Should your members need a code to log in?

Who needs it, and who can skip it

The free setup we tested

1. 1

   Install the free Two Factor plugin

   It’s made by WordPress contributors and listed on WordPress.org. BuddyBoss needs version 0.16.0 or newer.

2. 2

   Set it up for yourself first

   In the dashboard, open Users, then Your Profile, and scroll to Two-Factor Options. Turn on Recovery Codes and save them somewhere safe, then add an authenticator app.

3. 3

   Do the same for every admin and staff account

   Each person sets up their own, so check the two-factor column on the Users list afterwards.

4. 4

   On BuddyBoss, check the members’ Security tab

   With the plugin active, BuddyBoss 3.6 and newer adds Account, then Security, where members can turn it on themselves. It’s on unless you switched it off in BuddyBoss’s features.

5. 5

   Tell members where to find it

   One line in your next email is enough. Say what the code is for and that the Recovery Codes are how they get back in.

What members see when they turn it on

• They open Account, then Security, on BuddyBoss, or Your Profile in the dashboard on other sites
• They turn on Recovery Codes first and keep a copy. BuddyBoss won’t save an app or email code without them
• They scan a QR code with an authenticator app, or choose codes by email
• From then on, after their password, they’re asked for a 6-digit code from the app, or an 8-digit code from their email

On a phone, the code screen kept the BuddyBoss login look and fit the screen. If a member loses their phone, a recovery code gets them in, and each one works once.

What the notes don’t say

• BuddyBoss needs another plugin for this. The 3.6.0 notes say members can manage two-factor under Account, then Security. They don’t say the Security tab only appears once the free Two Factor plugin is active.
• Social Login skips the code. BuddyBoss’s code lets a Social Login sign-in through without it, on purpose. The member still needs the code to change their two-factor settings.
• Too many wrong codes resets the password. The Two Factor plugin’s code resets a member’s password after 30 wrong codes, on the basis that their password has been stolen. They’d then need the Forgot Password email.
• Members see some technical wording. The Security tab mentions the REST API and application passwords, which most members can ignore. After setting up the app, our test member was also told to consider Recovery Codes, though they were already on.

What we saw on a test site

We built a test site with BuddyBoss Platform 3.7.0 and LearnDash 5.2.3 on WordPress 7.1.4, added the Two Factor plugin 0.17.0, and turned two-factor on for three test members: one with an authenticator app, one with email codes, and one who set it up from the Security tab on a phone-sized screen.

What this test doesn’t cover

• We didn’t test BuddyBoss Social Login, the BuddyBoss app, WooCommerce or MemberPress logins.
• Our test emails never left the test site, so we didn’t test real delivery.
• We tested one plugin. The others below may work differently.
• It’s a small test site, not a community with thousands of members.

If you need to require it

The free Two Factor plugin can’t make two-factor required. Its FAQ says each person turns it on for themselves. If you must require it, these plugins say they can. We haven’t tested them, and BuddyBoss’s Security tab only works with Two Factor. On MemBuild Community, you can require it with Two Factor alone; see the next section.

• WP 2FA by Melapress: its WordPress.org page says it can require two-factor for everyone or for certain roles. Its pricing page puts some of that in the paid version, so check before you rely on it.
• Wordfence: two-factor login and passkeys are in the main plugin. The separate Wordfence Login Security plugin was closed on WordPress.org on 17 August 2026.
• Kadence Security, formerly Solid Security: its own documentation lists Require 2FA as a Pro feature.
• miniOrange: its WordPress.org page lists enforcement policies in its Premium plan.

Whichever you choose, test it on a copy of your site, logging in as a member, before you switch it on for everyone.

If your community runs on MemBuild Community

MemBuild Community is our own free community plugin. Since version 1.20.0 it has two-step login built in, using the same free Two Factor plugin as the test above.

1. 1

   Turn it on in Settings, then Security

   One switch adds the free Two Factor plugin from WordPress.org, or uses the copy you already have. If your host blocks plugin installs, the page shows how to add it by hand.

2. 2

   Choose who has to use it

   Anyone who wants it, required for you and your team, or required for everyone. People who have to use it set it up the next time they log in, before they get in.

3. 3

   Members set it up from their profile

   Under Edit profile, then Two-step login, they can add an authenticator app with a QR code, get codes by email, and save recovery codes. They never see the WordPress dashboard.

• The code screen matches your login page. After the password, the community’s own login page asks for the code, in your colors, instead of the plain WordPress screen. A login link sent by email asks for the code too.
• It can be required without a paid plugin. Two Factor alone leaves it up to each person. The community adds the choice of making it required for your team or for everyone.
• Changing the settings needs a fresh code. A member who wants to turn it off or switch to a new phone types a code first, so someone with only their password can’t switch it off.

The same advice applies: require it for you and your team, and think twice before forcing it on every member.

Questions owners ask