How to set up two-factor authentication and update your password

We’re strengthening the security of every website we host and support. As part of that, everyone who logs in to a Devstars-managed WordPress site needs a strong password and two-factor authentication (2FA).

2FA means that when you log in, you enter your password plus a six-digit code from an app on your phone. Even if someone gets hold of your password, they can’t get in without your phone. It’s the same idea as the codes your bank sends you.

This guide walks you through both steps. It takes about five minutes.

Before you start

You’ll need:

1. Your current username and password for your website.
2. A smartphone with a free authenticator app installed. We recommend Google Authenticator or Microsoft Authenticator, both available from the App Store and Google Play.
3. Five minutes and a quiet moment.

Part 1: Update your password

1. Log in to your website. The login page is usually your web address followed by /wp-admin, for example yourwebsite.co.uk/wp-admin.
2. In the left-hand menu, go to Profile (or Users > Profile).
3. Scroll down to Account Management and click Set New Password.
4. WordPress suggests a strong password for you. You can use it, or type your own. Our security plugin won’t accept weak passwords, or passwords that have appeared in known data breaches.
5. Save the new password in a password manager or somewhere secure.
6. Click Update Profile at the bottom of the page.

Forgotten your current password? Click Lost your password? on the login page and follow the email link to set a new one.

Part 2: Set up two-factor authentication

1. Install Google Authenticator or Microsoft Authenticator on your phone, if you haven’t already.
2. Log in to your website and go to Profile (or Users > Profile).
3. Scroll down to the Wordfence Login Security section and click Activate 2FA. You may also see a notice at the top of your dashboard, or an email from us, with a link to the same page.
4. You’ll see a QR code on screen. Open your authenticator app, tap the + button and choose Scan a QR code. Point your phone at the screen.
5. Can’t scan the code? Choose Enter a setup key in the app instead, and type in the key shown just below the QR code.
6. Your app now shows a six-digit code for your website. It changes every 30 seconds.
7. Download or copy your recovery codes and keep them somewhere safe, such as your password manager. Each code works once, and lets you log in if you lose your phone.
8. Type the current six-digit code from your app into the box on screen and click Activate.

That’s it. 2FA is now switched on for your account.

Logging in from now on

Enter your username and password as normal. You’ll then be asked for a six-digit code. Open your authenticator app and type in the current code for your website.

You may see an option to remember your device for 30 days. Only tick this on your own computer, never on a shared or public one.

If something goes wrong

• Your code isn’t accepted. Codes change every 30 seconds, so type the current one quickly. If it still fails, check that your phone’s date and time are set automatically.
• You’ve lost or changed your phone. Log in using one of your recovery codes instead of the six-digit code, then contact us and we’ll help you set up 2FA on your new phone.
• You’re locked out. Contact us and we’ll get you back in.

Keeping your account safe

We will never ask for your password, your six-digit codes or your recovery codes by email, phone or text. If you receive a request like that claiming to be from Devstars, please don’t respond, and let us know straight away.

Need help?

If you get stuck at any point, just reply to our email or contact us via email here, and we’ll talk you through it.