iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The best agency setup is a repeatable, layered baseline—not a single “best” plugin: require phishing-resistant passkeys or security keys where the login stack supports them, otherwise enforce authenticator-app TOTP for every administrator; add rate limiting and an appropriate bot challenge; review XML-RPC and other integrations; and prepare enrollment and account-recovery procedures before enforcement.
WordPress core does not include two-factor authentication (2FA). An agency must add a security plugin or connect WordPress to an identity provider, then operate that control consistently across every client site.
What an agency should standardize
A useful baseline has four layers. Authentication protects the account when a password is exposed. Abuse controls slow automated guessing and credential stuffing. Integration controls prevent security settings from breaking mobile apps, publishing tools, or member areas. Operations make sure staff can enroll, recover access, and prove that every site follows the policy.
Recommended Free Tools
| Layer | Agency baseline | Why it matters |
|---|---|---|
| Credentials | Unique, long passwords for every account; no shared administrator logins. | A second factor cannot compensate for reused or shared credentials and makes attribution difficult. |
| Second factor | Require 2FA for administrators. Prefer passkeys or FIDO2 security keys when the selected login flow supports them; otherwise use TOTP from an authenticator app. | Passkeys and security keys are designed to resist phishing. TOTP is broadly compatible but can still be phished. |
| Abuse controls | Rate-limit login endpoints at the edge or web server, add lockouts or throttling, and use a bot challenge where it fits the site. | These controls reduce automated attacks that a second factor does not stop by itself. |
| Protocol and integration review | Make an explicit XML-RPC decision and test mobile, publishing, API, WooCommerce, and membership workflows. | A policy that blocks a required integration will be bypassed or disabled under pressure. |
| Operations | Maintain an inventory, configuration template, enrollment grace period, recovery path, alerts, and audit record. | Fleet-wide consistency matters more than an impressive feature list on one site. |
WordPress.org’s Brute Force Attacks handbook recommends this layered approach and cautions that “Obscuring the login URL can reduce noise but should not be your only defense.” A hidden login path can be an extra measure, never the primary control.
#1 Best Overall
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Choose the factor before choosing the plugin
Passkeys and FIDO2 security keys
Passkeys use public-key cryptography and a platform authenticator such as a phone, computer biometric, or physical security key. WordPress guidance describes security keys as phishing-resistant platform authenticators. They are the strongest default when the plugin or identity provider presents a complete, reliable passkey flow for the WordPress login page.
Do not buy hardware first and assume it will work. Confirm that the actual WordPress authentication path supports WebAuthn or passkeys, that the browser and devices used by each client support it, and that administrators can register more than one authenticator. A physical FIDO2 security key is a sensible optional backup when the selected system supports that flow; the right model depends on the integration, operating systems, and account policy.
Authenticator-app TOTP
Time-based one-time passwords (TOTP) are the practical fallback for sites whose plugins or identity providers do not support passkeys. Each administrator scans a secret into an authenticator app and enters a rotating code after the password. TOTP is inexpensive and familiar, but a user can be tricked into disclosing a current code on a fraudulent login page. Train users to navigate to the known site or password manager rather than follow unexpected login links.
Recovery factors
Recovery codes, a second registered device, or an administrator-assisted reset are not substitutes for the primary factor. They are controlled escape routes for a lost phone or damaged key. Generate recovery codes during enrollment, store them offline or in an approved password manager, and define who can authorize a reset. Never make “email a code to any address supplied in a support ticket” the recovery policy.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Compare implementation approaches
| Approach | Strengths | Questions to answer before rollout |
|---|---|---|
| WordPress security plugin | Can combine 2FA, login protection, CAPTCHA, firewall, scanning, and WordPress-specific controls in one installation. | Which roles can be enforced? Is there a grace period? Does it support passkeys, TOTP, WooCommerce and membership forms? How are settings copied and audited? |
| External identity provider | Centralizes authentication, lifecycle management, and often passkeys across applications. | Can it protect every required WordPress login, including client-owned administrator accounts and emergency access? What happens if the provider or its connector is unavailable? |
| Separate edge and application controls | Lets an agency use an edge rate limit or challenge independently of the WordPress plugin. | Who validates challenge tokens, maintains rules, and handles false positives? Are API, XML-RPC, and checkout paths excluded or separately protected? |
These are decision dimensions, not a laboratory ranking. The available documentation does not establish an independently tested winner or a comparative percentage of attacks blocked.
Documented Wordfence option for agencies
Wordfence describes its free plugin as an all-in-one product with login security, 2FA, login-page CAPTCHA, firewall, scanner, and centralized management. It also documents Wordfence Central as a dashboard for administering multiple sites, viewing security events, applying settings templates, and organizing teams. Wordfence states that Central can be used with free or Premium license keys and, in its documentation, says there is no charge or site-count restriction. Those are vendor statements, not independent performance measurements, so confirm current terms and capabilities before signing a client agreement.
