WordPress 2FA backup codes vs recovery codes: what to keep where
Updated by Nazmul Hasan Rupok on
WordPress 2FA backup codes are the codes you get when you turn on two-factor sign-in: one-time codes that stand in for your authenticator app on the day your phone is not to hand. Many sites also have a second set of codes, printed recovery codes, which belong to the site rather than to a person and open a different door entirely. Mixing the two up is how people end up holding the wrong codes on the day they need the right ones.
This guide sets the two side by side, as BetterShield implements them, then covers where to keep each, what to do when they run low, and what to do when they are gone. Setting up two-factor itself is in WordPress two-factor authentication, and every way back into a locked site is in Locked out of WordPress?.
Quick summary
- Backup codes belong to one account: ten eight-digit codes, each signing that account in once in place of an app code.
- Printed recovery codes belong to the site: eight longer codes, each pausing the site’s protections for an hour so its owner can sign in.
- Both are shown once and kept only as hashes. Nobody can read them back, the site included.
- Keep backup codes away from the phone they back up, and printed codes away from the site and the inbox.
- Issue a new set of either while you can still authorize it. A new set replaces the old one at once.
Two kinds of codes, side by side
| Backup codes | Printed recovery codes | |
|---|---|---|
| Whose | One account | The whole site |
| How many | 10 | 8 |
| Look like | Eight digits, as 1234-5678 | Sixteen letters and digits, in four groups of four |
| What one does | Signs that account in once, in place of the app code | Turns on safe mode for an hour: BetterShield’s sign-in protections pause, and the owner signs in with their password |
| Where they come from | The last step of two-factor setup, or New backup codes | Printed recovery codes on BetterShield › Protection › Recovery |
| Where you type one | The Authenticator app code or backup code screen, after your password | The address printed on the sheet, with the code added to the end |
| How long they last | Until used, or replaced by a new set | Until used, or replaced by a new set |
| Who should hold them | The person whose account it is | The site’s owner |
In short: a backup code gets one person past their own second step. A printed recovery code pauses BetterShield enforcement for an hour; the owner still needs a password, and host or third-party restrictions remain. They are the personal and the site-wide version of the same idea, and a site that requires two-factor needs both.
One account or the whole site?
These recovery tools are deliberately different. Select one before using it.
- Personal backup code
Replaces one app code.
- Site recovery code
Starts a temporary pause.
- Recovery link
A single-use site credential.
Personal backup code
- What this means
- An unused code answers the second-factor prompt for its account. It does not replace the account password.
- Your next check
- Keep a copy you can reach without the lost phone, and label it with the site and account.
Site recovery code
- What this means
- A printed site code starts safe mode for an hour. It pauses BetterShield enforcement rather than signing you in.
- Your next check
- Use the address on the printed sheet, then sign in with your own account password.
Recovery link
- What this means
- The current unexpired link opens the recovery flow. An older or replaced link will not work.
- Your next check
- Store the replacement after use, resolve the cause, and end safe mode when finished.
How WordPress 2FA backup codes work in BetterShield
When someone finishes setting up two-factor, BetterShield shows ten backup codes, once. On Protection › Two-Factor, a profile or a store’s My Account › Sign-in security, Copy Codes and Download Codes save them. When Ultra requires setup during sign-in, that page also offers Print. Two-factor only turns on when they press I have stored these codes, so the user explicitly confirms storage before enforcement begins. That confirmation does not verify where the codes were saved.
From then on:
- The Authenticator app code or backup code screen takes an unused backup code in the same field as the app code. Each code works once.
- The Two-factor authentication card shows how many are unused, and adds “Running low” at three or fewer. The profile shows “You have 3 backup codes left.” with a suggestion to issue a new set while you can still authorize one.
- New backup codes issues a fresh ten. It asks for a current app code or a remaining backup code first, so nobody at an unlocked screen can mint themselves ten ways in. The old set stops working at once.
- Ten wrong codes in an hour, backup or app, stop codes being checked for that account until the hour is up.
Each use is recorded in the activity log as “Backup code used”, and each new set as “New backup codes issued”, so an unexpected use shows up.
WordPress recovery codes: the site’s way back in
The recovery link is the site’s main way back in, and it arrives by email. Printed recovery codes exist for the day email is the thing that is broken. Under Printed recovery codes on Protection › Recovery, Issue recovery codes shows eight codes once, with Print and Copy all. The card then counts them: “8 unused codes. Issuing a new set replaces them.”
Using one is deliberately heavy: it turns on safe mode for an hour, which pauses lockouts, the two-factor step and BetterShield’s other sign-in protections, so the owner can sign in with their password and fix whatever locked them out. A code alone signs nobody in; the password is still needed.
