---
title: "How to Set Up Two-Factor Authentication (2FA) in WordPress with All-In-One Security (AIOS)"
description: "Turn on two-factor authentication for WordPress logins with the All-In-One Security plugin and an authenticator app, and regain access if you lose your device."
url: "https://docs.noiz.ie/wordpress/how-to-set-up-two-factor-authentication-2fa-in-wordpress-with-all-in-one-securit/"
section: "WordPress"
categories:
  - "Applications > WordPress > Security"
last_reviewed: "1 August 2026, against the current WordPress release and the current All-In-One Security (AIOS) plugin release"
---

# How to Set Up Two-Factor Authentication (2FA) in WordPress with All-In-One Security (AIOS)

Two-factor authentication (2FA) adds a second layer of protection to your WordPress login. Even if your password is guessed, leaked, or stolen, an attacker cannot log in without a time-based one-time code generated on your own device. This article walks through enabling and configuring 2FA using the All-In-One Security (AIOS) plugin, from login to your first protected sign-in.

**Last reviewed:** 1 August 2026, against the current WordPress release and the current All-In-One Security (AIOS) plugin release. It complements the AIOS documentation; the settings screens below were verified against the plugin as installed.

## What You Need Before Starting

- A WordPress site with the **All-In-One Security (AIOS)** plugin installed and activated. The free version from the WordPress plugin directory includes 2FA for standard WordPress login forms.
- An administrator account on the site.
- A smartphone or tablet on which to install an authenticator app (see next section).

AIOS 2FA uses the open TOTP standard (time-based one-time passwords). The codes are generated locally on your device from a shared secret, so no network connection, SMS, or phone number is required, and no third party is involved in your logins.

## Step 1: Install an Authenticator App

Any TOTP-compatible authenticator app will work. Noiz recommends fully free and open-source (FOSS) options, as their code is publicly auditable and they do not tie your 2FA secrets to a vendor account:

- **FreeOTP+** (Android, available on F-Droid and Google Play): the Noiz preferred option, with encrypted export/backup support.
- **Aegis Authenticator** (Android, F-Droid and Google Play): FOSS, with encrypted vault and backup support.
- **FreeOTP** (iOS, App Store): the original Red Hat FOSS authenticator.

Proprietary options such as Google Authenticator, Microsoft Authenticator, and Authy are also fully compatible if you already use one of them.

Install your chosen app before proceeding. You will need it in Step 3.

## Step 2: Enable Two-Factor Authentication in AIOS

1. Log in to your WordPress admin dashboard at `https://yourdomain.com/wp-admin` (or your custom login URL if AIOS login page rename is active).
2. In the left-hand admin menu, click **WP Security**.
3. Click **Two Factor Auth** in the WP Security submenu.
4. Open the **Admin settings** section. Here you control which user roles are allowed to activate 2FA on their accounts.
5. Tick the roles that should have 2FA available. At minimum, enable it for **Administrator**. Enabling it for Editor and other privileged roles is strongly recommended.
6. Click **Save Changes**.

This makes 2FA available for those roles. Each user then activates it on their own account, as follows.

## Step 3: Activate 2FA on Your Account

1. Still under **WP Security > Two Factor Auth**, locate the activation section for your own account and set two-factor authentication to **Enabled / Active**.
2. A QR code and a private key (a string of characters) will be displayed. These represent the shared secret between the site and your authenticator app.
3. Open your authenticator app and add a new account:
    - **Scan the QR code** using the app's built-in scanner (fastest method), or
    - **Enter the private key manually** if your device cannot scan the screen.
4. The app will immediately begin generating six-digit codes that refresh every 30 seconds.
5. **Important:** before logging out, confirm that the current code shown in your app matches the current code shown on the AIOS Two Factor Auth page. If they match, the pairing is correct. If they do not match, check that the date and time on your phone are set to automatic, as TOTP depends on accurate clocks.
6. Save the settings.

## Step 4: Test the Login

1. Log out of WordPress.
2. Log in again with your username and password as normal.
3. You will now be prompted for a **one-time password**. Open your authenticator app and enter the current six-digit code for the site.
4. You are logged in. From now on, every login requires both your password and a fresh code from your device.

## If You Get Locked Out

If you lose access to your authenticator device and cannot generate codes, 2FA can be temporarily disabled by anyone with file-level access to the site. Add the following line to `wp-config.php`, just above the line that says `/* That's all, stop editing! */`:

```
define('TWO_FACTOR_DISABLE', true);
```

Log in, reconfigure 2FA with your new device, then remove the line again so protection is restored. File access is available through your hosting control panel's file manager or over SFTP. If you are on a Noiz managed WordPress plan, contact the Noiz support team and this can be handled for you.

The premium version of AIOS additionally supports one-time emergency backup codes, which can be generated in advance and stored somewhere safe for exactly this situation.

## Free vs Premium 2FA Features

The free version covers standard WordPress login forms and is sufficient for most sites. AIOS Premium adds, among other things:

- 2FA on WooCommerce, Elementor Pro, and other custom login forms.
- Making 2FA **compulsory** for selected user roles, rather than optional.
- Emergency backup codes for account recovery.
- Trusted devices, so a code is only required every set number of days per device.
- WordPress multisite support.

## Official Documentation

For further detail on AIOS two-factor authentication, refer to the official resources maintained by the plugin developer, TeamUpdraft:

- [AIOS Two-Factor Authentication overview](https://teamupdraft.com/all-in-one-security/wordpress-two-factor-authentication/)
- [AIOS 2FA shortcodes documentation](https://teamupdraft.com/documentation/all-in-one-security/faqs/how-to-use-aios-tfa-shortcodes/) (for offering 2FA management to front-end users on membership or WooCommerce sites)

## Need Help?

If 2FA is not behaving as expected, codes are being rejected, or you would like 2FA rolled out across multiple users or sites, contact the Noiz support team. Please note that if you are not on a managed WordPress plan, this work may be billable.

---
Source: https://docs.noiz.ie/wordpress/how-to-set-up-two-factor-authentication-2fa-in-wordpress-with-all-in-one-securit/