About this plugin
Secure WordPress login with this two factor authentication (MFA / 2FA) plugin. Users for whom it is enabled will require a one-time code in order to log in.
Features
- Supports standard TOTP protocols (and so supports Google Authenticator, Authy, and many others).
- Displays graphical QR codes for easy scanning into apps on your phone/tablet
- MFA can be turned on or off by each user
- Supports front-end editing of settings, via shortcode (i.e. users don’t need access to the WP dashboard).
-
User login history
[si2flose_twofactor_user_settings]
-
Simplified user interface and code base for ease of use and performance
- Alert users if someone appears to have found out their password, as indicated by successfully entering a password but repeatedly entering an incorrect MFA code.
- When using the front-end shortcode, require the user to enter the current MFA code correctly to be able to activate MFA
How Does MFA / 2FA Work?
This plugin uses the industry standard MFA / 2FA algorithm TOTP for creating One Time Passwords. These are used by Google Authenticator, Authy, and many other OTP applications that you can deploy on your phone etc.
A TOTP code is valid for a certain time. e. ) will show a different code every so often.
Plugin Notes
This plugin began life in early 2025 as a friendly fork and enhancement of “wp mfa authentication” plugin.
3 or higher and support for either php-openssl or PHP mcrypt. The vast majority of PHP setups will have one of these. If not, ask your hosting company.
- Search for ‘SI 2FA Login Security’ in the ‘Plugins’ menu in WordPress.
- Click the ‘Install’ button. (Make sure you picks the right one)
- Activate the plugin through the ‘Plugins’ menu in WordPress
- Find site-wide settings in 2FA User Settings; find your own user settings in the top-level menu entry “2FA User Settings”.
If you want to add a section to the front-end of your site where users can configure their two-factor authentication settings, use this shortcode:
[si2flose_twofactor_user_settings]