Enabling 2FA for WordPress Sites

This is a big one! We believe this is the first time a Managed Hosting platform for WordPress has applied 2FA as a built-in security feature — without requiring a plugin!

Our implementation is both seamless and secure. You can enable 2FA:

• Globally across all sites — applying to current and future websites with no extra configuration.
• Individually per site — configure each site as needed.

Global Settings – 2FA

To enable 2FA for all sites, go to Global Settings > WP Login 2FA inside your Staq Dashboard:

By default, 2FA is disabled. From the Enable Login 2FA dropdown, select Yes:

Then choose All Websites to apply 2FA across your entire Staq account. You may exclude specific sites or fine-tune the user roles it applies to:

Once configured, click Save to apply the changes.

Applying to Single Sites Instead

If you prefer to manage 2FA settings per site, you can do so in each site’s Staq Panel. Navigate to WP 2FA Login for the selected site:

Enable Login 2FA:

Select Yes from the dropdown to activate 2FA for this specific site:

User Roles for 2FA:

Verify which WordPress roles should require 2FA. These roles can be adjusted based on your preference.

Save Changes:

• Click Save to apply the settings.
• Click Reset to discard unsaved changes and revert to defaults.

WordPress Login Page

Once 2FA is enabled, users will be prompted with a secondary verification screen after logging in. The screen will show a hint of the email address the code was sent to:

The email containing the code will look like this (delivered via your site’s SMTP):

Notes & Exclusions

Keep in mind the following:

• 2FA codes are sent via email only
• SMTP must be active for code delivery
• Staq’s 1-click login bypasses 2FA
• 2FA is automatically disabled on staging environments

Disable and Delete Existing 2FA Plugins at Scale

If you’re using a third-party 2FA plugin but wish to switch to Staq’s built-in 2FA, you can bulk delete that plugin from all sites.

To do this, search for the plugin in the Staq dashboard and delete it across multiple sites at once. Make sure to keep the window open until the deletion process finishes.

See our guide on how to delete WordPress plugins in one hit.