# WordPress 2FA backup codes vs recovery codes: what to keep where

WordPress 2FA backup codes and the site's printed recovery codes do different jobs. How each works, how to store them, and what to do when they run out.

By BetterShield Team, Oct 11, 2026. Updated Nov 8, 2026 by Nazmul Hasan Rupok.

WordPress 2FA backup codes are the codes you get when you turn on two-factor sign-in: one-time codes that stand in for your authenticator app on the day your phone is not to hand. Many sites also have a second set of codes, printed recovery codes, which belong to the site rather than to a person and open a different door entirely. Mixing the two up is how people end up holding the wrong codes on the day they need the right ones.

This guide sets the two side by side, as BetterShield implements them, then covers where to keep each, what to do when they run low, and what to do when they are gone. Setting up two-factor itself is in [WordPress two-factor authentication](/blog/wordpress-two-factor-authentication/), and every way back into a locked site is in [Locked out of WordPress?](/blog/locked-out-of-wordpress/).

## Quick summary

- **Backup codes** belong to one account: ten eight-digit codes, each signing that account in once in place of an app code.
- **Printed recovery codes** belong to the site: eight longer codes, each pausing the site's protections for an hour so its owner can sign in.
- Both are shown once and kept only as hashes. Nobody can read them back, the site included.
- Keep backup codes away from the phone they back up, and printed codes away from the site and the inbox.
- Issue a new set of either while you can still authorize it. A new set replaces the old one at once.

## Two kinds of codes, side by side

| | Backup codes | Printed recovery codes |
|---|---|---|
| Whose | One account | The whole site |
| How many | 10 | 8 |
| Look like | Eight digits, as 1234-5678 | Sixteen letters and digits, in four groups of four |
| What one does | Signs that account in once, in place of the app code | Turns on safe mode for an hour: BetterShield's sign-in protections pause, and the owner signs in with their password |
| Where they come from | The last step of two-factor setup, or **New backup codes** | **Printed recovery codes** on **BetterShield › Protection › Recovery** |
| Where you type one | The **Authenticator app code or backup code** screen, after your password | The address printed on the sheet, with the code added to the end |
| How long they last | Until used, or replaced by a new set | Until used, or replaced by a new set |
| Who should hold them | The person whose account it is | The site's owner |

In short: a backup code gets one person past their own second step. A printed recovery code pauses BetterShield enforcement for an hour; the owner still needs a password, and host or third-party restrictions remain. They are the personal and the site-wide version of the same idea, and a site that requires two-factor needs both.

## How WordPress 2FA backup codes work in BetterShield

When someone finishes setting up two-factor, BetterShield shows ten backup codes, once. On **Protection › Two-Factor**, a profile or a store's **My Account › Sign-in security**, **Copy Codes** and **Download Codes** save them. When Ultra requires setup during sign-in, that page also offers **Print**. Two-factor only turns on when they press **I have stored these codes**, so the user explicitly confirms storage before enforcement begins. That confirmation does not verify where the codes were saved.

From then on:

- The **Authenticator app code or backup code** screen takes an unused backup code in the same field as the app code. Each code works once.
- The **Two-factor authentication** card shows how many are unused, and adds "Running low" at three or fewer. The profile shows "You have 3 backup codes left." with a suggestion to issue a new set while you can still authorize one.
- **New backup codes** issues a fresh ten. It asks for a current app code or a remaining backup code first, so nobody at an unlocked screen can mint themselves ten ways in. The old set stops working at once.
- Ten wrong codes in an hour, backup or app, stop codes being checked for that account until the hour is up.

Each use is recorded in the activity log as "Backup code used", and each new set as "New backup codes issued", so an unexpected use shows up.

## WordPress recovery codes: the site's way back in

The recovery link is the site's main way back in, and it arrives by email. Printed recovery codes exist for the day email is the thing that is broken. Under **Printed recovery codes** on **Protection › Recovery**, **Issue recovery codes** shows eight codes once, with **Print** and **Copy all**. The card then counts them: "8 unused codes. Issuing a new set replaces them."

Using one is deliberately heavy: it turns on safe mode for an hour, which pauses lockouts, the two-factor step and BetterShield's other sign-in protections, so the owner can sign in with their password and fix whatever locked them out. A code alone signs nobody in; the password is still needed.

These codes are also what lets you tighten sign-in safely. Before a role is added to **Require two-factor of a role**, BetterShield checks for a working recovery link or unused printed codes, and passkey-only sign-in refuses to start without one. See [Set up recovery](/docs/set-up-recovery/).

