Protect WP Admin with two-factor authentication

A leaked or reused administrator password is the most common way WordPress sites get hacked. Two-factor authentication (2FA) closes that gap: even if an attacker has the password, they can't log in without the second factor.

This is separate from the 2FA on your Templ account, which protects the Panel. The steps below protect the WordPress login itself.

Recommended plugin

We recommend the official Two Factor plugin. It's maintained by WordPress core contributors, stays lightweight, and supports authenticator apps (TOTP), email codes, and backup codes.

Enable it

In WP Admin, go to Plugins → Add New, search for Two Factor, then install and activate it.
Open Users → Profile and scroll to Two-Factor Options.
Enable Time Based One-Time Password (TOTP) and scan the QR code with an authenticator app such as Google Authenticator, 1Password, or Authy.
Enable Backup Verification Codes and store the generated codes somewhere safe, so you can still get in if you lose your device.

Enable 2FA for every administrator account, not just your own. A single unprotected admin login is all an attacker needs.

The one-click WP Admin button in the Templ Panel keeps working, since Templ Token Login authenticates without a password. If 2FA ever locks you out, deactivate the two-factor plugin from the Panel's Deactivate Plugins tool to regain access.