# How to turn on two-factor authentication

Two-factor authentication adds a code from an authenticator app to your password when you sign in. Your Workover account can publish to your live website, so it is worth protecting. In settings, Workover calls this **multi-factor authentication**; on the sign-in screen it is called **Two-factor authentication**. They are the same thing.

**Before you start:** you need your current Workover password and an authenticator app on your phone or computer, such as Google Authenticator or 1Password.

## Turn on two-factor authentication

1. Open your avatar menu and choose **Profile** to open **Account settings**, then open the **Security** tab.

![The full settings page showing where the Security tab and MFA section live](https://workover.io/api/proxy-image?url=https%3A%2F%2Fwp.wpdocsync.com%2Fwp-content%2Fuploads%2F2026%2F09%2Fthe-full-settings-page-showing-where-the-security-tab-and-mf-scaled.png)

1. Under **Multi-factor Authentication**, turn on the **Enable multi-factor authentication** toggle.
2. Enter your **Current Password** and click **Continue**.
3. On **Connect Authenticator App**, scan the QR code with your authenticator app.
4. Enter the 6-digit **Verification Code** from the app and click **Continue**.
5. On **Save your Emergency Recovery Codes**, click **Download recovery codes**. This saves a file called `workover-recovery-codes.txt`. You must download it before you can finish.
6. Click **Yes, I’ve saved my recovery codes**.

Two-factor authentication is on as soon as you reach the recovery codes step. The row now reads **Multi-factor authentication is on**, and from your next sign-in Workover asks for a code after your password.

## Sign in with two-factor authentication

After your password, the **Two-factor authentication** screen asks for the 6-digit code from your authenticator app. Enter it and click **Verify**.

If you cannot reach your authenticator app, click **Use a recovery code instead** and enter one of your recovery codes.

## Keep your recovery codes safe

Recovery codes get you in when you lose your phone or authenticator app. Each code works once.

- Store the file somewhere other than the phone that has your authenticator app, such as a password manager.
- There is no button to generate new codes on their own. To get a fresh set, turn two-factor authentication off and on again; setting it up again issues new codes.

## Turn off two-factor authentication

> **Warning:** Turning it off means your password alone gets into your account, and your authenticator app and recovery codes stop working.

1. In **Account settings** > **Security**, turn off the multi-factor authentication toggle.
2. In **Turn off multi-factor authentication**, enter your **Current Password**.
3. Click **Turn off**.

## If you lose access

- **You still have a recovery code:** sign in with it, then turn two-factor authentication off and on again to connect your new device and get new recovery codes.
- **You have no recovery code:** [contact support](/docs/contacting-support/).

## What it does not cover

Two-factor authentication protects your Workover sign-in. It does not protect your WordPress site, which has its own login and its own second-factor settings. It also does not affect the application password Workover uses to connect to WordPress, which you can revoke from wp-admin at any time.

To review the CLI and MCP connections signed in to your account, open **Account settings** > **Developer** and check **Connected devices**.

## Related

- [Your profile](/docs/your-profile/)
- [The CLI and MCP server](/docs/cli-and-mcp/)
- [Contacting support](/docs/contacting-support/)