Role enforcement and grace periods
Wordfence’s Login Security documentation describes role-based 2FA, a grace period before lockout, and status information showing users who have not enrolled. An agency can use the grace period to enroll staff and clients without creating an immediate outage, then switch the policy to enforcement after support coverage is ready. Record the selected roles and deadline in the client’s change log; otherwise an exception can become permanent.
Central and multisite details
Central is aimed at fleets of independent sites, but a WordPress multisite network needs separate handling. Wordfence says Central should be connected to the top-level site for each network. Its login-security user count may show only the main site, while per-subsite user pages provide the details. Treat “many client sites” and “many subsites in one network” as different inventory problems and verify both views during a pilot.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Standalone Login Security lifecycle
Wordfence’s standalone Login Security plugin documentation announced expected discontinuation around July 1, 2026 and directs sites to install the full Wordfence plugin to retain login-security functionality. That date has passed, so check the vendor’s current documentation and the WordPress plugin directory before deployment. Do not begin a new fleet standard on the standalone plugin unless its current support status is explicitly confirmed. The documentation says existing 2FA remains active after installing the full plugin; still test the migration on a staging copy and keep an administrator recovery path available.
Build the layered controls around 2FA
Rate-limit the login surface
Apply limits at the edge or web server as WordPress recommends, then use application-level lockouts or throttling where available. Protect wp-login.php and equivalent custom login endpoints, but account for legitimate bursts from a support team, scheduled publishing, or a membership launch. Set an alert for repeated lockouts rather than silently increasing limits until the attack disappears.
Use a bot challenge for the right traffic
Cloudflare Turnstile is a browser widget that issues a token which the server must validate. Cloudflare documents that it can be used whether or not a site is proxied through Cloudflare. Turnstile is a bot or form challenge, not a second authentication factor, and it does not replace administrator 2FA. Add it to login or password-reset flows only after testing screen readers, privacy requirements, caching, and legitimate API traffic.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Decide what XML-RPC should do
XML-RPC may be required by the WordPress phone app, Jetpack, remote publishing tools, or another integration. WordPress guidance supports protecting or restricting it, and Wordfence documents a setting that can reject XML-RPC authentication unless the user has 2FA. Wordfence also warns that applications and services using authenticated XML-RPC may stop working under that policy, explicitly mentioning the phone app and Jetpack.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose one of three documented policies for each client: disable XML-RPC when no dependency exists; allow it only from known systems or with narrowly scoped rules; or require 2FA for XML-RPC authentication after confirming that every dependent application supports the requirement. Record the decision and the tested integrations rather than applying a global switch to every site.
Agency rollout: a repeatable procedure
- Inventory the site. Record WordPress and PHP versions, administrator and editor accounts, multisite status, WooCommerce or membership plugins, mobile-app use, Jetpack or remote publishing, XML-RPC dependence, custom login forms, caching, CDN, and the current emergency contact.
- Classify accounts. Separate human administrators, developers, agencies, contractors, service accounts, and dormant users. Remove unused accounts, convert shared credentials to named accounts, and assign the least role that completes the job.
- Select the factor policy. Set passkeys or security keys as the preferred method where supported. Set TOTP as the compatibility fallback. Define whether administrators must register two authenticators and where recovery codes are stored.
- Select and stage the control. Install the chosen plugin or connector on a staging copy. Configure role coverage, login-page behavior, grace period, lockout thresholds, CAPTCHA or Turnstile, and XML-RPC policy. Do not enforce before an emergency administrator has a tested recovery route.
- Test real workflows. Test normal login, failed passwords, expired codes, passkey registration, lost-device recovery, password reset, WooCommerce checkout and account pages, membership forms, REST and XML-RPC clients, mobile apps, scheduled publishing, caching, and accessibility.
- Enroll users in waves. Start with the agency’s own administrators, then a pilot client, then the remaining sites. Give users a written path to the known login URL, a deadline, and support hours. Use the grace period for enrollment rather than granting indefinite exceptions.
- Enforce and monitor. Turn on enforcement for the approved roles, watch lockouts and failed challenges, and review users who remain unenrolled. Keep logs long enough to investigate incidents under the client’s retention policy.
- Document and template. Save the approved settings, exceptions, integration tests, recovery approvers, and rollback steps. Apply the template only to sites that match its assumptions; a WooCommerce or multisite exception should not be overwritten by a blind fleet push.
- Review after changes. Recheck the policy when WordPress, the security plugin, the identity provider, CDN rules, or a client integration changes. Re-test passkeys and recovery after administrator turnover.
