Brute force attack is one of the most common security problems for WordPress websites. Every now and then, hackers try to take control of websites with brute force techniques. Most of the time, they try to exploit the ignorance of newbie WordPress site managers.
Beginners make mistakes like creating admin accounts with obvious names like admin, administrator, master, root, test, etc., not using strong passwords, and not keeping proper backups and so on. While these issues could be prevented with some wise thinking, there’s a stronger method which can bullet-proof your website security.
I am talking about Google Authenticator’s two factor authentication system. If you really want to protect your WordPress website you should use a two factor authentication system.
How Two Factor Authentication Works?
If enough time is provided, any password could be cracked. The time needed for cracking the password depends on the structure of the password. You can get a rough idea about the time required to break a password in sites like howsecureismypassword.net.
There is a dangerous tendency among people where they use the same password in many sites. If one of the sites gets hacked your secret key to all the other sites are in the hands of the criminals. More alarmingly, some people do not even change their passwords after these types of events take place.
Now, if you are using a two factor authentication system you will still be safe in these cases. The fact that your website will be connected to your mobile device means that hackers won’t be able to take control of your website unless they take full control of your mobile device too.
How to Install Google Authenticator
First of all, you will need to install and activate Google Authenticator plugin from the WordPress plugin repository. Next you need to install Google Authenticator on your mobile device. Currently, the platform works on Android, iOS, Windows Phone, BlackBerry, WebOS and PalmOS.
In this tutorial I will use an Android device, but you can use any supported device you like. The process is similar for all mobile devices.
Go to the app store of your mobile device and search for ‘Google Authenticator’ and install it. Now, let’s get back to our website.
Setting Up Authenticator on the Website
From the dashboard, go to Users > Your Profile. You will see a new section like this.
You can turn on/off the authentication system by checking/unchecking the ‘Active’ checkbox. Below, the relaxed mode will allow you to extend the code validation limit. By default, the code remains valid for 1 minute. You can increase it to 4 minutes by checking the box.
Next, enter a description of your website, which will also work as the username of your Authenticator account. Provide a secret key in the box below. You will need the key to use Authenticator on your mobile device.
Lastly, the ‘Enable App Password’ is used if you are using remote publishing (XML-RPC) on your website. However, enabling this will decrease your overall security. So, do it at your own risk.
Setting Up Authenticator on Your Mobile Device
When you open Google Authenticator for the first time on your mobile device, you will be provided with a welcome screen like this:
Click ‘Begin Setup.’ On the next screen, you will be prompted to Add an account. Click on ‘Enter provided key.’
On the following account entry section, provide the account name, secret key and select ‘Time based’ as the authentication method.
You will be provided with a success screen on the resulting screen. You can use the code to log into your two factor authentication-enabled website.
Logging into a Two Factor Authentication-enabled Website
Now, when you try to log in to your two factor authentication-enabled WordPress website, you will see an additional field titled ‘Google Authenticator code.’
You will find a new authenticator every time you open the app in your mobile. You can also request a new code by hitting the refresh button on the right.
So that was how you install and set up a two step authentication system on your website. Let me know if you still have any questions. I will try my best to address them.