Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (Google Authenticator, Authy, etc.)

Two Factor Authentication

<p>Secure WordPress login with this two factor authentication (TFA / 2FA) plugin. Users for whom it is enabled will require a one-time code in order to log in. From the authors of <a href="https://updraftplus.com/" rel="nofollow ugc">UpdraftPlus &#8211; WP&#8217;s #1 backup/restore plugin</a>, with over two million active installs.</p>
<p>Are you completely new to TFA? <a href="https://wordpress.org/plugins/two-factor-authentication/faq/" rel="ugc">If so, please see our FAQ</a>.</p>
<p>Features (please see the &#8220;Screenshots&#8221; for more information):</p>
<ul>
<li>Supports standard TOTP + HOTP protocols (and so supports Google Authenticator, Authy, and many others).</li>
<li>Displays graphical QR codes for easy scanning into apps on your phone/tablet</li>
<li>TFA can be made available on a per-role basis (e.g. available for admins, but not for subscribers)</li>
<li>TFA can be turned on or off by each user</li>
<li>TFA can be required for specified user levels, after a defined time period (e.g. require all admins to have TFA, once their accounts are a week old) (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/" rel="nofollow ugc">Premium version</a>), including forcing them to immediately set up (by redirecting them to the page to do so)</li>
<li>Supports front-end editing of settings, via [twofactor_user_settings] shortcode (i.e. users don&#8217;t need access to the WP dashboard). (The <a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/" rel="nofollow ugc">Premium version</a> allows custom designing of any layout you wish).</li>
<li>Site owners can allow &#8220;trusted devices&#8221; on which TFA codes are only asked for a chosen number of days (instead of every login); e.g. 30 days (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/" rel="nofollow ugc">Premium version</a>)</li>
<li>Encrypt the TFA-generating secret keys using an on-disk encryption key, so that an attacker would need to break into both your WordPress database <em>and</em> your files in order to break TFA codes (as well as breaking a user&#8217;s password in order to use them)</li>
<li>Works together with <a href="https://wordpress.org/plugins/theme-my-login/" rel="ugc">&#8220;Theme My Login&#8221;</a> (both forms and widgets)</li>
<li>Includes support for the WooCommerce and Affiliates-WP login forms</li>
<li>Includes support for Ultimate Membership Pro</li>
<li>Includes support for CozmosLabs Profile Builder</li>
<li>Includes support for Ultimate Member login forms (Premium version)</li>
<li>Includes support for Elementor Pro login forms (Premium version)</li>
<li>Includes support for bbPress login forms (Premium version)</li>
<li>Includes support for login forms from the Gravity Forms User Registration add-on (Premium version)</li>
<li>Includes support for any and every third-party login form (Premium version) without any further coding needed via appending your TFA code to the end of your password</li>
<li>Does not mention or request second factor until the user has been identified as one with TFA enabled (i.e. nothing is shown to users who do not have it enabled)</li>
<li>WP Multisite compatible (plugin should be network activated)</li>
<li>Simplified user interface and code base for ease of use and performance</li>
<li>Added a number of extra security checks to the original forked code</li>
<li>Alert users if someone appears to have found out their password, as indicated by successfully entering a password but repeatedly entering an incorrect TFA code.</li>
<li>Emergency codes for when you lose your phone/tablet (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/" rel="nofollow ugc">Premium version</a>)</li>
<li>When using the front-end shortcode (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/" rel="nofollow ugc">Premium version</a>), require the user to enter the current TFA code correctly to be able to activate TFA </li>
<li>Works together with <a href="https://wordpress.org/plugins/wp-members/" rel="ugc">&#8220;WP Members&#8221;</a> (shortcode form)</li>
<li>Administrators can access other users&#8217; codes, and turn them on/off when needed (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/" rel="nofollow ugc">Premium version</a>)</li>
</ul>
<h4>Why use TFA / 2FA ?</h4>
<p>Read this! <a href="https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/" rel="nofollow ugc">https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/</a></p>
<h4>How Does TFA / 2FA Work?</h4>
<p>This plugin uses the industry standard TFA / 2FA algorithm <a href="https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm" rel="nofollow ugc">TOTP</a> or <a href="https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm" rel="nofollow ugc">HOTP</a> for creating One Time Passwords. These are used by Google Authenticator, Authy, and many other OTP applications that you can deploy on your phone etc.</p>
<p>A TOTP code is valid for a certain time. Whatever program you use (i.e. Google Authenticator, etc.) will show a different code every so often.</p>
<h4>Plugin Notes</h4>
<p>This plugin began life in early 2015 as a friendly fork and enhancement of <a href="https://wordpress.org/plugins/two-factor-auth/" rel="ugc">Oscar Hane&#8217;s &#8220;two factor auth&#8221; plugin</a>.</p>


Alternative Plugins for

Discover the Lists with Two Factor Authentication

New Install Plugins

DRONEXT Setup

Standard Plugins

namaroopa before migrate

vol intsall

Christoph Dorn

Christoph Dorn

startup

Credit Platform

Essenziali