Descripción
This plugin adds a second authentication factor for the user roles you choose. After a correct username and password, an extra code is required — the site admin picks the method:
- Email — a one-time numeric code sent to the user’s email address.
- Authenticator app (TOTP) — a standard 6-digit code from an app such as Google Authenticator, Authy, or Microsoft Authenticator (this plugin is not affiliated with or endorsed by Google). Each user connects the app in their own profile: scan the QR code or enter the secret key manually.
If the site uses TOTP but a specific user hasn’t connected the app yet, they temporarily get an email code at login instead — so nobody gets locked out.
Features:
- Enable 2FA per user role
- Two verification methods: email code or authenticator app (TOTP)
- Configurable email code length, lifetime, and attempt limit
- Admin screens and email codes follow each user’s own WordPress language setting (Users Profile Language) — no site-wide language switch needed
- Email codes are stored only as a hash; the TOTP secret is stored encrypted (AES-256-CBC)
- The QR code is generated entirely in the browser — the secret is never sent to a third-party service
Credits
The QR code on the authenticator app setup screen is rendered client-side using QRCode.js by davidshimjs (MIT license). This plugin bundles the minified build; the unminified source is available at https://github.com/davidshimjs/qrcodejs
Donate
If you find this plugin useful, please consider supporting its development.
https://buymeacoffee.com/rad181
Capturas
Instalación
- Upload the plugin folder to
/wp-content/plugins/ - Activate the plugin from the Plugins screen
- Go to the Rad 2FA menu item, choose the roles and the verification method
- If the authenticator app method is selected, each user sets it up in their own profile (Users Your Profile)
FAQ
-
What if a user doesn’t receive the code email?
-
Check the site’s outgoing mail (SMTP) setup. The plugin uses WordPress’s standard
wp_mail()function. -
Can I enable 2FA for specific roles only, not everyone?
-
Yes — in the plugin settings, tick the roles that require 2FA.
-
What happens if the authenticator app method is enabled but a user hasn’t set it up yet?
-
That user temporarily gets the code by email instead — it doesn’t block login.
-
Can an administrator set up the authenticator app for another user?
-
No — for security, the secret is tied to one person and can only be set up by that person in their own profile.
-
Does this protect Application Passwords / the REST API too?
-
No. 2FA applies to the login form (wp-login.php). WordPress Application Passwords authenticate REST API requests through a separate mechanism that doesn’t go through the login form, so they aren’t covered. If this matters for your site, disable Application Passwords for accounts that require 2FA.
-
Is this plugin affiliated with Google?
-
No. «Google Authenticator» is mentioned only as an example of a compatible authenticator app; this plugin implements the standard, open TOTP algorithm (RFC 6238) and works with any compatible app.
Reseñas
No hay valoraciones para este plugin.
Colaboradores y desarrolladores
«Rad 2FA — Two-Factor Login (Email & Authenticator App)» es un software de código abierto. Las siguientes personas han colaborado con este plugin.
Colaboradores
Traduce «Rad 2FA — Two-Factor Login (Email & Authenticator App)» a tu idioma.
¿Interesado en el desarrollo?
Revisa el código , echa un vistazo al repositorio SVN o suscríbete al registro de desarrollo por RSS.
Registro de cambios
1.2.1
- Added a Plugin URI header linking to the wordpress.org plugin page
1.2.0
- Renamed to Rad 2FA (was OTP Sentinel)
- Removed the plugin-specific language toggle; admin screens and OTP emails now follow each user’s own WordPress language setting (Users Profile Language)
- Inline admin scripts moved to properly enqueued files
1.1.1
- TOTP codes can no longer be reused across login attempts
- Encrypted TOTP secrets are now integrity-checked (HMAC)
- Rate-limited login challenge issuance to reduce email/brute-force abuse
- Fixed a redirect_to double-encoding bug affecting post-login redirects
- Added uninstall.php to remove plugin data on deletion
- Activation now checks for the required OpenSSL extension
1.1.0
- Added authenticator app (TOTP) support as an alternative to the email code
- Settings moved to their own top-level menu item
1.0.0
- Initial release