Which authenticator app should I use?

Any TOTP-compatible app works because the standard (RFC 6238) is identical across vendors. Recommended options in rough order of preference: 1Password or Bitwarden if you're already paying for a password manager (2FA codes sync across devices with your vault), Authy if you want free cross-device sync, Google Authenticator or Microsoft Authenticator if you want the simplest possible free option. Avoid apps that require an account and don't offer export, since you'll be locked out of your own 2FA codes if you lose your phone.

What happens if I lose my phone or wipe my authenticator app?

Use one of your backup codes to sign in, then immediately re-pair 2FA with a new authenticator app. Each backup code is single-use, so mark it as consumed once you've used it. If you don't have backup codes and can't sign in, use the wp-config disable path documented in the 2FA Recovery guide as a last resort.

Can I require 2FA for administrators without forcing it on subscribers?

Yes. GuardPress supports per-role enforcement: turn on 'Require 2FA' for Administrator (and Editor, if you want), leave it off for lower-privilege roles like Subscriber and Customer. Users in enforced roles are redirected to the 2FA setup page on next sign-in and cannot dismiss it. See the Per-Role 2FA Enforcement Setup guide for the exact settings.

Does GuardPress 2FA work with WooCommerce and MemberPress login forms?

Yes. GuardPress hooks the WordPress authentication filter, so 2FA challenges fire on every sign-in path: wp-login.php, WooCommerce my-account, MemberPress login, BuddyPress, page-builder login widgets, and third-party themes with custom login templates. If a specific login form isn't showing the 2FA challenge, it's usually because the form is calling a custom auth handler that bypasses the standard WordPress hook chain; see the CAPTCHA Blocks WooCommerce/MemberPress article for the fix pattern.

How often does the TOTP code change, and what's the clock-skew tolerance?

TOTP codes rotate every 30 seconds by the RFC 6238 standard, which is what GuardPress and every mainstream authenticator app implement. The verifier typically accepts codes within a small window of the current time to allow for minor clock drift. If your codes are consistently rejected, the most common cause is your device clock being out of sync — enable 'Set time automatically' on iOS/Android or sync the system clock on desktop, then try a fresh code.

Setting Up Two-Factor Authentication

2FA is the single highest-value security setting you can turn on. A compromised password stops being enough to sign in, so a leaked or brute-forced credential no longer gets an attacker into your admin. GuardPress ships 2FA off by default, though, for one reason: the fastest way to lock yourself out of your own site is to enable 2FA without an authenticator app configured or backup codes stored somewhere safe. This is the order that avoids that.

Why 2FA is worth 10 minutes of your time

Every WordPress site with a login form is a target. Attackers don’t need to know anything about your site to try; they run credential-stuffing lists (username / password pairs leaked from other breaches) against thousands of WordPress sites per hour. Brute-force protection catches the noisy attempts, but a single hit from a leaked credential pair is only one request. It doesn’t trigger any rate limit.

2FA breaks that whole class of attack. Even if your password shows up in a credential dump tomorrow, an attacker still needs the rotating 6-digit code from your phone to complete the sign-in. The attacker doesn’t have that, so the attempt fails silently and the credential is worthless against your site.

Every other security setting in GuardPress reduces attack surface. 2FA eliminates one specific attack vector entirely. That’s why it’s the single highest-leverage security setting you can enable, and why it’s the first thing to configure after installation.

The 5-minute setup, in order

Follow these in order. Do not skip step 4 (backup codes) — it’s the recovery path when everything else fails.

Install a TOTP authenticator app on your phone

Do this before you touch WordPress, so the QR code has somewhere to go. Any of these work equally well because the standard (RFC 6238) is identical across vendors:

1Password / Bitwarden — recommended if you already pay for a password manager. 2FA codes sync across devices with your vault, so a lost phone doesn’t lock you out.
Authy — free, cross-device sync via encrypted cloud backup.
Google Authenticator — free, simplest possible option. Now supports cloud backup if you sign in with a Google account.
Microsoft Authenticator — free, works well if you’re already in the Microsoft 365 ecosystem.

Avoid apps that require an account without an export option. If you can’t back up or migrate your codes, losing your phone locks you out of every 2FA-protected account, not just WordPress.

Enable 2FA in GuardPress → Settings

Open GuardPress → Settings → Two-Factor Authentication. Flip the enable toggle on. Save. This turns on the 2FA challenge on the next sign-in, but doesn’t pair your account yet.

Pair your authenticator app with the QR code

Once enabled, GuardPress shows a QR code on your user profile page (Users → Your Profile → Two-Factor Authentication section). Open your authenticator app, tap Add, and scan the QR code. It adds a Your Site Name entry with a rotating 6-digit code.

Enter the current 6-digit code into the confirmation field on the profile page before saving. This confirms the pairing worked. If the code is rejected, your device clock is likely out of sync — TOTP is time-based, so it only tolerates ~30 seconds of drift. Fix the clock and try again.

Save the backup codes off-device

GuardPress generates 10 one-time backup codes when you enable 2FA. These are your only recovery path if your authenticator app is lost or wiped, so treat them like a spare house key.

