Hub two-factor protects the Bedrock customer dashboard, not wp-login.php. Sign in, open Account, and turn on Hub two-factor with your password. Add the secret to an authenticator app, then enter a code to finish. Save the backup codes offline. We show them once.

The Hub stores that secret encrypted. We never email it and we do not write it to logs. After it is on, sign-in asks for a code. Password change, billing changes, and Site key rotate also ask for a code.

WordPress two-factor is separate and still lives in the plugin. Turn on two-factor or Account.