Greater Security with Two Step Authentication
We know your blog is important to you, and today we’re proud to announce Two Step Authentication: an optional new feature to help you keep your WordPress.com account secure. For those of you who use Two Step Authentication with your Google account, you’ll know how useful this feature is for keeping your account secure.
Two Step Authentication works like this: when you log in to your WordPress.com account, we’ll prompt you to enter a secret number. To get that secret number, you’ll need to download the Google Authenticator App on your smartphone. It generates a new number every 30 seconds, making it virtually impossible to guess. All you need to do is open the app on your phone, and type in the number it’s showing. If you don’t have a smartphone, you can instead opt to have the number SMSed to you.
To enable Two Step Authentication, head on over to the new Security tab in your WordPress.com account settings, and go through the setup wizard. The wizard will help you make sure that everything is configured correctly:
Once you enable Two Step Authentication on your account, there are a couple of extra steps we recommend you take:
Print backup codes
Print out some backup codes to keep in a safe place — your wallet, a filing cabinet or your document safe in case your phone is lost or stolen. You can print backup codes right from your WordPress.com Security tab:
Generate application-specific passwords
Some apps that connect to your WordPress.com account (such as the WordPress mobile apps) don’t yet fully support Two Step Authentication. For these apps, you can generate unique passwords to use with each one (for example, you can have a different password on your phone and your tablet). If your device ever goes missing, you can disable its password with a single click, locking it out of your account.
If you need any extra help setting up Two Step Authentication, detailed instructions are available in the Support documentation.
Have feedback or suggestions? Leave them in the comments!
WordPress.com News 
Brilliant! Necessary! Forward-thinking! Outstanding! Now leaving to turn on the 2-Step! SMILE! Thank you!
LikeLike
And for those of us with Nokia Symbian smartphones there’s ….. bupkiss
LikeLike
While there’s no official Google Authenticator app for Nokia phones, there is 3rd party app available from the Ovi store for MeeGo phones:
http://store.ovi.com/content/273598
Or there are experimental apps for Symbian available, such as this one:
https://code.google.com/p/lwuitgauthj2me/
Alternatively, SMS authentication will work with any phone, provided you have reception.
LikeLike
great timing this is something that we need. As an aside, will this also be enabled for self-hosted blogs, as a Jetpack service perhaps?
LikeLike
We are looking at the best way to offer this in Jetpack, but no firm plans just yet.
Keep an eye on the Jetpack blog for future announcements!
LikeLike
Great. I don’t have a cell phone, so can’t download the app. Does this mean my blog is no longer accessible?
LikeLike
Don’t worry, this is an optional feature!
LikeLike
And for those of us who don’t have a smart-phone? What then? There are some of us our here, you know……
LikeLike
You can opt to have a login code sent to you by SMS, instead. You’ll need network reception, of course, but this will work with any phone.
LikeLike
@showmescifi or anyone else who’s wondering about self-hosted WordPress – it seems .org has had it for a while: http://wordpress.org/extend/plugins/google-authenticator/
LikeLike
Great. Thanks!
Now if Apple will just send me an iPhone to test out.
(I’m waiting Apple…)
LikeLike
Optional means I don’t have to do this, right? Because we don’t have cell phones. I don’t want to discover that I have no choice. We can’t afford cell phones, so we don’t have them and amazingly, life is fine — even though sometimes, we are out of touch for a few hours. Just like in the good old days!!
LikeLike
That’s correct, this is an entirely optional extra level of protection for your account. We understand that not everyone has a cell phone!
LikeLike
That’s all fine and dandy if you have a data package on your phone, otherwise useless.
LikeLike
You only need your phone connected to the internet when you install the Google Authenticator app – after that, the codes will be generated without needing an internet connection.
LikeLike
Nothing for Windows Phone??
LikeLike
There’s no official app for Windows Phone, but this third party app should do the job:
http://www.windowsphone.com/en-us/store/app/authenticator/021dd79f-0598-e011-986b-78e7d1fa76f8
(When setting up WordPress.com Two Step Authentication, simply select that you already have the app, and scan the resulting QR code.)
LikeLike
Great function but what happens if you loose your smartphone?
LikeLike
We strongly recommend you set up Backup Codes after you enable Two Step Authentication. These backup codes can be printed out and kept in a safe place, to use in the event you lose your phone.
LikeLike
Thanks Gary.
This is a great step forward WordPress and should become a standard feature for all the other providers of internet services.
As I am no professional for security questions do you think that with 2-Step-Authentication a periodic change of the password is dispensable?
LikeLike
While changing your password regularly is a good security measure, we primarily recommend using a strong, unique password for your WordPress.com account. Here are some more tips on choosing a password:
https://wordpress.com/support/passwords/#choosing-and-using-good-passwords
LikeLike
It would be nice if this could be extended in future to use Yubikeys.
LikeLike
Thanks for the suggestion! We have no immediate plans for Yubikey support, but we’ll keep it in mind for future updates.
LikeLike
Great, security is always top priority.
LikeLike
Excuse me, where is Security Tab in Dashboard? 🙂
LikeLike
https://wordpress.com/#!/settings/security/
LikeLike
If you don’t have a smartphone or cell but have an iPod touch with a camera, you can still do this! Just download the Google Authenticator app from the App Store and follow the instructions for the two-step authentication in the security settings. It still works and it’s a piece of cake.
LikeLike
Finally, a long wait security feature come. A MUST enable feature.
LikeLike
Is this available for all WP websites…or just the free blogs people sign up for? My clients websites are all on WordPress and I dont see the security tab anywhere (including under settings)…and most of them are in 3.5.1…so am I missing it…or is it not available for WP websites yet?
LikeLike
This is currently only available for WordPress.com sites, though we’re investigating ways to make it available for self-hosted WordPress sites, too!
LikeLike
This is sometimes called two-factor authentication.
LikeLike
Awesome Work. Thanks a lot for integrating with Google Authenticator. I would like to request the option to move from one phone to another without disabling this app on phone. Since, I have rooted phone, I would love to have this feature, in case I formatted the phone.
LikeLike
Thanks for the suggestion! We’ll keep this in mind for future updates.
LikeLike
@Salman Backup the Google Authenticator using something like Titanium Backup before formatting and it will restore without any issues just fine.
LikeLike