About this plugin
Loqwall 2FA adds a secure second authentication step after the standard WordPress username/password login. After entering their credentials, users must verify their identity with a one-time code before gaining access.
Features
- Email OTP — a 6-digit code is sent to the user’s registered email address.
- Authenticator App (TOTP) — time-based codes compatible with Google Authenticator, Authy, Bitwarden, and any RFC 6238 app.
- Backup codes — 10 one-time recovery codes generated per user.
- Device trust — optionally remember a trusted device for up to 30 days.
- Role enforcement — admins can be required to use 2FA regardless of their personal preference.
- Per-user control — users enable and configure 2FA from their own profile page.
- Rate limiting — brute-force protection on OTP verification.
- Audit log — every authentication event is recorded in a private database table.
- No external dependencies — all cryptographic operations use PHP’s built-in functions. No Composer, no remote APIs.
- Developer-friendly — hooks and filters let you customise behaviour without modifying plugin files.
For Developers: Hooks & Filters
Filters
Loqwall_2FA_required_for_user
Runs on every login attempt. Return false to exempt a user, or true to force 2FA regardless of settings.
add_filter( 'Loqwall_2FA_required_for_user', function( $required, $user ) { // Exempt the user with ID 5 from 2FA. if ( 5 === $user->ID ) { return false; } return $required; }, 10, 2 );
Loqwall_2FA_otp_email_message
Filters the email body before the OTP is sent. Receives the body string, the WP_User object, the plain-text 6-digit code, and a boolean indicating whether the email is HTML.
add_filter( 'Loqwall_2FA_otp_email_message', function( $body, $user, $code, $html_mode ) { // Append a custom footer to every OTP email. return $body. '<p>Need help?
com</p>'; }, 10, 4 );
Actions
Loqwall_2FA_verified
Fires immediately after a user successfully passes 2FA. Receives the user ID and the method used ( 'email', 'totp', or 'backup_code' ).
add_action( 'Loqwall_2FA_verified', function( $user_id, $method ) { // Log the successful verification to a custom audit system. my_audit_log( $user_id, 'login_verified', $method ); }, 10, 2 );
Loqwall_2FA_failed
Fires after each failed 2FA verification attempt. Receives the user ID and the method attempted.
add_action( 'Loqwall_2FA_failed', function( $user_id, $method ) { // Notify an admin after a failed attempt. " ); }, 10, 2 );<h3>Third Party Libraries</h3>
This plugin bundles the following third-party library:
qrcodejs
* Author: Sangmin Shim (davidshimjs)
* License: MIT
com/davidshimjs/qrcodejs
js
* Purpose: Renders the QR code displayed during Authenticator App setup. Used entirely client-side; makes no external network requests.