Two-factor is optional until you enroll. In WP-Admin open Bedrock Shield, Settings, and turn on Two-factor (TOTP). Then each admin opens Users, Profile, Bedrock Shield two-factor, adds an authenticator app, and saves the backup codes offline. A Hub Protect action can require this for every administrator. That asks for confirm first. Stop requiring it from Protect, or rename the plugin folder if you cannot enroll.

Your Bedrock Hub account can also use two-factor. Sign in, open Account, and turn on Hub two-factor. That is separate from WordPress. We store the Hub secret encrypted and never email it.

Leave brute-force lockouts on. Do not hide wp-login.php until you tested the new slug on one site. Hide the login URL is optional and Advanced. We do not ship magic links or passkeys.

Hub account two-factor or How to connect.