## How to store them

**Backup codes**

- In your password manager, labeled with the site and account, provided you can recover and unlock that vault without the missing phone.
- Or on paper, in a drawer you can reach, not taped to the monitor.
- Never only on the phone they back up. Losing the phone would lose both.
- One set per person. Nobody else needs your backup codes.

**Printed recovery codes**

- On paper, somewhere that is not the site and not your inbox: a safe, a locked drawer, a document store you control.
- Labeled with the site's address, so the right sheet is used on the right site.
- With a second copy for the person who would act if you could not, such as a business partner.
- For agencies, one sheet per client site, stored with that client's other credentials.

## When backup codes run low

Issue a new set as soon as the count reaches three, while your phone and app still work. On **Protection › Two-Factor**, enter an **App code or backup code** under **New backup codes** and press **Issue new codes**. On a profile, press **Issue new backup codes**, enter a **Code from the app, or a backup code**, and press **Issue new codes**.

Store the new ten before you leave the screen. They are shown once, and the old set no longer works.

## If the codes or the phone are gone

| Situation | What to do |
|---|---|
| Phone gone, backup codes in hand | Sign in with a backup code. Then turn two-factor off with another backup code, on **Protection › Two-Factor** or with **Turn off, or move to a new phone** on your profile, and set it up again on the new phone. If the site requires two-factor of your role, ask an administrator to turn it off instead. |
| Codes gone, phone in hand | Issue a new set with an app code. |
| Both gone | An administrator opens the account under **Users** and presses **Turn off two-factor for this account**. The person signs in with their password and sets it up again. |
| You are the only administrator, and both are gone | Use the recovery link or a printed recovery code. The two-factor step is not asked during safe mode, and while it lasts your password turns two-factor off on **Protection › Two-Factor** (an alert goes out). Then set it up again. |
| Printed codes lost or seen by someone else | Issue a new set on **Protection › Recovery**. The old codes stop working. |
| A backup code used that you did not use | Preserve the unexpected-use record, issue a new set, change the password, and review sessions and other credentials. |

Turning two-factor off for someone signs that account out everywhere, and is recorded as "Two-factor turned off". [Two-factor with an app](/docs/two-factor-app/) covers the details.

## Practice recovery without exposing the codes

A saved filename is not enough. Check that you can reach the backup-code copy without the phone or account you would be recovering. A password manager can be suitable even when it also runs on the phone, provided you can independently unlock its vault elsewhere. Avoid a circular dependency where opening the vault requires the very authenticator you have lost.

For a personal recovery rehearsal, keep an existing session open and use one backup code in a separate sign-in. Mark it spent. You now know both the saved copy and the sign-in route work. This consumes a code; it is not a read-only test.

For site recovery, **Check readiness now** checks the configured recovery state without consuming a link or code. A full safe-mode rehearsal is a different exercise: schedule it because it pauses protections for the site, sign in, check the cause you intended to recover from, and end safe mode promptly. Do not run it merely to see whether a printed string looks right.

**Worked example (fictional):** an agency stores each client's site recovery sheet in a restricted vault accessible to two authorized operators. Each editor keeps their own personal backup codes. When an editor replaces a phone, the agency handles that account's enrollment; it does not distribute the site-wide sheet to the whole writing team.

## Common mistakes

- **Pressing the last button before saving the codes.** They are shown once. Copy them first.
- **Keeping backup codes on the phone they back up.** One lost phone takes both.
- **Treating printed recovery codes as backup codes.** A printed code does not answer the code screen; it pauses the whole site's protections.
- **Waiting until the last backup code.** Issuing a new set needs a working code. Do it at three.
- **One printed sheet, in one place.** If that place is unavailable, so is your way back.

## Frequently asked questions

### Are backup codes the same as recovery codes?

No. Backup codes belong to one account and replace its app code once. Printed recovery codes belong to the site and turn on safe mode for an hour, so the owner can sign in and fix what went wrong.

### Can I see my backup codes again?

No. They are kept only as hashes and shown once. Issue a new set to get codes you can read, which retires the old ones.

### Do backup codes expire?

No. Each works until it is used, or until a new set replaces it. Printed recovery codes work the same way, while the recovery link lasts 90 days.

### What if someone finds my printed recovery codes?

A code alone signs nobody in: it pauses protections, and a password is still needed. Issue a new set straight away, which retires every old code.

## Conclusion

Backup codes keep one person able to answer their own second step. Printed recovery codes keep the site's owner able to get in when nothing else answers. Hold both, keep each away from what it backs up, and replace them before you run out.

BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/). Setup and lost phones are covered in [Two-factor with an app](/docs/two-factor-app/).