Active installationsNewAdoption metric — not a quality score
WordPress.org ratingNo WordPress.org ratings yet
Official packageDirect from WordPress.org
Repository metrics are context, not quality scores. Active installations measure adoption and can strongly reflect a plugin’s age and historical popularity. Ratings, recent updates and “Tested up to” metadata also do not guarantee modern code, error-free operation, security, feature completeness or suitability for a particular site. Why active installs don’t tell the whole story →
WP PlugIndex currently records FactorGuard – Two-Factor Authentication version 1.0.1 as active, updated 9d ago and tested up to WordPress 7.1.
Overview
About this plugin
FactorGuard is a lightweight, privacy-first Two-Factor Authentication (2FA) plugin for WordPress. It adds a rock-solid two-step verification layer to the default WordPress login page, without relying on any external cloud service or third-party API.
After a user enters the correct username and password, they must complete a second step: enter a one-time code sent to their email or use a time-based code from an authenticator app like Google Authenticator or Authy.
>
🔒 Zero external API calls. All verification happens on your own server.
Core Features:
⚡ Email OTP: send a one-time passcode to the user’s registered email address
📱 Authenticator App (TOTP): full RFC 6238 support for Google Authenticator, Authy, and any TOTP-compatible app
🔑 One-time backup codes: hashed recovery codes so users never get locked out
🔐 Military-grade encryption: TOTP secrets encrypted at rest using libsodium XSalsa20-Poly1305
🚫 Replay attack protection: accepted TOTP codes are invalidated for the current time-slice
⏱️ Brute force & rate limiting: configurable lockout after too many failed attempts
🧙 Setup wizard: guided onboarding to configure your preferred 2FA method in minutes
🌐 API-safe: automatically bypasses OTP for REST API and XML-RPC requests
🌍 Translation ready: fully internationalised and.pot file included
🧹 Clean uninstall: removes all plugin data on uninstall (opt-in)
How It Works – Email OTP
User enters their username and password on the login page
If credentials are correct and OTP is enabled, a verification code is emailed to the user
The login form shows an OTP input field (username/password fields are hidden)
User enters the code sent to their email
On success, login completes. On failure, the attempt is counted toward the lockout limit
How It Works – TOTP (Authenticator App)
Site admin enables TOTP under Settings > FactorGuard
Each user visits their Profile page and scans the QR code with their authenticator app
Users enter the 6-digit code shown in their app to activate TOTP on their account
On subsequent logins, the login form asks for the current authenticator app code instead of sending an email
WordPress.org metadata
Plugin tags
Topics listed for this plugin in the WordPress.org directory.
login security
two factor
2fa
authentication
otp
Compatibility & maintenance
Compatibility & maintenance
Tested with WP 7.1
Marked as tested with the current WordPress 7.1 release.
Current WordPress releaseWordPress 7.1
WordPress.org Tested up to7.1
Minimum requirementsWordPress 5.6 · PHP 8.2
Update activity24 Oct 20269d ago
“Tested up to” is directory metadata supplied by the plugin author. WP PlugIndex does not turn an older declaration into a claim that the plugin is incompatible.
Changes recorded by WP PlugIndex
Recent tracked changes
Version1.0.0→1.0.1
WordPress compatibility7.1→7.1.3
Tracking & source
WP PlugIndex tracks public WordPress.org directory metadata and records selected version, compatibility and availability changes as they are detected.
