01
Installed and enforced for you
We add the open-source Two Factor plugin, maintained by WordPress core contributors, and our own enforcement layer. If someone deactivates it in wp-admin, it keeps running. The portal is the only off switch.
Two-factor login · Included with hosting
A stolen password is no longer enough.
Require a second login step from everyone who can edit your WordPress site. One switch in your portal. No security plugin to buy, configure, or babysit.
$89/site/month · Hosting, care, Auto SEO, Auto Speed, two-factor login & cookie consent included.
Month to month. We handle your WordPress migration.
Two-factor login
NEW2 of 3 set up
Everyone else is asked to set it up the next time they open the dashboard, before anything else.
Who can edit the site · 2 minutes ago
- People
- 3can edit the site
- Set up
- 2sign in with a code
- Pending
- 1asked at next sign-in
Checked on the site 2 minutes agoHide details
- Sarah Chensarah · AdminAuthenticator app
- Marcus Webbmarcus · EditorEmail codes
- Dana Ortizdana · Shop managerNot set up yet
- topsydeTopSyde access accountExempt
The work, taken care of
One switch. Everyone who edits is covered.
Turn it on from the site's Dashboard tab. We install it, enforce it, keep it updated, and show you who has set it up.
02
Everyone who can edit, enrolled
Administrators, editors, authors, contributors, and shop managers are sent to set up a second step the next time they open the dashboard, before anything else. Shop customers and subscribers are never asked.
03
Codes, backups, and lockout help
An authenticator app (Google Authenticator, 1Password, Authy and others) or codes by email, plus one-time backup codes. Lost phone and backup codes? We reset it after verifying who is asking.
Built around your next decision
Less to manage yourself.
Someone asked whether you use MFA.
Cyber-insurance applications, client security reviews, and vendor questionnaires increasingly ask about multi-factor login on admin accounts. Turn it on, and the card in your portal shows who has set it up.
A stolen password alone no longer gets in
You are comparing Wordfence, WP 2FA, or miniOrange.
Plenty of 2FA plugins are free to install. The real cost is the work around them: choosing one, enforcing it for the right roles, keeping it updated, and unlocking people who lose a phone. That work is ours now, and your site keeps the server-level protection it already has with Sentinel.
You manage logins across client sites.
Clients reuse passwords, and their staff come and go. Turn two-factor on per site and see who has set it up and who hasn't on each site's card. No chasing people for screenshots.
Illustrative mockups. Results depend on your site.
One managed plan
Four plugins you no longer need.
Two-factor login is one of four tools built into TopSyde managed WordPress hosting. SEO, speed, two-factor login and cookie consent come with the plan, along with a team to help you make the switch. Bought separately, the SEO, speed and cookie plugins alone run $425+ a year per site.
List prices checked October 2026: Yoast SEO Premium $118.80/yr, WP Rocket $59.95/yr ($299.95 for up to 50 sites), CookieYes Pro $250/yr per domain (the plan with region targeting, like ours). Two-factor plugins have free tiers, so we count none.
Optional per site, off by default. Turning it off removes the requirement and the plugin we installed; everyone's setup is kept in case you turn it back on.
Standard plan · 1–10 sites
$89 / site / month
- Managed WordPress hosting & migration
- Auto SEO and Auto Speed
- Two-factor login and cookie consent
- Updates, backups & Sentinel security
- Maintenance and technical support
Custom development is quoted separately. Volume pricing starts at 11 sites.
Before you switch.
Who has to use it?
Everyone who can edit the site: administrators, editors, authors, contributors, and shop managers. Shop customers, members, and subscribers sign in exactly as before. The site's TopSyde access account is exempt because it is not a person and its password is never stored.
What happens if someone loses their phone?
They can sign in with one of their backup codes. If those are gone too, open a ticket from the account email (or the person's own email) and we will verify who is asking, then reset their two-factor so they can set it up again.
Does it make the site impossible to hack?
No tool does. Two-factor login stops a stolen or reused password from being enough on its own, which is how most dashboard takeovers start. One honest gap: until a person sets up their second step, their password still reaches the setup screen. If a site was compromised, reset passwords before turning it on.
Do email codes work?
Yes, as long as the site can send email. Codes go through the site's normal mail delivery, so an authenticator app is the stronger and more reliable choice. We recommend it in the setup notice.
Does it work on multisite?
Not yet. The switch is unavailable for WordPress multisite installs today.
How do I get started?
Choose a TopSyde plan or tell us about your site. We help with migration, review the current setup, and explain activation in your site’s Dashboard tab. Auto SEO, Auto Speed, two-factor login and cookie consent are separate switches, so you turn on exactly what each site needs.
Let us handle the upkeep.
Two-factor login, hosting, and managed care from $89/site/month. Start with a conversation about your site.
Also included on every plan:
Two-factor login + hosting · $89/site/month