About this plugin
A stolen or guessed password is the most common way into a WordPress dashboard. This plugin adds a second step to the login: after the password, the user enters a one-time code that only their phone has.
Ways to get the code
- Authenticator app — Google Authenticator, Yandex Key, Microsoft Authenticator, 1Password, Bitwarden or any other app that supports TOTP (RFC 6238). Works offline, no external services. The QR code for setup is drawn in the browser, so the secret never leaves the site.
- Telegram — the site’s own bot sends a 6-digit code to the user’s Telegram. Optional; the administrator connects a bot created in @BotFather.
- Backup codes — ten one-time codes for when the phone is lost. They are created automatically when the first method is connected.
For site owners and agencies
- Require 2FA for chosen roles (off until you choose them). Until they set it up, those users can open nothing in the dashboard except their profile and the Two-Factor Login page.
- “Trust this device” for up to 90 days, configurable or off.
- A 2FA column in the users list and a one-click reset for a user who lost everything.
- Five wrong codes lock the login for 15 minutes.
- Password logins over XML-RPC are refused for users with 2FA (application passwords keep working).
- Emergency switch in wp-config.php if every administrator is locked out.
Privacy and security
- App secrets and the bot token are encrypted in the database with a key from wp-config.php, so a database dump alone does not reveal them.
- Backup codes are stored as password hashes; Telegram codes and login tickets as keyed hashes.
- Nothing is logged in until the second factor is passed: WordPress’s auth cookie is not even sent after the password step.
- No tracking, no ads, no calls home. The only external service is Telegram, and only if you connect a bot.
org.
Telegram is a trademark of its owner. This plugin is an independent project and is not affiliated with or endorsed by Telegram.
External services
org), operated by Telegram, to deliver login codes. It is off until an administrator enters a bot token on Settings → Two-Factor.
org from the server:
- when the administrator saves a bot token: the token, to check it ( getMe );
- when a user connects Telegram on their Two-Factor Login page: the bot token, to read messages sent to the bot ( getUpdates ), and a confirmation message to the user’s chat;
- each time a user who chose Telegram logs in: the user’s Telegram chat ID and a message with the one-time code and the site name ( sendMessage ).
No passwords, e-mail addresses or other personal data from the site are sent. org/privacy
Authenticator apps work entirely on the user’s phone and the site; no service is contacted.
Third-party code
- QR Code Generator for JavaScript by Kazuhiko Arase, MIT license — assets/js/vendor/qrcode.js, https://github.com/kazuhikoarase/qrcode-generator