Does it make sense to use two factor authentication with password protected wp-admin folder?

Question

I've finished building my wordpress website and now, I'm concerned about the security of the website.

To improve security, I'm using Google two factor authentication plugin while also password-protecting the wp-admin folder besides the default username-password login of wordpress.

My question is, does it make sense to apply all these layers of security? Am I being silly about this? I mean, if either two of these protection methods are used, instead of three, and it is enough, then using all three will be too much of a hassle without bringing significant improvement in security. What do you think?

Answer 1

I am not sure what three factors you are counting here.

I count two: (1) passwords (2) Google 2-factor.

Now, I'm not getting into Google's solution, how it works or whether it is good or not.

But simply adding another password, does NOT create a 2nd factor - to do that, you need a different factor.

As a reminder, the typical authentication factors are:

1. Something you know (e.g. passwords)
2. Something you have (e.g. smartcard, or G2F)
3. Something you are (e.g. biometrics).

So having two different passwords is still just one factor, and does not give you the benefits of having the 2nd factor, or prevent the threats against single-factor authn.

Is it silly to add a 2nd factor, given that you already have 2 passwords?
It's hard for us to say, not knowing what the site is for or about, your risk profile, tolerance, etc. But if you need to keep it secure - and it's not your sister's cat's blog - then no, it is not silly at all.