Keep Your Account Safe With Multi-Factor Authentication

Protecting your account is more important than ever. Multi-Factor Authentication (MFA) is one of the best ways to keep yourself secure. 

This guide will explain the different MFA options WP Engine supports via our User Portal, how they work, and how they compare in terms of security.

What is multi-factor authentication?

MFA adds an extra layer of security beyond just your password. It requires you to verify your identity using a combination of two or more different methods:

1. Something you know (like your password)
2. Something you have (like your phone or a security key)
3. Something you are (like your fingerprint)

By requiring multiple verification methods, MFA makes it much harder for hackers to gain unauthorized access to your WordPress site on WP Engine.

Our supported MFA options

1. Email authentication

What it is: Email MFA sends a one-time code to your registered email address when you attempt to log in.

Setup: Automatically enabled for all accounts on WP Engine.

Security level: ★★☆☆☆ (Basic)

Protects against: Password theft, brute force attacks

Limitations: If your email account is compromised, this method becomes vulnerable. Also, email delivery can sometimes be delayed or blocked by spam filters.

Best for: Users who want a simple solution without installing additional apps.

2. Okta Verify

What it is: A mobile app that sends push notifications to your phone for authentication.

Setup:

1. Download Okta Verify from the Google Play Store or the Apple App Store.
2. Select “Okta Verify” in the MFA page.
3. Follow the guided setup process.

Security level: ★★★★☆ (Strong)

Protects against: Password theft, phishing, and man-in-the-middle attacks

Limitations: Requires a smartphone and an internet connection.

Best for: Users who want a convenient yet secure option that doesn’t require entering codes manually.

3. Authenticator app

What it is: An app that generates time-based one-time passwords (TOTP) that change every 30 seconds.

Setup:

1. Download an authenticator app (like Google Authenticator) from the Google Play Store or Apple App Store.
2. Scan the QR code provided in the WP Engine User Portal with your app.
3. For backup, scan the same QR code on multiple devices before completing setup.

Security level: ★★★☆☆ (Medium)

Protects against: Password theft, phishing, and replay attacks

Limitations: Copying the code to multiple devices increases the possibility of compromise. 

Best for: Users who want strong security with offline capabilities.

4. Security key or biometric authenticator (FIDO2/WebAuthn)

What it is: Physical security keys (like YubiKey or Google Titan) or built-in biometric authentication (like fingerprint readers or facial recognition).

Setup: Varies based on the specific device, but typically involves registering your security key or biometric data through the User Portal.

Security level: ★★★★★ (Strongest)

Protects against: Password theft, phishing, malware, and sophisticated remote attacks

Limitations: May require purchasing additional hardware (for security keys) or a compatible device (for biometrics).

Best for: Users who want the highest level of security, especially for administrative accounts.

Comparison and recommendations

For casual users

Recommended: Email or Authenticator App

Both provide a good balance of security and convenience. Email requires no setup, while an Authenticator app can offer better security with minimal setup.

For regular business users

Recommended: Okta Verify or Authenticator App

These options provide strong security while remaining convenient for daily use.

For administrators or high-security needs

Recommended: Security Key or Biometric Authentication

These provide the strongest protection against sophisticated attacks and are therefore recommended only for accounts with administrative privileges.

Best practices

1. Enable at least one MFA method beyond email for optimal security.
2. Ensure your WP Engine password is updated and does not match your other passwords.
3. Store backup codes securely. 
4. Keep authentication apps and devices updated.
5. Use phishing‑resistant factors (Okta Verify or FIDO2/WebAuthn) for privileged access.

By implementing MFA, you significantly reduce the risk of unauthorized access to your WordPress site, even if your password is compromised. Choose the method that best fits your security needs and technical comfort level.

Need help?

If you encounter any issues setting up or using any of these MFA methods, please contact our support team for assistance.