Enrollment, recovery, and support runbooks
Enrollment checklist
- Confirm the user’s identity through the client’s existing support process.
- Have the user sign in from the known site address, not a link copied from an email.
- Register the primary passkey, security key, or TOTP device.
- Register a second authenticator if policy requires it.
- Generate recovery codes and confirm that the user stored them in the approved location.
- Test sign-out and a fresh sign-in before ending the session.
Lost device or key
- Verify the request using a pre-agreed channel and a second administrator or client approver.
- Disable the lost authenticator and review recent sessions and security events.
- Use a recovery code or the documented administrator reset; do not remove 2FA permanently.
- Enroll the replacement device, generate new recovery codes, and invalidate the old set.
- Record the incident, approver, time, and account changes.
Emergency lockout
Keep one break-glass administrator account under the client’s control, protected by two registered authenticators and a written access procedure. Store its credentials and recovery material separately from day-to-day agency accounts. Test the procedure on a schedule; an untested emergency account is not a recovery plan.
Compatibility checks that prevent outages
| Area | Test | Typical failure |
|---|---|---|
| Custom login and membership | Register and use 2FA from every front-end login form. | The plugin protects only the default administrator screen, leaving a custom form unprotected or unusable. |
| WooCommerce | Test customer account, checkout, password reset, and administrator login separately. | A challenge or redirect breaks checkout or loops through a cache. |
| XML-RPC and mobile | Publish or authenticate from each approved app after the XML-RPC policy is enabled. | Authentication fails when XML-RPC is required to enforce 2FA. |
| REST, webhooks, and service accounts | Use application passwords or scoped machine credentials where supported; test without interactive 2FA assumptions. | An automated job is forced through an interactive challenge and stops publishing. |
| Caching and CDN | Clear page and object caches, then test from a clean browser and a second network. | A cached challenge, nonce, or redirect is served to the wrong user. |
| Accessibility and privacy | Test keyboard navigation, screen readers, mobile browsers, and consent requirements for any challenge widget. | A legitimate administrator cannot complete the challenge or the client rejects the data flow. |
Fleet governance and visibility
Maintain a per-site record with the selected factor, enforced roles, enrollment percentage, grace-period end date, XML-RPC decision, rate-limit location, bot-challenge status, plugin and WordPress versions, exceptions, and recovery contacts. A dashboard is useful only if it distinguishes an independent client site from a subsite in a network and identifies stale or unenrolled accounts.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Use configuration templates for repeatability, but require a compatibility gate before applying them. A template should declare its assumptions—for example, whether XML-RPC is unused, whether a custom membership login exists, and whether passkeys are supported. Give team members least-privilege access to the management system and retain an audit trail for policy changes.
Common failure modes and fixes
- “We changed the login URL, so we are protected.” Login URL obscurity reduces noise but is not a substitute for unique passwords, 2FA, rate limiting, and monitoring.
- Administrators are enrolled, but editors are not. Start with administrators as the minimum requirement, then assess editors and other privileged roles according to what they can publish, install, or change.
- The plugin is installed but nobody is enforcing it. Use the documented grace period, publish a deadline, monitor unenrolled users, and enforce only after recovery has been tested.
- XML-RPC was blocked without an inventory. Restore the documented exception or narrow the rule, identify the dependent app, and retest before choosing disablement.
- A challenge breaks a legitimate user. Check token validation, cache rules, browser support, accessibility, and whether the challenge was placed on an API or machine-to-machine endpoint.
- A user loses the only device. Follow identity verification and administrator-approved recovery; revoke the lost factor and issue new recovery codes.
- A fleet template overwrites a client exception. Separate baseline settings from site-specific overrides and require a change review for every exception.
- The standalone Wordfence Login Security plugin is still being deployed. Verify its post-July-1-2026 status and use the current supported migration path, which Wordfence documentation describes as installing the full plugin.
How to make the final choice
Choose the option that passes all five gates below, in order:
- Authentication gate: It supports the strongest factor your clients can actually use, with a documented recovery path.
- Enforcement gate: It can cover the required roles, custom login surfaces, and enrollment grace period without permanent exceptions.
- Abuse-control gate: Rate limiting, lockouts, and any challenge can be deployed without exposing APIs or blocking legitimate traffic.
- Compatibility gate: XML-RPC, mobile, publishing, commerce, membership, caching, and accessibility tests pass.
- Operations gate: Your team can inventory sites, apply templates safely, see unenrolled users and events, and support recovery at fleet scale.
If a product fails one gate, changing brands will not fix an undefined policy. Resolve the integration or operational gap first, then select the plugin or identity provider that fits the client’s environment and support model.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
