WP Engine 2FA: how to set up an authenticator app

The WP Engine User Portal at my.wpengine.com is where you manage your hosted WordPress sites, plans and users. It's a separate login from the WordPress admin of each site, so this guide covers the portal only (WP Engine).

You likely have multi-factor authentication (MFA) already: WP Engine turns on email codes for every account by default (WP Engine). Its blog suggests adding at least one stronger method: Okta Verify push prompts, an authenticator app, or a security key or biometric login (WP Engine). This guide adds an authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the WP Engine steps come from WP Engine's own support articles and blog, linked below, which we read on October 20, 2026. We haven't tested them on a WP Engine account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

If your email domain uses single sign-on, WP Engine doesn't ask for its own MFA at all. Your company's identity provider handles the checks, so there's nothing to set up here (WP Engine).

Turn on 2FA with an authenticator app

Make sure you can get into the email address you sign in with first. Then follow WP Engine's steps (WP Engine):

1. Sign in to the User Portal.
2. Click the profile icon in the top right corner, then select Multi-factor authentication.
3. Click Set up next to the authenticator option. The article's setup section names it Google Authenticator, but the same article says other time-based code apps work too.
4. Follow the prompts until WP Engine shows a QR code.
5. In Novaz, tap +, then Scan QR code. If the portal is open on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
6. If you want a spare, scan the same QR code on a second device now (see below).
7. Finish the prompts. If the portal asks for a code, type the current one from Novaz.

WP Engine's pages only mention the QR code, not a key you can type. If the screen does offer one, use Enter key manually in Novaz and type it as the Setup key (What is a 2FA setup key?). The blog says codes change every 30 seconds, the same as Novaz uses for typed keys (WP Engine).

Make a spare before you finish

The support article never mentions backup codes. The blog's checklist tells you to store them safely, but no page says the portal gives you any (WP Engine).

What WP Engine does suggest is scanning the setup QR code on more than one device before you confirm the setup (WP Engine). This is your one chance to scan it on a second device, such as an iPad with its own authenticator app. A Novaz iCloud backup or backup file is another kind of copy: it lets you restore the account on a new iPhone later. The blog points out that each copy is one more place the key could leak (WP Engine), so keep the spare somewhere safe. A second method, like a security key, is another way to avoid a lockout.

When WP Engine asks for a code

Not on every sign-in. WP Engine uses rules to decide, for example when you sign in from a new location or device. When it asks, pick the method you want from a dropdown of the ones you've set up (WP Engine).

If WP Engine rejects your code

WP Engine's pages don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones or turning it off

Moving to a new phone is a reset, and you must be able to sign in to do it (WP Engine):

1. Click the profile icon, then Multi-factor Authentication.
2. Deactivate the authenticator app.
3. Set it up again and scan the new QR code with the new phone.

Do it while the old phone still works. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and skip the reset. Without one, the new phone needs the account added again (moving to a new iPhone).

Deactivating also removes the app if you no longer want it. WP Engine doesn't say whether MFA can be switched off entirely, and email codes are on by default. Afterwards, open the account in Novaz and tap Remove account.

If you lose your authenticator

Try another method first. Email codes are on by default, so check the sign-in dropdown for it.

If no method works, WP Engine says to open a billing ticket (WP Engine):

1. Fill out the billing support form.
2. For the issue category, select I'm locked out of my account.
3. Watch your email for replies.

Support resets your MFA after security checks, such as security questions. Other users on the plan can't request changes to your login, but any Owner can add a new user if access is urgent (WP Engine). WP Engine warns you to "expect a long delay on verifying your account" and gives no time frame (WP Engine).

Keep your email address current. If you're the plan's only Owner and lose both your password and that email address, WP Engine asks for a court order (WP Engine). More in Lost the phone with your authenticator app?

Official WP Engine help

• Multi-Factor Authentication for the User Portal
• Reset User Portal Login
• User Portal Account Users and Roles
• Single Sign-On (SSO) for WP Engine User Portal
• Keep Your Account Safe With Multi-Factor Authentication