- Broader login security like brute-force protection, a separate fix
- Ongoing account management as users change
- Resolving an unrelated login redirect or access issue
Questions about this fix
What happens if someone loses the device their 2FA is tied to?
We set up and document a recovery path as part of this fix, so a lost device doesn't mean permanent lockout, though the recovery process does need to be followed correctly.
Will this affect people logging in through an app or API, not just the browser?
It can, depending on how those connections authenticate — we check for this during setup so an integration doesn't unexpectedly break.
Is an authenticator app really better than SMS codes?
Generally yes — SMS can be intercepted or redirected through carrier-level attacks in ways an authenticator app isn't vulnerable to, which is why it's the more commonly recommended method.
Do all my users need to use the same 2FA method?
Not necessarily — some setups allow different methods per user, though keeping it consistent is usually simpler to manage and support.
Can I require 2FA only for administrators, not everyone?
Yes, that's a common and reasonable configuration, and we'll set the requirement to match whichever roles you specify.
Related fixes
If this is the second time this year
A bad update breaking the site is a symptom of updates not being tested first. Care plans run every update on a staging clone before it reaches your live site, which is the actual fix for this happening again.
Your access, your rules
Create a separate admin account for us and delete it when we are done. For anything else, we get in touch and agree a method — never a form field on this site, never by reply to an email.
We back up first, always
Before anything is touched we take a full backup and keep it for 30 days. If a fix goes wrong, we put the site back exactly as it was.
If it is not what you bought
If the problem turns out smaller than what you ordered, we refund the difference. If it is bigger, we stop and send a quote before doing any extra work.
If we cannot fix it
You get back what we received. Diagnosis is on us — you only pay when the problem is actually solved. The payment processor takes its fee before the money reaches us, so we never hold it and it is not ours to return. That is true here as everywhere else.
If it comes back
Reply within seven days of delivery and we put it back on the bench at no cost. The fix is not finished until it holds.
What we are responsible for
If something goes wrong with a fix, our responsibility is limited to what you paid for it. We take a full backup first so mistakes can be undone, and we tell you before doing anything outside what you bought.