Wordfence · Help

Wordfence: lost authenticator and recovery codes?

Choose an authorised owner-recovery route and fully re-establish two-factor protection afterward.

Source date: 5 November 2026Editorial team: KAN KAI WORKSEditorially updated:

Quick answer

A new password does not replace a lost Wordfence second factor. As an authorised owner, first check unused recovery codes, a trusted session or a reset by another authorised administrator. If those routes are unavailable, use the documented owner-recovery process through verified hosting access. Any necessary temporary deactivation should end with restored protection, a new factor and fresh codes; recovered login does not remove possible malware.

Source basis: Q1 · Q2

Applies to
Authorised owners and administrators of their own WordPress installation using Wordfence or Login Security. Other login factors and a possible security incident require separate handling.
How to verify the result
A second browser confirms the newly protected login while the administrator session remains open; protection status, user rules and securely stored new recovery codes are checked.
Your first check

Is there still a trusted admin session or another authorised administrator?

Check recovery codes and an administrator reset first. Without those routes, verified hosting access is needed; a password change alone does not replace the second factor.

A replacement phone no longer has the authenticator entry, recovery codes are missing and Wordfence blocks the legitimate owner from the dashboard. A correct password is insufficient. The reviewed report describes lost factors and a previous malware finding. Regaining access and cleaning a compromised website are separate tasks. Q1

Start with the narrowest available recovery route

This guide is for owners and authorised administrators of their own installation. Check for a trusted open session, another authorised administrator or securely stored recovery codes. Wordfence documents these recovery options and resetting two-factor authentication. Q2

Do not prematurely sign out of a session that still works. Never publish recovery codes, passwords or QR-code secrets in support posts. Establish which access remains under your control before making changes.

Follow the appropriate route

  1. Check existing codes: Use only an unused recovery code belonging to the affected setup. A code from another website or an older replaced configuration is not a dependable substitute.
  2. Prefer an administrator reset: Another authorised administrator can reset the affected two-factor setup after verifying identity. This avoids disabling the entire site’s protective component.
  3. Identify the installation: If that route is unavailable, establish whether the full Wordfence plugin or standalone Login Security generates the challenge. A separate SSO or hosting factor can remain independent of either.
  4. Use verified hosting-owner access: With authorised file management, SFTP or an equivalent administration route, the documented Wordfence recovery procedure may involve temporary plugin deactivation. For manual file management, identify the plugin directory actually responsible. Preserve its original name and an immediate reversal path; do not alter database accounts or unrelated installations.
  5. Restore protection immediately: Reactivate the required component, configure the second factor again and generate new recovery codes. Test login in a second browser while retaining the recovered administrator session.

Verify more than a successful login

Check Wordfence protection status and the intended user rules afterward. Temporary deactivation must not become an unnoticed permanent state. Store the new recovery codes separately from the authenticator and protect them against unauthorised access.

If there is an evidenced compromise concern, preserve the findings and handle that incident separately. A new QR code does not remove malicious code or unauthorised accounts. Keep the recovery record clear about which task has actually been completed.

Frequently asked questions

Is “forgot password” enough?

A password change does not replace a missing second factor. Use the supported recovery or administrator route.

Should I leave Wordfence disabled permanently?

No. Any necessary temporary recovery should end with working authentication and verified protection restored.

Must I reinstall everything if no codes remain?

No. Check legitimate administrator and hosting routes first. A complete reinstall can unnecessarily put content and configuration at risk.

Information for assistance

Provide the plugin variant, version, available authorised access routes and the precise login stage. Keep secrets and private recovery codes under your own control.

KAN KAI WORKS can assist with authorised recovery and restoring protection afterward. Get help with this case.

Support with this issue

KAN KAI WORKS can assist with authorised recovery and restoring protection afterward.

Describe your case →Related service: Websites & CMS

Sources and scope

Sources checked: 5 November 2026. The original incident has not been independently reproduced.