Integrations · WordPress
WordPress 2FA with phone approval: the Notakey provider plugin
For anyone running a WordPress site. WordPress logins are among the most brute-forced on the internet; two plugins and a Notakey application turn every login into a password plus a tap on the phone.
How it connects
Two plugins in WordPress, one application on the server
WordPress gets the Two-Factor plugin from wordpress.org and the Notakey Provider for Two-Factor extension. The extension talks to your Notakey authentication server over its API using a service URL, client ID and secret, service ID and service domain that you enter under WordPress Settings.
On the Notakey side you create an application with API credentials scoped for authentication, user management and device management, and set onboarding requirements; phone-number-based SMS verification is one ready-made option. The server can be on-premises or cloud-hosted, and the free tier is enough for a small team.
Users enrol themselves: each one installs Notakey Authenticator, opens their Two-Factor Options in WordPress, starts onboarding and scans the QR code. From the next login, WordPress asks the phone. The site, its theme and its users are otherwise untouched.
What to know before you start
- Both plugins must be installed and activated; the Notakey extension is a provider for the Two-Factor plugin, not a standalone login replacement.
- Users enrol from their own WordPress profile. Each account that should be protected needs to complete onboarding on a phone.
- The API credentials need scopes for authentication, user management and device management. Treat the client secret as a credential when you store it in WordPress.
From zero to the first approval
- 01
Prepare the Notakey server and application
Sign up for a cloud-hosted server or run the appliance on-premises. Create an application with API credentials scoped for authentication, user management and device management, and configure onboarding requirements.
- 02
Install and configure the two plugins
Install and activate the Two-Factor plugin and the Notakey Provider for Two-Factor extension, then enter the service URL, client ID and secret, service ID and service domain under WordPress Settings.
- 03
Onboard users from their own profile
Each user installs Notakey Authenticator, opens Two-Factor Options in WordPress, starts onboarding and scans the QR code to finish setup on their phone. Their next login asks the phone.
Frequently asked questions
- What do I install on the WordPress site?
- The Two-Factor plugin from wordpress.org and the Notakey Provider for Two-Factor extension. The extension is a provider for Two-Factor, not a standalone login replacement.
- Is there a free option for a small site?
- Yes. The free tier is enough for a small team, and the Notakey server can be cloud-hosted, so there is nothing to run yourself.
- How do users enrol?
- Each user installs Notakey Authenticator, opens Two-Factor Options in their WordPress profile, starts onboarding and scans the QR code. Their next login asks the phone.