How to Set Up Two-Factor Authentication (2FA) in WordPress with All-In-One Security (AIOS)

Two-factor authentication (2FA) adds a second layer of protection to your WordPress login. Even if your password is guessed, leaked, or stolen, an attacker cannot log in without a time-based one-time code generated on your own device. This article walks through enabling and configuring 2FA using the All-In-One Security (AIOS) plugin, from login to your first protected sign-in.

What You Need Before Starting

• A WordPress site with the All-In-One Security (AIOS) plugin installed and activated. The free version from the WordPress plugin directory includes 2FA for standard WordPress login forms.
• An administrator account on the site.
• A smartphone or tablet on which to install an authenticator app (see next section).

AIOS 2FA uses the open TOTP standard (time-based one-time passwords). The codes are generated locally on your device from a shared secret, so no network connection, SMS, or phone number is required, and no third party is involved in your logins.

Step 1: Install an Authenticator App

Any TOTP-compatible authenticator app will work. Noiz recommends fully free and open-source (FOSS) options, as their code is publicly auditable and they do not tie your 2FA secrets to a vendor account:

• FreeOTP+ (Android, available on F-Droid and Google Play) - the Noiz preferred option, with encrypted export/backup support.
• Aegis Authenticator (Android, F-Droid and Google Play) - FOSS, with encrypted vault and backup support.
• FreeOTP (iOS, App Store) - the original Red Hat FOSS authenticator.

Proprietary options such as Google Authenticator, Microsoft Authenticator, and Authy are also fully compatible if you already use one of them.

Install your chosen app before proceeding. You will need it in Step 3.

Step 2: Enable Two-Factor Authentication in AIOS

1. Log in to your WordPress admin dashboard at https://yourdomain.com/wp-admin (or your custom login URL if AIOS login page rename is active).
2. In the left-hand admin menu, click WP Security.
3. Click Two Factor Auth in the WP Security submenu.
4. Open the Admin settings section. Here you control which user roles are allowed to activate 2FA on their accounts.
5. Tick the roles that should have 2FA available. At minimum, enable it for Administrator. Enabling it for Editor and other privileged roles is strongly recommended.
6. Click Save Changes.

This makes 2FA available for those roles. Each user then activates it on their own account, as follows.

Step 3: Activate 2FA on Your Account

1. Still under WP Security > Two Factor Auth, locate the activation section for your own account and set two-factor authentication to Enabled / Active.
2. A QR code and a private key (a string of characters) will be displayed. These represent the shared secret between the site and your authenticator app.
3. Open your authenticator app and add a new account:
   • Scan the QR code using the app's built-in scanner (fastest method), or
   • Enter the private key manually if your device cannot scan the screen.
4. The app will immediately begin generating six-digit codes that refresh every 30 seconds.
5. Important: before logging out, confirm that the current code shown in your app matches the current code shown on the AIOS Two Factor Auth page. If they match, the pairing is correct. If they do not match, check that the date and time on your phone are set to automatic, as TOTP depends on accurate clocks.
6. Save the settings.

Step 4: Test the Login

1. Log out of WordPress.
2. Log in again with your username and password as normal.
3. You will now be prompted for a one-time password. Open your authenticator app and enter the current six-digit code for the site.
4. You are logged in. From now on, every login requires both your password and a fresh code from your device.

If You Get Locked Out

If you lose access to your authenticator device and cannot generate codes, 2FA can be temporarily disabled by anyone with file-level access to the site. Add the following line to wp-config.php, just above the line that says /* That's all, stop editing! */:

define('TWO_FACTOR_DISABLE', true);

Log in, reconfigure 2FA with your new device, then remove the line again so protection is restored. File access is available through your hosting control panel's file manager or over SFTP. If you are on a Noiz managed WordPress plan, contact the Noiz support team and this can be handled for you.

The premium version of AIOS additionally supports one-time emergency backup codes, which can be generated in advance and stored somewhere safe for exactly this situation.

Free vs Premium 2FA Features

The free version covers standard WordPress login forms and is sufficient for most sites. AIOS Premium adds, among other things:

• 2FA on WooCommerce, Elementor Pro, and other custom login forms.
• Making 2FA compulsory for selected user roles, rather than optional.
• Emergency backup codes for account recovery.
• Trusted devices, so a code is only required every set number of days per device.
• WordPress multisite support.

Official Documentation

For further detail on AIOS two-factor authentication, refer to the official resources maintained by the plugin developer, TeamUpdraft:

• AIOS Two-Factor Authentication overview
• AIOS 2FA shortcodes documentation (for offering 2FA management to front-end users on membership or WooCommerce sites)

Need Help?

If 2FA is not behaving as expected, codes are being rejected, or you would like 2FA rolled out across multiple users or sites, contact the Noiz support team. Please note that if you are not on a managed WordPress plan, this work may be billable.