WordPress.com 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
This guide is for your WordPress.com account, the one you use to manage a site hosted on WordPress.com. Self-hosted WordPress sites from WordPress.org sign in through their host, so these steps don't apply to them (WordPress.com).
WordPress.com calls its 2FA two-step authentication. Codes come from an authenticator app or by text message, and once one is on, you can add a passkey or security key (WordPress.com). It's optional, unless a Business or Commerce site you work on has Require two-step authentication on: then you must set it up before you can sign in to that site (WordPress.com).
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the WordPress.com steps come from WordPress.com's own support guides, linked below, which we read on October 20, 2026. We haven't tested them on a WordPress.com account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on two-step authentication with an app
From WordPress.com's guide (WordPress.com):
- Signed in to WordPress.com, hover over your name at the top right and select My WordPress.com account.
- In the side menu, select Security, then Two-Step Authentication. The page is also at my.wordpress.com/me/security/two-step-auth (WordPress.com).
- Choose Set up using an app.
- WordPress.com shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the six-digit code from Novaz on the WordPress.com page and click Enable.
- WordPress.com now shows your backup codes. Save them, then type one of them into the field and click Verify. Two-step authentication is on.
The guide says you can type a code into your app instead of scanning, but doesn't name that option or say how often codes change. A key typed into Novaz (+, then Enter key manually, then Setup key) always gets 6-digit codes every 30 seconds, so scanning is the safer choice. See What is a 2FA setup key?
Your backup codes are the way back in
If you lose your phone, backup codes are your "only way to log back into your account without staff assistance" (WordPress.com). That holds with Novaz too, if the phone is gone and you have no Novaz backup (iCloud backup or a backup file) to restore.
- You can copy, print or download them. WordPress.com suggests a wallet, a document safe or a password manager, not your computer (WordPress.com).
- Each code works once.
- To get a new set, go to Security > Two-Step Authentication and, in the Backup codes section, enter one of your current codes first. Do this from a computer, not a phone. The new set cancels the old one. So don't wait until your last code is gone.
More in 2FA backup codes.
Signing in
Each time you sign in with your password, WordPress.com asks for a code (WordPress.com). Type it from Novaz and click Continue. With a passkey or security key added, you can pick Continue with security key instead (WordPress.com).
If WordPress.com rejects your code
WordPress.com's troubleshooting covers only text-message codes (WordPress.com). The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you lose your authenticator
At the code prompt, click Use a backup code instead (WordPress.com). A passkey or security key also gets you in, but can't turn two-step authentication off, the first step to setting up a new app.
Without backup codes, use the Account Recovery form; you don't need to sign in. WordPress.com won't bypass two-step authentication unless you prove the account is yours, with a transaction ID from a past purchase or the activation link from your sign-up email (WordPress.com). Without proof, it won't restore access. It replies or asks for more, and doesn't say how long that takes (WordPress.com).
If you've never bought anything there, that activation email is your only proof besides codes, so check now that you can find it. More in Lost the phone with your authenticator app?
Moving to a new iPhone
With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone and keep the same codes. Otherwise, WordPress.com has you set two-step authentication up again (WordPress.com):
- Print or save your backup codes.
- Install the authenticator app on the new phone.
- Turn off two-step authentication (below) with a code from the old phone.
- Set it up again with the new phone. If asked for a code, use an unused backup code.
- Remove it from the old phone: in Novaz, open the account and tap Remove account.
If you use the Jetpack mobile app, create a new application password for it on the new phone (WordPress.com, WordPress.com). See How to transfer your authenticator app to a new iPhone.
Turning it off
In Security > Two-Step Authentication, under Disable two-step authentication, click Disable. Enter a code from Novaz or a backup code, not a security key, and click Disable again. WordPress.com advises against it (WordPress.com).
