# WordPress 2FA remember device: trust a browser for up to 90 days

Let a browser skip the WordPress two-factor code screen for 1 to 90 days, see which browsers are trusted, and forget them when a laptop is lost.

By M Asif Rahman, Nov 4, 2026.

WordPress can remember a device for two-factor sign-in: **Trusted browsers** in BetterShield Ultra, the separate paid add-on, lets a person tick a box after entering a valid code, and that browser then skips the code screen for 1 to 90 days. A password or passkey is still required every time.

Our guide to [two-factor authentication for WordPress](/blog/wordpress-two-factor-authentication/) explains why a code after the password is worth having. This post covers the everyday cost of it, typing a code on the same laptop every morning, and how to lower that cost without giving up the protection.

## Quick summary

- **Trusted browsers** is part of BetterShield Ultra. The free plugin asks for the code at every sign-in.
- It is off by default. **Days a browser stays trusted** accepts 1 to 90, and **0** turns it off.
- A trusted browser skips only the code screen. The password or passkey is still required.
- **Your trusted browsers** lists your own browsers, and **Remove** forgets one.
- A browser is also forgotten when the account password changes, two-factor is reset or turned off, or everyone is signed out.

## Why people turn off two-factor, and what to do instead

Two-factor sign-in is a good habit and an easy one to resent. If you sign in to the same site from the same laptop each day, the code screen starts to feel like a tax. The risk is that a tired team answers by weakening the rule for everyone: leaving two-factor optional, or asking nobody to use it.

A remembered browser is the middle path. [Multi-factor authentication](https://en.wikipedia.org/wiki/Multi-factor_authentication) asks for more than one kind of proof. A trusted browser keeps the password or passkey as the first proof, and lets the browser itself stand in for the second one, for a limited time, on a device the person chose.

## What Trusted browsers does

After someone enters a valid two-factor code, the code screen offers a choice to trust that browser for the number of days you set. If they take it, later sign-ins from that browser skip the code screen until the trust expires.

A few details are worth knowing before you switch it on:

- **It is the person's choice each time.** Nothing is trusted unless the person ticks the box after a valid code.
- **It skips the code screen only.** A password or passkey is still required.
- **It is per site.** On multisite, a browser trusted on one site skips the code on that site only.
- **It is limited by time.** Trust ends when the window you set ends.

## Set it up

You need BetterShield and the [BetterShield Ultra](/docs/bettershield-ultra/) add-on active, and two-factor already set up on the accounts that will use it. If you have not done that yet, start with [setting up an authenticator app](/docs/two-factor-app/).

1. Open **BetterShield › Ultra › Trusted browsers**.
2. Set **Days a browser stays trusted** to a number from 1 to 90.
3. Press **Save**.

The default is **0**, which turns trusted browsers off. Once you save a number above zero, the code screen offers the choice to trust the browser for that many days.

| Kind of use | What we suggest |
|---|---|
| A personal laptop used every day | A short window that matches your sign-in routine |
| A shared or public computer | Leave the box unticked |
| A lost or stolen device | Forget that account's browsers straight away |

## Choosing the number of days

There is no single right answer, because the number trades convenience against how long a copied or stolen browser keeps its pass. We recommend starting short. A window of a week or two is enough to remove the daily friction for most people, and you can lengthen it later if nobody objects.

Shortening the window also shortens trust that was already granted, so you do not need to wait for old trust to run out after you tighten it.

## Seeing and forgetting trusted browsers

The **Trusted browsers** screen has two lists.

- **Your trusted browsers** shows your own trusted browsers, with when each was trusted and when it expires. **Remove** forgets one.
- **Other people’s trusted browsers** shows how many trusted browsers each account holds. **Remove All Their Trusted Browsers** forgets every one for that account.

Since BetterShield Ultra 1.0.4, people can also see and forget their own trusted browsers from their WordPress profile. Forgetting a browser removes its code-screen bypass only. It does not remove the person’s authenticator app or passkey.

