A stolen or guessed password is still the most common way into a WordPress site. Two-factor authentication closes that gap by requiring something the attacker does not have, even if they have the password. But “turn on 2FA” is not one decision. The method you pick determines whether you are actually raising the bar or just adding friction that a patient attacker can route around.
Why the password alone falls short
Credential stuffing, reused passwords from unrelated breaches, and brute-force attempts against wp-login.php are constant background noise on the web. A password, no matter how strong, is a single static secret. Once it leaks once, it is compromised everywhere it was reused. Second factors work because they require possession or biometrics in addition to knowledge, which is a fundamentally different kind of proof.
SMS codes: convenient, weakest
Text-message codes are the easiest second factor to explain to a team, since almost everyone already knows how to receive a text. That is also their biggest liability: they route through phone carriers, and carrier accounts can be hijacked through SIM swapping, where an attacker convinces a carrier to port a victim’s number to a new SIM. Once that happens, every SMS code sent to that number goes straight to the attacker. SMS is also phishable in real time: a fake login page can prompt a victim to type the code they just received, and a bot on the other end relays it to the real site within seconds.
SMS is better than no second factor at all, but treat it as a baseline, not a destination. If it is the only option a client or contributor will accept, use it, but plan to upgrade later.
TOTP: solid, phishable, easy to deploy
Time-based one-time passwords (TOTP), generated by apps like an authenticator app on a phone, are a meaningful step up. The shared secret lives only on the device and the server, so there is no carrier in the middle to attack, which makes TOTP immune to SIM swapping. Codes rotate every 30 seconds and are generated offline, so there is no text message to intercept.
The remaining weakness is phishing. A convincing fake login page can still ask for the current TOTP code, and if the victim types it in, the attacker can use it within the short validity window. TOTP does not verify that the login attempt is happening on the real domain, it just proves the person has the secret. For most WordPress sites, TOTP is a strong, practical default: it is supported by most 2FA plugins, works offline, and requires no telecom trust.
Passkeys: the strongest option today
Passkeys use public-key cryptography tied to the origin of the site. When you register a passkey, the browser or device creates a key pair and only ever releases the private key’s signature to the exact domain it was created for. This is what makes passkeys resistant to phishing in a way SMS and TOTP are not: a lookalike domain simply cannot request a valid signature, because the credential is bound to the real site’s origin. There is no code to read aloud, copy, or relay. Passkeys are also immune to SIM swaps since there is no phone number involved at all.
The tradeoff is maturity of tooling. Passkey support in WordPress plugins is newer and less universal than TOTP, and it depends on the user’s device or browser supporting platform authenticators (fingerprint, face recognition, or a hardware key). Where it is available, it is the strongest option. Where it is not yet supported for your setup, TOTP remains the reliable fallback.
The ranking
- Passkeys: strongest. Phishing-resistant by design, immune to SIM swapping, no shared secret to steal.
- TOTP (authenticator apps): strong and widely compatible. Immune to SIM swapping, but a determined real-time phishing attack can still capture a code.
- SMS: weakest, but still better than nothing. Vulnerable to SIM swapping and real-time phishing relays.
Rolling it out to a reluctant team
Technical superiority does not matter if nobody enables it. A few things tend to make adoption stick:
- Start with the accounts that matter most. Administrator and editor roles that can install plugins or edit code are the highest-value targets. Require 2FA there first, and expand from that base rather than mandating it everywhere on day one.
- Give one recommended path, not three options. Decision fatigue kills adoption. Tell your team “use an authenticator app, here is how,” with a short setup walkthrough, rather than listing every method and letting people pick the weakest one out of convenience.
- Set a grace period, then enforce. Most 2FA plugins support a soft rollout where users are prompted but not blocked for a set window before enforcement begins. This gives people time to set it up on their own schedule instead of getting locked out mid-task.
- Keep backup codes somewhere real. Print them, store them in a password manager, whatever works, but make sure losing a phone does not turn into an emergency ticket. This single step prevents most of the pushback you will hear about 2FA being “risky.”
- Explain the why in one sentence. “This stops someone who steals or guesses your password from getting in” lands better with a non-technical team than a lecture on cryptography.
Practical notes for WordPress
Enforce 2FA through a dedicated plugin rather than rolling your own, since these plugins integrate with the login flow, handle backup codes, and support enforcement policies by role. Use wp-cli to audit who currently has administrator or editor access (wp user list --role=administrator is a good starting query) before deciding who needs 2FA first. Pair 2FA with a hardening layer at the edge: a service like Cloudflare sitting in front of the site can rate-limit and challenge suspicious login attempts before they even reach WordPress, which reduces the volume of brute-force noise your 2FA has to filter. A managed host that already runs this edge layer, ServerBorn included, takes that piece off your plate so 2FA is defending against the attacks that actually get through, not raw automated noise.
Takeaway
SMS is a floor, TOTP is a solid working default, and passkeys are the ceiling for phishing resistance and SIM-swap immunity. Pick the strongest option your team’s devices support, roll it out to your highest-privilege accounts first, and give people backup codes so a lost phone never becomes a lockout. The goal is not perfect security, it is making the easy attacks stop working.