by
dollarmates
1 (0 reviews)
DollarMates U2 Secured Authenticator
Tap-to-approve two-factor authentication for WordPress logins, backed by the U2 Secured Authenticator app.
DollarMates U2 Secured Authenticator ranks #56,146 among WordPress.org plugins with 1+ active installations, is #1,095 of 1,643 in the Authentication category, a 1/5 rating from 0 reviews, and was last updated Oct 8, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v0.3.1
Current Version v0.3.1
Updated 2 weeks ago
Last Update on 08 Oct, 2026
Refreshed 7 hours ago
Last Refreshed on
#1,095 of 1,643 in Authentication
Downloads -72.6% this week
Actively maintained
Rank
#56,146
—
No change
Active Installs
1+
-3%
KW Avg Position
111
2 worse
Downloads
150
+6 today
Support Resolved
0%
—
No change
Rating
20%
Review 1 out of 5
1
(0 reviews)
Next Milestone 10
0+
10+
43,209
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 7 more installs to reach 10+
Rank Changes
Current
#56,146
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
1.0
0 reviews
Overall
20%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 0.3.1
- Last Updated
- Oct 08, 2026
- Requires WP
- 6.0+
- Tested Up To
- 7.1
- PHP Version
- 7.4 or higher
- Author
- dollarmates
Support & Rating
- Rating
- ★ ☆ ☆ ☆ ☆ 1
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,764
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,016
WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More
5M+ installs
#9
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#34
Loginizer
1M+ installs
#46
Maintenance
1M+ installs
#58
All-In-One Security (AIOS) – Security and Firewall
1M+ installs
#59
MainWP Child - Securely Connects to the MainWP Dashboard to Manage Multiple Sites
700K+ installs
#86
Frequently Asked Questions
Common questions about DollarMates U2 Secured Authenticator
They fall back to a recovery code (issued, ten at a time, when they first linked, and shown again any time they choose to regenerate them from their profile) or a TOTP code from a backup authenticator app, if one was set up. If they've lost the phone and exhausted their recovery codes, an administrator runs wp u2auth disable <user> over SSH — see "The escape hatch" above. This is a local, offline operation: it works even if the U2 API itself is unreachable.
No. A user in a newly-enforced role gets the configured grace period (default seven days) to link before they're blocked — they're nagged on their profile screen, not refused at login, until that window closes.
The plugin fails closed, and there is no setting that changes that — opting out is not offered. In practice that is less dramatic than it sounds. An already-linked user cannot use the push challenge while U2 is unreachable, but can still sign in with a recovery code or a TOTP code: both are verified against this site's own data with no outbound call at all. The login is still gated, just via a different factor. If the phone is gone and the codes are exhausted, wp u2auth disable <user> over SSH is the escape hatch, and it makes no network call either.
failed. See "Fail-closed means a misconfiguration blocks logins" under Verification status in README.md for what that means for your own rollout.
Users who require a second factor are refused, with a message telling them to ask an administrator to check the key. They are not let in. This is worth stating plainly because the alternative is the more tempting behaviour and it is a two-factor bypass: wp_login fires after WordPress has already set the auth cookie, so a plugin that merely declines to challenge when it is unconfigured has thereby completed the login. Up to and including 0.2.2 this plugin did exactly that, and deleting the API key silently switched two-factor off for every user who had it. Fixed in 0.3.0. A site with the plugin installed and nobody enrolled is unaffected: it behaves exactly as WordPress
send one".
Five wrong codes for one user inside fifteen minutes, and the TOTP factor refuses that user until the window passes. Recovery codes are checked before the limit applies, so a user who fumbled their authenticator app still has their codes — the limit is a brake, never a lockout, and it clears itself. Each guess also costs a full password sign-in, because the challenge is single-use: a failed code invalidates the attempt and the attacker has to authenticate the password again to get another.
No. It's an optimisation, never a requirement. When a user taps Approve, U2 Secured can POST that outcome to this site immediately; the login screen then answers from local state instead of asking U2 Secured again. Without it the login screen simply asks — which is what it does anyway while it waits. Every login flow, fallback and failure mode is identical either way. Set it up only if this site is reachable from the public internet. If it isn't, deliveries would never arrive and nothing would tell you so, which is worse than not configuring it. The URL to paste into the developer portal is printed on Settings → U2 Secured, under Getting started — take it from there rather than typing it out, since it follows your site address and your permalink structure, and that screen already resolves which of the two forms your site actually uses.
It's rejected. Every delivery carries an HMAC signature over the exact bytes sent, computed with the shared secret from U2AUTH_WEBHOOK_SECRET (or the settings screen), and is verified before a single field of the payload is read. A wrong signature, a signature computed over different bytes, a stale timestamp, or a malformed header are all refused and change nothing. If no secret is configured at all, every delivery is refused — "not configured" is never treated as "accept anything". A rejected webhook can't strand a login either: the browser's own poll resolves the approval regardless.
XML-RPC authenticates with the raw password and never reaches the hook this plugin challenges on, so the plugin closes it off outright rather than leaving a second, unguarded front door. Application Passwords are a legitimate WordPress feature with their own use cases, so instead of being blocked they're surfaced as an admin notice — decide for your site whether to disable them separately.