## What it can break, and how to undo

A long trust window reduces how often a stolen browser is asked for a code. That is the whole trade, so keep the window as short as your team will accept.

To undo it, shorten **Days a browser stays trusted** or set it to **0**, then press **Save**. Because shortening the window also shortens trust already granted, the change takes effect for browsers that are already trusted.

Trust also ends by itself, with no action from you, in these cases:

- The account password changes.
- Two-factor is reset or turned off for the account.
- The account is signed out everywhere, or everyone is signed out.
- The site is locked down.

That last group is why the [sessions tools](/docs/sessions/) and the [site lockdown](/blog/wordpress-site-lockdown/) matter here. Ending sessions also forgets the browsers that were skipping the code, which is what you want after a lost device.

## When a laptop is lost

If a trusted laptop goes missing, do these in order:

1. Change the account password. A password change forgets that account’s trusted browsers.
2. Open **Other people’s trusted browsers** and press **Remove All Their Trusted Browsers** for the account, if you want to be certain.
3. Sign the account out everywhere from the [sessions](/docs/sessions/) tools.
4. Check the [activity log](/docs/activity-log/) for sign-ins you do not recognize.

Because the password is still needed, a trusted browser on its own does not let someone in who has no password or passkey. The steps above end the trust so that a stolen browser asks for a code again.

## Check it is working

- **The code screen.** After a valid code, it shows the choice to trust the browser.
- **Your trusted browsers.** After you take that choice, the browser appears with when it was trusted and when it expires.
- **The next sign-in.** From the same browser, with the password or passkey, the code screen is skipped.
- **The activity log.** It records changes to trusted browsers. See [the activity log](/docs/activity-log/) for filters and export.

If you want to see who has a second factor at all, the [sign-in report](/docs/sign-in-report/) is part of Ultra too.

## How it fits with the rest of sign-in

Trusted browsers sits on top of two-factor, not instead of it. If your roles must use two-factor, our guide to [requiring two-factor](/blog/enforce-two-factor-wordpress/) covers who is asked and when, and a trusted browser does not change who is required to set it up. The backup codes you keep for a lost phone are a separate thing again, explained in [WordPress 2FA backup codes vs recovery codes](/blog/wordpress-2fa-backup-codes/).

[Sign-in policies](/docs/sign-in-policies/) and [Locked out](/docs/locked-out/) cover the neighboring controls if you want to tighten sign-in further or know how to get back in when something goes wrong.

## Recommended settings

- Keep **Days a browser stays trusted** short. We recommend starting with a week or two.
- Tell people to leave the box unticked on shared and public computers.
- Ask people to remove a browser from their profile when they stop using the device.
- After a lost device, change the password first, then forget that account’s browsers.
- Use one account per person, so a list of trusted browsers belongs to one person.

## Frequently asked questions

### Do I need BetterShield Ultra for trusted browsers?

Yes. **Trusted browsers** is part of the paid BetterShield Ultra add-on. The free plugin still sets up two-factor with an authenticator app, but it asks for the code at every sign-in.

### Does a trusted browser skip the password too?

No. A trusted browser skips only the code screen. A password or passkey is still required for every sign-in.

### How long can a browser stay trusted?

From 1 to 90 days, set by **Days a browser stays trusted**. The default is **0**, which turns trusted browsers off.

### How do I forget a trusted browser?

Press **Remove** next to it under **Your trusted browsers**, or forget it from your WordPress profile. An administrator can use **Remove All Their Trusted Browsers** for another account.

### Does it work across a multisite network?

No. A browser trusted on one site skips the code on that site only.

## Conclusion

Trusted browsers lets a person skip the code screen on a browser they chose, for a number of days you control, while the password or passkey stays in place. You can see every trusted browser, forget any of them, and turn the whole thing off by setting the days to 0. BetterShield is free on [WordPress.org](https://wordpress.org/plugins/bettershield/), and BetterShield Ultra adds this feature; the full details are in the [Trusted browsers doc](/docs/trusted-devices/).