it’s virtually impossible to eliminate the human factor in poor password selection or the practice of using the same password for multiple online services.

https://wordpress.org/plugins/wp-google-authenticator/