Two-step verification, also called two-step authentication or two-factor authentication, adds a second check, such as a code from a phone app, on top of the password for a store admin or payment account. This guide shows how to turn it on for Shopify, for a WooCommerce store’s WordPress login through WordPress.com and Jetpack, and for Stripe and PayPal accounts.

Before you start

Install an authenticator app on a phone. Shopify lists Google Authenticator, Duo Mobile, Amazon AWS MFA and Authenticator as examples. Stripe ranks the methods it supports from most to least secure: passkeys, security keys, Touch ID or Windows Hello, authenticator apps and text messages (SMS). It warns that text messages are unencrypted, need cell reception and are vulnerable to SIM swap attacks, and it recommends enabling two or more methods.

1. Shopify

  1. In the Shopify admin, click your store name.
  2. Click your profile, then click Security.
  3. In the Two-step authentication section, click Turn on two-step.
  4. Enter your password and click Next.
  5. From the Authentication method list, select Authenticator app.
  6. Scan the QR code with the app, enter the six-digit code it shows, and click Turn on.
  7. Optionally add a backup authentication method, then save your recovery codes.

Shopify suggests keeping recovery codes in several places, such as a password manager, cloud storage or a printed copy. It notes that Shopify Support can’t help with third-party authenticator apps.

2. WooCommerce on WordPress, through WordPress.com and Jetpack

For self-hosted WordPress sites running Jetpack, one documented route is to protect a WordPress.com account and use it to sign in to the store. First, turn on two-step authentication for the WordPress.com account, following WordPress.com’s instructions:

  1. While logged in, hover over your name in the top-right corner and select My WordPress.com account.
  2. In the side menu, select Security.
  3. Click Two-Step Authentication and choose to set it up with an app or with SMS.
  4. For an app, scan the QR code, type the six-digit code and click Enable.
  5. Copy, print or download the backup codes shown during setup. Each works only once.

Then connect the store’s login to that account using Jetpack‘s Secure Sign On:

  1. In WP Admin, go to Jetpack > Settings > Security.
  2. Turn on Allow users to log in to this site using WordPress.com accounts.
  3. Turn on Require accounts to use WordPress.com Two-Step Authentication.

Jetpack can link local and WordPress.com accounts that share an email address. That option, Match accounts using email address, is on by default.

3. Stripe

  1. Open the Personal details page in the Stripe Dashboard.
  2. Find the Two-step authentication section.
  3. Click Add authentication method and follow the prompts.
  4. Store the backup code somewhere safe.

Stripe says Touch ID or Windows Hello can be added only after another method, because they are tied to one device. Administrators can require two-step authentication for all team members on the Team settings page.

4. PayPal

PayPal’s help center describes setup with an authenticator app such as Google Authenticator or Microsoft Authenticator:

  1. Click the Settings icon next to Log out.
  2. Click Security near the top of the page.
  3. Click Set Up to the right of 2-step verification.
  4. Select Use an authenticator app.
  5. Click Set it Up and follow the on-screen steps.

Common problems

  • The phone with the authenticator app is lost. Shopify says to sign in with a backup method or a saved recovery code; without either, access must be recovered before sensitive actions such as deactivating the store. WordPress.com offers Use a backup code instead on its login screen and links to account recovery steps.
  • The Stripe backup code was not saved. Stripe shows it only once, when two-step authentication is first enabled. While still able to sign in, generate a new code in the two-step authentication settings; that invalidates the old one.
  • WordPress.com SMS codes don’t arrive. Try a backup code, then check signal strength, Do Not Disturb or flight mode, the phone number on the account, and whether texts from unknown senders are being filtered.
  • The WordPress login form still skips the second step. Jetpack says its two-step requirement applies only to logins made with WordPress.com credentials. The default WP Admin login form can bypass it unless that form is disabled with the jetpack_remove_login_form filter.
  • A user sees “We couldn’t find your account.” They signed in with WordPress.com credentials but have no linked local account. Jetpack says to connect their local account to WordPress.com.
  • The Shopify menu looks different. Shopify says a refreshed admin design is rolling out gradually, so the store name may be in a different place.