Authenticator App - Novaz

WordPress.com 2FA Setup with an Authenticator App

wordpress.com SupportedChecked against official help · September 25, 2026

Your WordPress.com account controls every site you run there, so a stolen password shouldn't be enough to get in. WordPress.com calls the feature two-step authentication and lets you set it up with an authenticator app, which it recommends, or with SMS codes. Authenticator App - Novaz works as that app.

A hijacked WordPress.com account can be used to impersonate you and scam your contacts, so 2FA matters. Besides an authenticator app, WordPress.com also offers SMS text codes and security keys. An authenticator app (TOTP) is usually the best balance of security and convenience — and it's safer than SMS codes, which can be intercepted through SIM-swap attacks. For the strongest protection, WordPress.com also supports hardware security keys.

2FA methods WordPress.com supports

  • SMS text message
  • Authenticator app (TOTP)
  • Security key (U2F / WebAuthn)

Before you start

  • Your WordPress.com username or email address and password
  • Authenticator App - Novaz installed on your iPhone or iPad
  • WordPress.com open on a computer, so the QR code is on a different screen from your phone. You'll also need a computer later if you ever generate new backup codes
  • A safe place for your backup codes, such as a wallet or a secure password app, rather than a file on your computer
Download on the App Store

Part 1: Turn on 2FA in WordPress.com

  1. 1

    Open My WordPress.com Account

    Sign in to WordPress.com, hover over your name at the top right corner of any screen and select the "My WordPress.com Account" button.

  2. 2

    Go to Security > Two-Step Authentication

    Select "Security" in the menu on the side, then click "Two-Step Authentication". You can also go straight to my.wordpress.com/me/security.

  3. 3

    Click Set up using an app

    WordPress.com shows two options. Click "Set up using an app", marked "Recommended". A QR code appears; keep this page open.

Part 2: Add WordPress.com to Authenticator App - Novaz

  1. 4

    Scan the QR code with Authenticator App - Novaz

    Open Authenticator App - Novaz, tap the + button and point your camera at the QR code on the WordPress.com page. If the camera can't read it, choose to enter a setup key instead, type the code WordPress.com gives you and use "WordPress.com" as the account name.

  2. 5

    Save the account and note the code

    Check the account name and secret key the app filled in, then tap "Save". Authenticator App - Novaz now shows a six-digit code for WordPress.com that changes every 30 seconds.

Part 3: Confirm and finish

  1. 6

    Enter the code and click Enable

    Back on WordPress.com, type the six-digit code into the field on the two-step authentication screen and click the "Enable" button.

  2. 7

    Save and verify your backup codes

    WordPress.com now shows a set of backup codes. Don't skip this: copy, print or download them with the icons below the list, then type one of them into the field and click "Verify". Two-step authentication is now on, and WordPress.com will ask for a code each time you log in with your password.

If something goes wrong

  • WordPress.com says the code is wrong: make sure your iPhone sets its date and time automatically (Settings > General > Date & Time), then enter the newest code from Authenticator App - Novaz.
  • You've lost your backup codes list or think someone has seen it: on a computer, go to Security > Two-Step Authentication, enter a previously saved backup code under "Backup codes" and generate a new set. The old codes stop working.
  • An app connected to your WordPress.com account, such as a Jabber app, can't sign in any more: some apps don't fully support two-step authentication. Scroll to "Application passwords" on the Two-Step Authentication page, click "Add new application password", name it and click "Generate Password".

Checked against WordPress.com's own help pages on September 25, 2026. Menu names can change, so these pages have the current path:

How to recover your WordPress.com account

Backup codes are your way back in. If you lose your phone, delete Authenticator App - Novaz or are otherwise locked out, log in as usual, click "Use a backup code instead" when asked for a code and enter one of your saved codes. Each code works only once, so generate a new set when you're running low. Without your device or backup codes, use WordPress.com's Account Recovery form and prove ownership with a transaction ID from a WordPress.com purchase or the activation URL from your sign-up email. If WordPress.com can't verify you, it can't grant access.

Frequently asked questions

Which two-step methods does WordPress.com offer?
An authenticator app (recommended) and SMS codes. Once one of those is set up, you can also register a passkey or physical security key under "Security Key" on the same page and use it instead of a code.
How do I move my WordPress.com codes to a new iPhone?
Print your backup codes, install Authenticator App - Novaz on the new device, disable two-step authentication for the old device, then set it up again on the new one. If you're asked for a code along the way, use an unused backup code.
Can I turn two-step authentication off with a security key?
No. Clicking "Disable" under Security > Two-Step Authentication asks for a code from your authenticator app, an SMS code or a backup code, not a security key.

Generate your WordPress.com codes in Authenticator App - Novaz

Free, offline, and encrypted. One tap for every 6-digit code.

Get the app

More Social guides

Novaz is not affiliated with, endorsed by, or sponsored by WordPress.com. WordPress.com and its logo are trademarks of their respective owner and are used here for identification only.