Ivan

The Google Authenticator plugin for WordPress gives you two-factor authentication using the Google Authenticator app for Android/iPhone/Blackberry.
If you are security aware, you may already have the Google Authenticator app installed on your smartphone, using it for two-factor authentication on Gmail/Dropbox/Lastpass/Amazon etc.
The two-factor authentication requirement can be enabled on a per-user basis. You could enable it for your administrator account, but log in as usual with less privileged accounts.
If You need to maintain your blog using an Android/iPhone app, or any other software using the XMLRPC interface, you can enable the App password feature in this plugin, 
but please note that enabling the App password feature will make your blog less secure.
<h3>Credits</h3>
Thanks to:
<a href="https://profiles.wordpress.org/evinak/" rel="nofollow ugc">Oleksiy</a> for a bugfix in multisite.
<a href="https://github.com/pancek" rel="nofollow ugc">Paweł Nowacki</a> for the Polish translation
<a href="https://github.com/FabioZumbi12" rel="nofollow ugc">Fabio Zumbi</a> for the Portuguese translation
<a href="https://www.guidoschalkx.com/" rel="nofollow ugc">Guido Schalkx</a> for the Dutch translation.
<a href="https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=henrik%40schack%2edk&lc=US&item_name=Google%20Authenticator&item_number=Google%20Authenticator&no_shipping=0&no_note=1&tax=0&bn=PP%2dDonationsBF&charset=UTF%2d8" rel="nofollow ugc">Henrik.Schack</a> for writing/maintaining versions 0.20 through 0.48
<a href="http://tobias.baethge.com/" rel="nofollow ugc">Tobias Bäthge</a> for his code rewrite and German translation.
<a href="http://blog.pcode.nl/" rel="nofollow ugc">Pascal de Bruijn</a> for his “relaxed mode” idea.
<a href="http://technobabbl.es/" rel="nofollow ugc">Daniel Werl</a> for his usability tips.
<a href="http://dd32.id.au/" rel="nofollow ugc">Dion Hulse</a> for his bugfixes.
<a href="https://profiles.wordpress.org/users/aldolat/" rel="nofollow ugc">Aldo Latino</a> for his Italian translation.
<a href="http://www.kaijia.me/" rel="nofollow ugc">Kaijia Feng</a> for his Simplified Chinese translation.
<a href="http://www.buayacorp.com/" rel="nofollow ugc">Alex Concha</a> for his security tips.
<a href="http://jetienne.com/" rel="nofollow ugc">Jerome Etienne</a> for his jquery-qrcode plugin.
<a href="http://orizhial.com/" rel="nofollow ugc">Sébastien Prunier</a> for his Spanish and French translation.

Google Authenticator

Personally I feel 2FA should be a part of WordPress core. But since it isn't, plugins like this one are a must-have to secure your sites.

The configuration interface is clearly layed out and the login page fits in perfectly with the default WP login page styling.

This plugin is light-weight, unobtrusive, free and adds that extra layer of security. Should your admin credentials ever be compromised, 2FA will keep your site secure.

Must-have security plugin

Awesome plugin, which is almost always in first group of plugin I've install on new website. Thank you for create and maintain it.

One on few my first-to-install plugin

Google Authenticator for your WordPress blog.

Alexandre Froger

Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.
<h3>Overview</h3>
This plugin adds the following major features to WordPress:
<ul>
<li>3 One-Time Password modes: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li>3 Authentication Gateways for OTP Verification Codes: WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li>Two-Factor Authentication: allow (or force) users to authenticate with a second factor on top of their password.</li>
<li>Passwordless Authentication: allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li>Account Validation: force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li>Synchronize OTP identifiers with existing data: wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li>Simple yet customizable appearance: forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li>Activity Logs: when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li>Customizable for developers: developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li>Integration-friendly: specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li>Unlimited features: there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.
Each bug report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.
Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.
Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum.
<h3>Integrations</h3>
Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.
Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).
If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.
All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception. 
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.

OTP Authenticator

One-Time Password Authentication for WordPress

Google Authenticator vs OTP Authenticator