Two Step Authentication for WordPress Admin in Nginx and Apache

Updated: 11 October 2026 · Applies to: WordPress 7.1 on Apache (cPanel) and Nginx

Two-step (two-factor) authentication asks for a code from an app on your phone in addition to the password. It stops most attacks with stolen or guessed passwords. For WordPress 7.1 there are two layers you can combine.

1. Two-factor login inside WordPress

1. In WordPress, go to Plugins › Add Plugin and search for Two-Factor (the plugin maintained by WordPress contributors), or use the login security of a security plugin you already have.
2. Install and activate it.
3. Open Users › Profile, enable the authenticator app (TOTP) method, scan the QR code with an app such as Google Authenticator or Authy, and enter a code to confirm.
4. Generate the backup codes and store them safely.

Ask every administrator and editor to set it up.

2. Protect the login page on the server (optional)

A password prompt from the web server in front of wp-login.php stops bots before WordPress loads.

Apache / cPanel: in cPanel, Files › Directory Privacy protects whole folders; for only the login file, add this to .htaccess (create the password file with htpasswd outside public_html):

<Files wp-login.php>
    AuthType Basic
    AuthName "Login"
    AuthUserFile /home/USER/.htpasswds/wp-login
    Require valid-user
</Files>

Nginx:

location = /wp-login.php {
    auth_basic "Login";
    auth_basic_user_file /etc/nginx/.htpasswd;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/run/php/php8.3-fpm.sock;
}

Note: Do not password-protect the whole /wp-admin/ folder: admin-ajax.php is used by visitors and plugins. If you lose access to your 2FA app, disable the plugin by renaming its folder over FTP or File Manager, log in, and set it up again.