These codes are also what lets you tighten sign-in safely. Before a role is added to Require two-factor of a role, BetterShield checks for a working recovery link or unused printed codes, and passkey-only sign-in refuses to start without one. See Set up recovery.
How to store them
Backup codes
- In your password manager, labeled with the site and account, provided you can recover and unlock that vault without the missing phone.
- Or on paper, in a drawer you can reach, not taped to the monitor.
- Never only on the phone they back up. Losing the phone would lose both.
- One set per person. Nobody else needs your backup codes.
Printed recovery codes
- On paper, somewhere that is not the site and not your inbox: a safe, a locked drawer, a document store you control.
- Labeled with the site’s address, so the right sheet is used on the right site.
- With a second copy for the person who would act if you could not, such as a business partner.
- For agencies, one sheet per client site, stored with that client’s other credentials.
When backup codes run low
Issue a new set as soon as the count reaches three, while your phone and app still work. On Protection › Two-Factor, enter an App code or backup code under New backup codes and press Issue new codes. On a profile, press Issue new backup codes, enter a Code from the app, or a backup code, and press Issue new codes.
Store the new ten before you leave the screen. They are shown once, and the old set no longer works.
If the codes or the phone are gone
| Situation | What to do |
|---|---|
| Phone gone, backup codes in hand | Sign in with a backup code. Then turn two-factor off with another backup code, on Protection › Two-Factor or with Turn off, or move to a new phone on your profile, and set it up again on the new phone. If the site requires two-factor of your role, ask an administrator to turn it off instead. |
| Codes gone, phone in hand | Issue a new set with an app code. |
| Both gone | An administrator opens the account under Users and presses Turn off two-factor for this account. The person signs in with their password and sets it up again. |
| You are the only administrator, and both are gone | Use the recovery link or a printed recovery code. The two-factor step is not asked during safe mode, and while it lasts your password turns two-factor off on Protection › Two-Factor (an alert goes out). Then set it up again. |
| Printed codes lost or seen by someone else | Issue a new set on Protection › Recovery. The old codes stop working. |
| A backup code used that you did not use | Preserve the unexpected-use record, issue a new set, change the password, and review sessions and other credentials. |
Turning two-factor off for someone signs that account out everywhere, and is recorded as “Two-factor turned off”. Two-factor with an app covers the details.
Practice recovery without exposing the codes
A saved filename is not enough. Check that you can reach the backup-code copy without the phone or account you would be recovering. A password manager can be suitable even when it also runs on the phone, provided you can independently unlock its vault elsewhere. Avoid a circular dependency where opening the vault requires the very authenticator you have lost.
For a personal recovery rehearsal, keep an existing session open and use one backup code in a separate sign-in. Mark it spent. You now know both the saved copy and the sign-in route work. This consumes a code; it is not a read-only test.
For site recovery, Check readiness now checks the configured recovery state without consuming a link or code. A full safe-mode rehearsal is a different exercise: schedule it because it pauses protections for the site, sign in, check the cause you intended to recover from, and end safe mode promptly. Do not run it merely to see whether a printed string looks right.
Worked example (fictional): an agency stores each client’s site recovery sheet in a restricted vault accessible to two authorized operators. Each editor keeps their own personal backup codes. When an editor replaces a phone, the agency handles that account’s enrollment; it does not distribute the site-wide sheet to the whole writing team.
Common mistakes
- Pressing the last button before saving the codes. They are shown once. Copy them first.
- Keeping backup codes on the phone they back up. One lost phone takes both.
- Treating printed recovery codes as backup codes. A printed code does not answer the code screen; it pauses the whole site’s protections.
- Waiting until the last backup code. Issuing a new set needs a working code. Do it at three.
- One printed sheet, in one place. If that place is unavailable, so is your way back.
Frequently asked questions
Are backup codes the same as recovery codes?
No. Backup codes belong to one account and replace its app code once. Printed recovery codes belong to the site and turn on safe mode for an hour, so the owner can sign in and fix what went wrong.
Can I see my backup codes again?
No. They are kept only as hashes and shown once. Issue a new set to get codes you can read, which retires the old ones.
Do backup codes expire?
No. Each works until it is used, or until a new set replaces it. Printed recovery codes work the same way, while the recovery link lasts 90 days.
What if someone finds my printed recovery codes?
A code alone signs nobody in: it pauses protections, and a password is still needed. Issue a new set straight away, which retires every old code.
Conclusion
Backup codes keep one person able to answer their own second step. Printed recovery codes keep the site’s owner able to get in when nothing else answers. Hold both, keep each away from what it backs up, and replace them before you run out.
BetterShield is free on WordPress.org. Setup and lost phones are covered in Two-factor with an app.