Skip to content
Novaz AuthenticatorGET

Wordfence Central 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Signing in with a code
  3. Your backup codes
  4. If Wordfence rejects your code
  5. New phone or lost phone
  6. Turning 2FA off
  7. Official Wordfence help

Wordfence Central is the free dashboard for running the Wordfence plugin on many WordPress sites from one place: scan findings, plugin settings and more (Wordfence). It lives in your wordfence.com account, which also holds your license keys and billing (Wordfence). Anyone who gets in can change Wordfence's settings on every connected site, so the account deserves two-factor authentication (2FA).

Wordfence's help describes one method: a code from an authenticator app, with backup codes you download during setup (Wordfence). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

Don't mix this up with the plugin's own 2FA for your WordPress login, which you set up on each site under Login Security > My 2FA (Wordfence). This guide covers only the wordfence.com account.

How we checked this guide: the Wordfence steps come from Wordfence's own help pages, linked below. wordfence.com didn't serve those pages to our automated reader, so on October 20, 2026 we read archived copies on web.archive.org. The main page, Setting up two-factor authentication, was saved on July 13, 2026, but Wordfence last updated it in August 2021, so its labels are the most likely to have changed. We haven't tested the steps on a Wordfence account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

There are two ways in, depending on whether you've used Central before (Wordfence).

The first time you sign in to Central, Wordfence prompts you to turn on 2FA:

  1. Click Setup Two Factor Authentication. A window opens with a QR code.
  2. In Novaz, tap +, then Scan QR code, and point the camera at the code.
  3. Click Download to save your backup codes.
  4. Click Continue, type the 6-digit code from Novaz, and click Activate.

If you already have an account:

  1. Sign in at wordfence.com, hover over the menu in the upper right corner, and click ACCOUNT (Wordfence).
  2. On the Account page, click Enable with Authenticator App. A window opens with a QR code.
  3. Add it to Novaz: tap +, then Scan QR code.
  4. Click Download to save your backup codes, then click Close.
  5. Type the code from Novaz in the Enter Activation Code box and click Activate.

Under the QR code sits an unnamed 32-character code: that's the setup key. Wordfence's codes are 6 digits and change every 30 seconds, so typing it works: tap +, then Enter key manually, and paste it into Setup key. See What is a 2FA setup key? On your iPhone's own browser, screenshot the QR code and use Choose a photo. See scanning a QR code on the same iPhone.

Signing in with a code

After your username and password, Wordfence asks for a code: type the one from Novaz and click Log In. Or take the shortcut: type the code right after your password in the password field, with or without a space, and click Log In before the code expires (Wordfence).

Your backup codes

Setup is the only time Wordfence's help mentions getting these codes, which it calls backup codes there and recovery codes at sign-in. It doesn't say how many you get, whether each works once, or how to make new ones.

To use one, there's no separate box. Enter your username and password, paste a recovery code straight after the password, and click Log In (Wordfence).

If your phone is lost and there's no Novaz backup to restore, these codes get you in. Keep them off your phone, in a password manager or on paper. More in 2FA backup codes.

If Wordfence rejects your code

Wordfence's help for the account doesn't cover rejected codes. If you used the shortcut, make sure the code went in before it changed. Then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

New phone or lost phone

Wordfence documents one way to move 2FA to a new phone (Wordfence):

  1. Sign in with a recovery code, or with a normal code if you still have the old phone.
  2. At the bottom of the Account page, click Remove two-factor authentication.
  3. Wordfence asks if you're sure. Click Deactivate.
  4. Set up 2FA again with the new phone, using the steps above, and download the new backup codes.

Do this before you wipe the old one. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and keep the same codes. See How to transfer your authenticator app to a new iPhone.

If you've lost both the phone and your recovery codes, Wordfence's help pages describe no way back into the account. They point Premium customers to a ticket system that you open by signing in to wordfence.com, and free users to the public WordPress.org support forum (Wordfence). Don't post account details on a public forum. For general steps, see Lost the phone with your authenticator app?

Turning 2FA off

At the bottom of the Account page, click Remove two-factor authentication, then Deactivate. The help doesn't say whether Wordfence asks for a code first.

Official Wordfence help

More guides: Security, identity and VPN