Lost the phone with your two-factor app

Two-factor authentication in WordPress comes from a plugin, for example Wordfence or Two Factor. WordPress doesn't have it built in. Without your phone there are three ways in: a backup code, another administrator, or temporarily disabling two-factor from the server.

Use your backup codes

When you set up two-factor, you were offered a list of one-time codes to save or print.

1. Look for the codes in your password manager, in downloaded files or among papers you printed.
2. Log in with your username and password, and enter a backup code instead of the code from the app. With Two Factor, choose to use a backup code first.
3. Each code works only once. Once you're in, set up two-factor again with your new phone and create new codes.

Ask another administrator to switch it off

Another administrator can disable two-factor for your user, so you can log in with just your password.

1. With Two Factor, the administrator goes to Users → All Users, edits your profile, unticks every method under Two-Factor Options and clicks "Update User".
2. With Wordfence, the administrator goes to Users → All Users and edits your profile. Under Wordfence Login Security, they click "Manage 2FA" and then "Deactivate".

Once you're in, set up two-factor again with your new phone.

Switch it off from the server

If you're the only administrator, disable two-factor from the server. How you do that depends on the plugin.

With Wordfence:

1. Connect with FTP or the file manager in your hosting panel, and open wp-content/plugins.
2. Rename the wordfence folder, for example to wordfence-off. If you use the standalone Wordfence Login Security plugin, the folder is called wordfence-login-security instead.
3. Log in with your username and password.
4. Rename the folder back. If you opened Plugins while the folder had the new name, WordPress has deactivated Wordfence, so activate it again.
5. Go to Login Security in wp-admin (under Wordfence if you have the full plugin), deactivate two-factor and set it up again with your new phone.

With Two Factor, renaming the folder doesn't help: once the plugin is active again, it asks for a code from your phone before you can change the two-factor settings. Reset two-factor for your user instead. With SSH and WP-CLI, delete the setting with the command below, replacing username with your username, email address or user ID:

wp user meta delete username _two_factor_enabled_providers

From version 0.17, Two Factor also has its own command for this: wp two-factor disable username --yes.

Without WP-CLI, open the table ending in usermeta, usually wp_usermeta, in phpMyAdmin and delete the row with your user_id where meta_key is _two_factor_enabled_providers. Log in with your password and set up two-factor again.

When you're stuck

With another plugin, you get in the same way, by renaming the plugin's folder. The plugin's documentation tells you how to reset two-factor afterwards. If you can't work out which plugin it is, or you have neither FTP, phpMyAdmin nor another administrator, whoever holds the hosting account has to help you.