Website security is never a finished job. The bad guys change their tactics constantly, and the measures we use to protect the websites we manage need to evolve with them.
For that reason, Dotwise is introducing two-factor authentication (2FA) as a standard security measure for administrator accounts on the WordPress websites we manage.
Despite following best practice, including using strong, unique passwords and never sharing them with others, password-only authentication still carries an inherent risk.
In our experience managing websites, even customers who take sensible precautions can still have passwords compromised and, as a result, suffer unauthorised access to their website. This is one of the main reasons we no longer believe that a password alone provides sufficient protection for administrator accounts.
Administrator password compromise is the #1 reason our customers’ sites get hacked today.
What is two-factor authentication?
Traditionally, logging into WordPress requires a username and password. The problem is that passwords can be compromised. They may be guessed, reused across different services, exposed in a data breach or obtained through phishing.
Two-factor authentication adds another layer.
With 2FA enabled, an administrator logs in using their username and password as normal, but is then asked for a temporary security code generated by an authenticator app on their phone or another device.
This means that knowing the password alone is no longer enough to gain access to the website.
You’ll probably be familiar with this approach and may already have an authentication app on your mobile phone already.
For the websites we manage, we will normally implement 2FA using WordFence Login Security, part of the WordFence security software that we already use extensively across our managed WordPress sites.
Why are we making this change?
Administrator accounts are particularly important because they normally have almost complete control over a WordPress website. Depending on the site’s configuration, an administrator may be able to install software, create other users, change website content and alter important settings.
Protecting these accounts therefore deserves more than reliance on a password alone.
Strong, unique passwords remain important, but 2FA substantially reduces the usefulness of a stolen password. An attacker who obtains the password still needs the second authentication factor before they can log in.
For this reason, we now regard 2FA as an appropriate baseline security measure for administrator access to the websites under our care.
What will happen?
We will be reviewing the websites we manage and identifying those where administrator accounts are not currently protected by 2FA.
Where appropriate, we will install or configure Wordfence Login Security and enable 2FA for administrator accounts.
The next time an affected administrator logs into WordPress, they will be asked to complete a short setup process. This normally involves scanning a QR code with an authenticator app such as Google Authenticator or Microsoft Authenticator. Any equivalent app will also work.
Once configured, the app generates the temporary codes required when logging into the website.
We will, of course, provide assistance where required.
Can I opt out?
Yes.
There may be reasons why a customer does not want 2FA enabled. We therefore won’t make it an absolute requirement for every customer.
However, our recommendation will be that 2FA remains enabled for all administrator accounts. Customers who choose not to use it should understand that they are choosing to operate with a weaker form of login protection than we recommend.
What about passkeys?
There is also a newer approach to authentication that you may increasingly encounter: passkeys.
WordFence has introduced support for passkey authentication. A passkey allows you to authenticate using a trusted device rather than entering a conventional password and a temporary 2FA code.
Depending on the device, that might mean confirming your identity using a fingerprint, facial recognition, a device PIN or another secure mechanism.
Passkeys have some significant security advantages: they are resistant to many of the phishing techniques that can be used to steal passwords and even temporary 2FA codes.
They can also make logging in quicker: rather than entering a password and then opening an authenticator app to obtain a six-digit code, authentication can often be completed directly on the device.
Why aren’t we moving everyone to passkeys?
For the moment, we are taking a more cautious approach.
Traditional authenticator-app 2FA is widely understood and works consistently across the very wide range of customers that we support, from small businesses to government departments.
Passkeys introduce some additional considerations. They can be stored and synchronised in different ways depending on whether someone uses Apple, Google, Microsoft or other password-management systems. Customers may also use several computers or phones, share responsibility for administering a website between several people, or replace devices.
None of these issues makes passkeys a bad solution. On the contrary, we expect passkeys to become increasingly important and they may ultimately become the preferred way of authenticating to WordPress.
But for now, we don’t think introducing a relatively new authentication workflow simultaneously across every website we manage is necessary.
Our approach
Our default will therefore be straightforward:
Administrator accounts should use two-factor authentication (2FA).
We will normally implement this using an authenticator app and Wordfence Login Security. Customers who specifically want to use Wordfence’s new passkey functionality can ask us to enable and configure it for their website.
This gives us a consistent security baseline across the websites we manage, while allowing customers who are ready to adopt passkeys to take advantage of the newer technology.
Security measures inevitably introduce a small amount of additional inconvenience. In this case, we think the trade-off is worthwhile. Administrator access is simply too powerful to protect with a password alone.