Installing Wordfence and Implementing Two-Factor Authentication

Wordfence is one of the most widely used WordPress security plugins. Its free version adds a firewall inside WordPress, a malware and file-change scanner, brute-force protection and two-factor authentication (2FA) for your logins. This guide shows how to install it, set up each part without slowing your site, turn on 2FA for every administrator, and get back in if something locks you out.

1. What Wordfence does, free and paid

The free version is enough for most small business sites. Don't install a second security plugin alongside it: two firewalls or two login limiters often conflict, lock out real users or slow every page. Our guide to WordPress security plugins compares Wordfence with the alternatives.

2. Install Wordfence

3. Optimise the firewall

Out of the box, the Wordfence firewall runs only when WordPress loads. Extended protection makes it run before any PHP file on your site, including vulnerable plugin files that attackers call directly.

New firewalls start in Learning Mode for about a week, so Wordfence can learn your site's normal traffic before it blocks anything. Leave it there, then check that Protection Level shows Extended Protection and the status is Enabled and Protecting.

4. Brute-force protection

Most login attacks are bots guessing passwords. In Wordfence › All Options › Brute Force Protection:

• Lock out after a small number of failed logins, such as 5, and set a lockout period of a few hours.
• Immediately lock out invalid usernames, so bots trying admin are blocked at once. Don't use admin as a real username.
• Prevent the use of passwords leaked in data breaches for administrators.
• Don't let WordPress reveal valid usernames in its login error messages.

If you lock yourself out, Wordfence's block page offers to email an unlock link to the administrator address.

5. Scans

Go to Wordfence › Scan and click Start New Scan once after installing. The free version then runs scheduled scans automatically; choosing the time is a Premium feature.

• Keep the Standard scan. High Sensitivity finds more but raises false alarms and uses more server time.
• On shared hosting, turn on Use low resource scanning under All Options › Scan Options if scans make your site slow. A full scan counts towards your account's CPU and memory limits like any other PHP work; see understanding hosting resource limits.
• Read each result before acting. "Modified core file" and "unknown file in WordPress core" deserve a close look; an out-of-date plugin just needs updating.

6. Set up two-factor authentication

With 2FA, a stolen password is no longer enough to log in. You need a free authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or Authy; see popular 2FA apps.

Then open the Settings tab of Login Security:

• Require 2FA for the Administrator role at least, and for editors and shop managers too if they can publish or see orders.
• Give each person their own account; 2FA is per user, so a shared login can't be protected properly.
• Leave XML-RPC covered by 2FA, or disable XML-RPC authentication if you don't use the WordPress mobile app or Jetpack.
• Optionally turn on reCAPTCHA for the login page to cut bot traffic further.

This protects your WordPress logins. Your Domain India client area has its own two-factor authentication; turn that on too with enable two-factor authentication.

7. Alerts and Live Traffic

• Email alerts: in All Options › Email Alert Preferences, keep alerts for an administrator login from a new device, a new administrator account, scan problems and plugin updates. Switch off noisy ones, such as every single blocked IP address, so you still read the important ones.
• Live Traffic: under Wordfence › Tools › Live Traffic, the default logs security-related traffic only. Keep it that way on shared hosting; logging all traffic writes to your database on every visit.

Order confirmations and Wordfence alerts both leave through PHP mail(). On our cPanel servers, most SMTP mail plugins can't connect because the socket functions they need are disabled; see PHP sendmail settings.

8. If Wordfence locks you out

• Blocked by the firewall or a lockout: use the unlock email link on the block page, or wait for the lockout to expire.
• Lost your phone: log in with a recovery code, then set up 2FA again. Another administrator can also reset 2FA for your account.
• Nothing else works: in your control panel's File Manager, rename wp-content/plugins/wordfence to wordfence-off. WordPress deactivates Wordfence, including its 2FA, and you can log in. If you used extended protection, also remove the auto_prepend_file line from .user.ini in your site's main folder. Rename the folder back afterwards and fix the setting.

9. What Domain India hosting already does

Measured on our servers on 20 September 2026, cPanel accounts get Imunify360 with a web application firewall and WordPress protection switched on, and automatic removal of malicious code from infected files, keeping the originals for 14 days. You aren't emailed when it removes something, so Wordfence's alerts fill that gap. CloudLinux CageFS isolates each account on cPanel and DirectAdmin, and JetBackup 5 takes a weekly backup every Sunday, keeping 5 copies you can restore yourself.

Prices on the card are live and exclude 18% GST. If your site has already been hacked, follow the security checklist for hacked websites first: a plugin installed after a hack won't remove a backdoor that is already there.

Frequently asked questions

Ready to lock down your site? Install Wordfence, turn on 2FA for every administrator today, and read the WordPress hardening guide for the next steps. Need help with your hosting account? Open a support ticket or use our 24/7 live chat.