Store them somewhere that is not your primary phone or laptop:

Password manager (recommended): paste them into a secure note in 1Password, Bitwarden, or similar. Available from any device you sign in on.
Printed paper: print the codes and file them somewhere safe (locked drawer, home safe, safety deposit box). Old-school but reliable.
Encrypted note: save them to a locally-encrypted notes app that syncs to a separate device (encrypted iCloud/Google Drive note, Standard Notes, Notesnook, etc.).

Each code is single-use. Once you use one, cross it off the list and re-generate a new set from the profile page if you’re getting low.

Sign out and test the full flow

This is the step people skip. Don’t. Sign out of WordPress. Sign back in. Confirm the 2FA prompt appears and that a fresh code from your app lets you through.

If the sign-in fails, don’t force it: use one of your backup codes to get in, then re-pair the authenticator app before signing out again. Discovering a broken 2FA setup while you’re signed in is a five-minute fix. Discovering it after you’re signed out is an emergency.

Supported authenticator apps at a glance

App	Cost	Cross-device sync	Export
1Password	Paid	Yes (with vault)	Yes
Bitwarden	Free (paid for advanced)	Yes (with vault)	Yes
Authy	Free	Yes (encrypted cloud)	No
Google Authenticator	Free	Yes (with Google account)	Yes (QR export)
Microsoft Authenticator	Free	Yes (with Microsoft account)	Limited
Aegis (Android)	Free	Manual backup file	Yes
Raivo (iOS)	Free	iCloud backup	Yes

All of these implement the same TOTP standard, so any of them will pair with GuardPress’s QR code identically. The differences that matter for real-world use are (1) whether you lose your codes if you lose your phone, and (2) whether you can migrate between apps later.

Backup codes: the step people regret skipping

Every 2FA support ticket that ends in “I can’t sign in to my own site” starts the same way: the user enabled 2FA, didn’t save the backup codes, and then lost their phone / switched authenticator apps / factory-reset their device / had their Google account suspended. The account is now permanently 2FA-locked and the only recovery paths are painful.

What the backup codes actually are: 10 single-use, 8-character strings that each substitute for a valid TOTP code on the 2FA prompt. Each one is good for exactly one sign-in, then it’s invalidated. Once you use one, cross it off. When you’re down to 2–3 unused codes, re-generate a fresh set from your user profile (this invalidates any remaining old codes).

The password-manager pattern

Save the backup codes as a secure note in the same password manager where your GuardPress site’s login is stored. That way, if you can access your password manager, you can always recover 2FA on the sites protected by 2FA in that manager. If you lose access to the password manager itself, that’s a bigger problem than one site — but the password manager vendors themselves have well-established account-recovery flows.

If you did enable 2FA and didn’t save the backup codes, see 2FA Recovery for the wp-config disable path. It’s a last-resort mechanism, but it exists.

Per-role enforcement for team sites

On sites with more than one user, you almost never want to force every subscriber to enable 2FA — the ratio of “user friction” to “actual risk reduction” is bad for low-privilege roles. But you do want to require 2FA for Administrators, and probably Editors and Shop Managers.

GuardPress supports this natively. In Settings → Two-Factor Authentication → Enforcement, tick the roles that must have 2FA enabled. Users in those roles who haven’t configured 2FA yet get redirected to the setup page on their next sign-in and cannot dismiss it until they pair an app.

Common role-based patterns:

Blog / marketing site: require for Administrator, encourage for Editor, leave off for Author and Contributor.
WooCommerce store: require for Administrator and Shop Manager, encourage for Editor, leave off for Customer.
Membership site: require for Administrator and any staff role that can moderate content, leave off for Member and Subscriber.
Agency-managed site: require for Administrator (yourself) and any client-side role that has publishing rights.

See Per-Role 2FA Enforcement Setup for the exact settings screen. When you change the enforced-role list, existing users in newly-enforced roles get a 7-day grace period (banner shown at every admin view) before the hard redirect to the setup page kicks in.

What to do when 2FA breaks

Lost phone / new phone / factory-reset device

Use a backup code to sign in, then re-pair your authenticator app on the new device. Delete the old device from any authenticator apps that support device management. If you don’t have backup codes, see 2FA Recovery for the wp-config disable path.

Codes are rejected even though the app is showing them

Clock drift. TOTP tolerates only ~30 seconds of skew between your device and the server. Fix: on iOS/Android, turn on “Set time automatically.” On desktop authenticator apps, sync the system clock. Retry the code from the app (wait for the next rotation).

Authenticator app was deleted and I don’t have backup codes

Last-resort path: 2FA Recovery documents a define('GUARDPRESS_DISABLE_2FA', true) constant you can drop into wp-config.php via SFTP or your host’s file manager. Signs you in without a 2FA prompt for the next session, letting you re-pair. Remove the constant immediately after.

I’m getting locked out during 2FA setup because I keep entering the wrong code

Brute-force protection counts wrong 2FA codes toward the lockout threshold. If you’re actively pairing an app and mistyping, whitelist your own IP first (GuardPress → IP Management → Whitelist My IP) so you don’t lock yourself out mid-setup.

2FA prompt isn’t appearing on my custom login form

GuardPress hooks the standard WordPress authentication filter chain, so any login form calling wp_signon() or the REST auth endpoints picks up 2FA. Custom login forms that bypass those (some page builders, some legacy membership plugins) won’t. See CAPTCHA Blocks WooCommerce/MemberPress Login for the pattern — same fix applies to 2FA.