In a hurry? Skip to the TL;DR
Starting now, every administrator account on a WordPress site we manage needs two-factor authentication to log in. There’s no opt-out and no “later.” If you administer a site, the next time you log in you’ll be asked to set it up, and after that every login needs it.
We don’t usually write to announce a decision instead of a suggestion. This one’s different. We can enforce this on our side, so we are. Here’s the reasoning, honestly, including the part where two-factor authentication won’t save you, and why we’re leaving one closely related habit up to you.
TL;DR
- Two-factor authentication is now required on every administrator account we manage. There’s no opt-out. Your next login will walk you through setting it up.
- It stops someone who has your password. It doesn’t stop someone who has your session. A stolen session cookie skips the login screen entirely, so 2FA never gets asked.
- We can enforce 2FA because it lives on our side of the line. We can’t see or secure your laptop, your browser, or the extensions you’ve installed.
- Doing daily work from an Editor account is the mitigation for the part 2FA can’t reach. We strongly recommend it. We’re not requiring it, because it depends on habits only you can see.
- If you’d like a hand with any of it, we’re happy to jump on a call. It doesn’t take long, and we’d rather set it up with you than leave you to work it out alone.
What’s changing
- Every administrator account, on every site we manage, now needs two-factor authentication (2FA) to log in. That’s a code from an app on your phone, in addition to your password.
- This applies to administrator accounts specifically. If you already log in day to day with a separate Editor account (more on that below), nothing changes for you yet, though we recommend it there too.
- There’s no exemption process. If your admin login doesn’t have 2FA configured, your next login will walk you through setting it up before you can continue.
We know that’s a firm way to open, and we don’t love being the people who add a step to your day. So if you’d rather not do this on your own, we’re happy to jump on a call and set it up with you. It takes a few minutes, it only has to happen once, and there’s no such thing as a silly question about it. Just ask.
The threat this closes, and one you probably haven’t heard of
We’ve written before about checking whether your passwords have appeared in a data breach. That post covers one way credentials leak: a company you have an account with gets hacked, and your email and password end up in a dump that criminals trade around.
There’s a second, quieter path, and it doesn’t require any company to be hacked at all. It’s called infostealer malware, a small hidden program that ends up on someone’s own computer, usually through a cracked piece of software, a fake download, or a bad email attachment. Once it’s running, it quietly copies two things out of your browser. First, the passwords you’ve saved. Second, something most people don’t realize is sitting there: your active session cookies, the small files your browser keeps that say “this person already logged in, let them through.” Both get bundled up and sold in bulk.
That second part is the one worth sitting with. A stolen password still has to be typed in somewhere. A stolen session cookie doesn’t. Whoever buys it can load it into their own browser and walk into your account as if they were you, mid-session, with no login screen involved.
What two-factor authentication actually stops, and what it doesn’t
We’d rather tell you the honest limits of this than oversell it.
Think of your password as the ID you show at the door, and 2FA as the second check right behind it, a code from your phone that only you should be able to produce. If a criminal has your password from an infostealer’s haul but not your phone, that second check stops them cold. That’s real protection, and it’s why we’re requiring it.
Here’s what it doesn’t touch. A stolen session cookie is more like a wristband from an event you already got checked into. Once it’s on, nobody asks to see your ID again. That already happened, earlier, when you actually logged in. If a criminal has a copy of that wristband, they don’t queue up at the door at all. They skip it, because as far as WordPress is concerned the login already happened. Two-factor authentication has nothing to check, because it never gets asked.
So 2FA closes the stolen-password door. It does not close the stolen-session-cookie door. Anyone who tells you otherwise is selling you more confidence than the tool has earned.
Where our reach ends
We’ve written in detail about the six layers we maintain to protect your site: the server, the application, the firewall, backups, monitoring, and the rest. That’s real, ongoing work, and it’s ours to do.
None of it reaches the laptop or phone sitting on your desk. We have no visibility into which browser extensions you have installed, what other tabs are open while you’re logged into your site, whether your device already has something like the infostealer malware described above running on it, or whether it’s a shared family computer. That’s not a gap we’ve chosen to leave. It’s structurally not ours to see. Your device is yours, the same way your home office is yours. We can build a very secure building. We can’t follow you home and check whether you locked the car.
Our roles-and-responsibilities post covers this split in more general terms. This is the sharpest version of it. 2FA is the piece we can put in place and hold in place, because it lives on our side of the boundary. Everything about how you use your own browser lives on yours.
Why administrator access is required, and Editor access still isn’t
That boundary is the whole logic here, plainly stated. A safeguard we can enforce on our end, we now enforce. A habit that depends on how you personally work day to day, we recommend and explain, and then leave to you.
Which brings us back to something we’ve already written about at length: why you shouldn’t use your administrator account for daily tasks. We’re not going to re-make that case here, so go read it if you haven’t. But it’s worth connecting to everything above. A separate Editor account for everyday work is the mitigation for exactly the threat 2FA can’t reach. If your day-to-day session gets stolen off an infected device, what a criminal inherits is whoever’s account you were logged into at the time. Do your daily posting and editing from an Editor account, and a stolen session hands them Editor-level access, which is a real problem but a contained one. Do it from your Administrator account, and a stolen session hands them the whole site.
That’s why Editor access matters more, not less, in light of everything above. It’s also exactly why we’re not mandating it the way we’re mandating 2FA. It depends on habits we can’t see and can’t flip a switch on. We can only make the case for it and make it easy to set up. Consider this us making the case again, a little more pointedly..
A few habits worth adopting
Since we’re on the subject of what’s in your hands:
- Log out when you’re finished, especially on a shared or public computer. Closing the browser tab isn’t the same thing as logging out.
- If you see an active login on your account that you don’t recognize, treat it as worth asking us about rather than something to shrug off.
- Browser extensions are useful, and also worth a periodic look. They run with access to every page you visit, including your logged-in WordPress dashboard. Install what you actually use, and remove what you don’t.
None of this requires new software or a monthly bill. It’s just attention, applied consistently, to the one layer that’s genuinely yours to run.
Let me know if you have any questions about any of this. If you’d like a hand setting up 2FA, or getting an Editor account going for your day to day work, we’re happy to jump on a call and do it together.
-Geoffrey
