As promised in a previous post, 2FA for WordPress.org accounts is now ready to test as an opt-in feature.
Note: this feature is for logging in to the WordPress.org web site itself; it does not affect your personal WordPress
If you’re familiar with 2FA and have an authenticator app such as Authy, Google Authenticator, or Keepass, then you can enable Two Factor auth on your account here:
https://wordpress.org/support/users/profile/edit/account/
You’ll see a screen similar to this:
Follow the Two-Factor Authentication link to get a QR code, and scan that using your preferred authenticator app.
Please make sure you save the Backup Codes! If you lose access to your authenticator app in the future you’ll need those to recover access to your WordPress.org account!
Questions
Is 2FA compulsory?
Not yet. In the near future we plan to begin requiring it for accounts with special access, core contributors, theme and plugin developers, and so on.
It will be optional for casual users’ accounts, subject to changes in best practices.
Does 2FA work with Subversion?
Not directly, since Subversion clients don’t support 2FA.
For WordPress core releases, 2FA has been in use for many years in the form of SSH keys protecting the release system.
For plugin and theme authors, the release management system will require a second factor before code commits are published in downloadable zip files. We’re also investigating other ways of requiring 2FA for code commits.
Does it support hardware keys/WebAuthn?
We do support hardware keys and other WebAuthn supported factors thanks to the WebAuthn Provider for Two Factor plugin. For now they must be configured through a wp.org admin interface via wp-admin/profile.php and we are working on adding a more user friendly interface (see issues #193 and #194). If you want to configure WebAuthn, log into one of the WordPress.org sites (wordpress.org, make.wordpress.org/*, etc), navigate Users -> Profile, scroll to the bottom of the page.
Can I use 2FA on my own WordPress site?
We’re using the Two Factor community plugin along with some customizations. Two Factor is open source and available for anyone to use right now. It’s completely free and stand-alone.
Issues/Feedback
You can file bugs or feedback in meta trac or the wporg-two-factor repository.
Thanks to @tellyworth for help in drafting this post 🙂