Stillcode › Two-factor authentication › WordPress.com
What WordPress.com accepts — a hardware key among them — where its own instructions are, and what happens to your codes when the phone holding them stops existing.
These are the second factors WordPress.com offers on wordpress.com. Which ones you
see can depend on your plan and your country;
what each of the seven actually costs you is set out once.
| Method | What it is | |
|---|---|---|
| Authenticator app (TOTP) | Supported | Computed on your own device; nothing is sent to produce it. |
| Hardware security key | Supported | A physical key you tap; the one option phishing does not beat. |
| SMS text message | Supported | Texted to your number, so your carrier is part of the lock. |
Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.
WordPress.com offers both SMS and an authenticator app. They are not equivalent — a texted code depends on your mobile carrier and survives no longer than control of your phone number, while a generated code never travels. If both are enabled, the account is only as strong as the weaker one, because an attacker picks.
A hardware security key is also accepted. It is stronger than any code, because a code can be typed into a convincing fake page and a key cannot. The usual arrangement is a key as the primary factor and an authenticator app as the backup that fits in a pocket.
Of the fifty services on this site, twenty-three accept a hardware security key,
and WordPress.com is one of them. Eleven of the fifty accept exactly this combination, so the same
decision comes up on ten other
services here. Among the eight services filed under social,
three accept a hardware security key —
WordPress.com among them.
The directory files WordPress.com under social, records three of the seven second
factors it tracks, and points at instructions published at
en.support.wordpress.com/security/two-step-authentication.
WordPress.com's own instructions: WordPress.com — two-factor authentication — linked, never copied, because a stale menu path here locks people out.
WordPress.com publishes no dedicated page for losing your second factor, which in practice means the route back is ordinary account recovery: proving who you are to support, on their timetable.
Background: how the codes work · what still works when the phone is gone.
An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store