About this plugin
Email 2FA for WordPress adds an extra layer of security to the WordPress login process by using one-time passwords (OTP) sent via email.
The plugin does not require any external 2FA service, making it a simple and lightweight solution for WordPress websites.
php for the OTP verification step. This page is created automatically when the plugin is activated, with the verification shortcode already added. No manual page creation or shortcode configuration is required.
The plugin is completely free and focuses on providing essential Email 2FA functionality without unnecessary complexity or premium restrictions.
Features
- Two-factor authentication via email
- One-time passwords (OTP)
- Automatic creation of the verification page with the shortcode already added upon activation
- Configurable OTP length
- Configurable OTP expiration time
- Configurable maximum number of verification attempts
- Configurable OTP resend delay
- Require 2FA for all users
- Require 2FA for specific user roles
- Enable 2FA on a per-user basis
- Custom verification page using a shortcode
- Customizable login and verification URLs
- Uses WordPress wp_mail() functionality
- No external 2FA service required
Settings
The plugin settings are available on the Email 2FA settings page.
Available settings include:
- Enable or disable 2FA
- OTP length
- OTP expiration time
- Maximum number of failed verification attempts
- OTP resend delay
- Require 2FA for all users
- Require 2FA for specific user roles
- Email subject
If “Require 2FA for all users” is disabled, 2FA is required when the user’s role has been configured as mandatory, or when the user has enabled 2FA for their own account.
Note: On the first activation, “Require 2FA for all users” is enabled by default. This means that every account, including your own, will be required to complete 2FA on the next login. Make sure that your site can send emails correctly through wp_mail() before logging in again.
Verification Page
The OTP verification form is displayed using the shortcode:
[email_2fa_verify]
This page is created automatically when the plugin is activated, with the shortcode already added. If you need to use the verification form on another page (for example, in a custom template or page builder), you can manually add the same shortcode there.
The plugin manages the verification process and completes the user’s login when the correct OTP is entered.
URL Customization
The default verification page is the page automatically created during plugin activation ( /verify-2fa/ ).
If you prefer to use a different URL — for example, another page or slug — you can override the default page using the following filter:
add_filter( 'email_2fa_verify_url', function () { return home_url( '/custom-2fa-verification/' ); } );
To change the login page URL:
add_filter( 'email_2fa_login_url', function () { return home_url( '/login/' ); } );<h3>Email Configuration</h3>
The plugin uses WordPress’s wp_mail() functionality to send OTP codes.
No separate external email delivery service is required.
If you want to set a specific sender email address:
com'; } );
To change the sender name:
add_filter( 'wp_mail_from_name', function ( $name ) { return 'Your Website Name'; } );
If you are using an SMTP plugin, it is recommended to configure the sender address through your SMTP plugin settings.
Caching
The login and verification pages are dynamic.
If you use a caching plugin or server-level caching, you must exclude the login and verification pages from caching.
Examples of caching plugins include:
- LiteSpeed Cache
- WP Rocket
- WP Super Cache
Incorrectly caching these pages may cause problems with the login and verification process.
Troubleshooting
The user is not redirected to the verification page
Check that 2FA is actually required for the specific user.
Check the following settings:
- Require 2FA for all users
- Require 2FA for specific user roles
- Enable 2FA per user
If the login form uses AJAX, make sure that the plugin’s login detection mechanisms can run correctly on the login page.
The verification page keeps refreshing
This may be caused by another redirect configured on the website.
php, the login page, or the verification page.
The verification session has expired or is invalid
This may mean that the pending verification cookie or token could not be found or has expired.
Check that:
- The OTP database table exists.
- Cookies are enabled in the browser.
- Cookies are not being deleted by another plugin.
- The login and verification pages use the correct domain.
- The pages are excluded from page caching.
- The WordPress timezone is configured correctly.
The verification page no longer exists / I accidentally deleted it
The page will be created again the next time you activate the plugin (deactivate and activate it again).
The verification form is displayed to users who have not started a login attempt
Check whether the verification page is being cached by a caching system.
Exclude the verification page from page caching so that the shortcode is executed separately for each visitor.
Security
Email 2FA for WordPress is designed to provide an additional layer of security to the WordPress login process by using one-time passwords (OTP) sent via email.
For better security, keep WordPress, plugins, and themes up to date.
Links
gr/
com/dimitridedou
gg/VWXWSBtvKd