by Super Duper Plugins 0 (0 reviews)

Super Duper Two-Factor Login

Name: Super Duper Two-Factor Login
Author: Super Duper Plugins

Free 2FA for WordPress: authenticator app, email codes, backup codes, WooCommerce, role enforcement, plus optional server and upload hardening.

Super Duper Two-Factor Login ranks #25,883 among WordPress.org plugins with 20+ active installations, is #596 of 1,659 in the Authentication category, and was last updated Sep 10, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v2.6.5 Current Version v2.6.5

Updated 1 month ago Last Update on 10 Sep, 2026

Refreshed 1 week ago Last Refreshed on

#596 of 1,659 in Authentication Top 50% by installs

View on WordPress.org

Rank

#25,883

— No change

Active Installs

20+

— No change

KW Avg Position

105.3

— No change

Downloads

1.1K

+8 today

Support Resolved

— No change

Rating

Review 0 out of 5

0 (0 reviews)

Next Milestone 30

Total Progress 80%

20+ 30+

3,138

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 2 more installs to reach 30+

Rank Changes

Current #25,883

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

0.0

0 reviews

Overall 0%

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

Resolution Rate

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.6.5
Last Updated: Sep 10, 2026
Requires WP: 6.8+
Tested Up To: 7.1.4
PHP Version: 8.2 or higher
Author: Super Duper Plugins

Support & Rating

Rating: ☆ ☆ ☆ ☆ ☆ 0
Reviews: 0
Support Threads: 1
Resolved: 0%

Keywords

2FA Authenticator security two factor woocommerce

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Super Duper Two-Factor Login

Any TOTP-compatible app works, including Google Authenticator, FreeOTP+, Authy, Microsoft Authenticator, and many others. We recommend FreeOTP+ (Android) and FreeOTP (iOS) as free, open-source options.

Technically yes – any password manager with TOTP support accepts the manual key shown underneath the QR code. We advise against it. Two-factor authentication only works because the two factors live in different places. If your password and your one-time codes sit in the same vault, a single compromised vault hands an attacker both factors at once, and you are back to single-factor security. Keep the second factor on a separate device; a free authenticator app on your phone is enough.

You can log in using one of your 10 backup codes. If those are also gone, administrators can use their personal recovery key on the login page. As a last resort there is the FTP emergency file, but it has to be switched on beforehand under Emergency access – see the question about it further down.

Yes. Go to Two-Factor Login settings and select which roles must use 2FA. You can set a grace period with a deadline, or enforce it immediately – users will then be required to complete 2FA setup on the login page before gaining any access.

Yes. It adds a "Two-Factor Authentication" tab to the WooCommerce My Account page. You can also enforce 2FA for the WooCommerce account area and checkout.

No. Everything runs locally. QR codes are rendered in your own browser by a small bundled script, TOTP calculations happen on the server, and app store badges use local SVG files. No external images, scripts, or API calls are made. The one HTTP request the plugin can make goes to your own website: the optional live test in the hardening section requests a probe file from your own uploads folder to check whether the server executes it. It only runs when you click the button, and no third party is involved.

Most break-ins that start with a file upload only become dangerous at the moment the server executes that file. The uploads folder is meant for images and documents – there is never a legitimate reason to run PHP in there. The plugin writes a rule block into wp-content/uploads/.htaccess (and the same for wp-content/upgrade/) that tells the server to refuse PHP and other scripts in that directory. Existing content in those files is preserved; the plugin only manages its own clearly marked block.

Two common causes. On nginx, .htaccess files are ignored entirely – open the "Rules for nginx" box below the test and add those lines to your server configuration (or ask your host to). On Apache, the directives may be disabled by AllowOverride; your host can enable them or add the rules to the server configuration for you. In both cases the other options in this section (upload filter, XML-RPC blocking, file editor, plugin installation) still work, because they do not depend on .htaccess.

It blocks executable server-side scripts – PHP, Perl, Python, shell scripts, ASP, JSP and similar – plus files whose name starts with a dot. Images, PDFs, videos, ZIP archives and office documents are unaffected. If your site genuinely needs to offer one of the blocked types as a download, a developer can adjust the list with the sdtfa_blocked_upload_extensions filter.

Only if you update your site another way. The option blocks every install, update and delete through the dashboard – including WordPress core updates, this plugin's own updates and automatic security updates. It is the right choice for sites deployed over FTP, Git or a pipeline, and the wrong choice for a site that relies on the update button. You can switch it off again in these settings at any time; you are never locked out of the setting itself.