by Web Guy
0 (0 reviews)
Tiny 2FA + Brute Force Protection
A simple two-factor authentication plugin that just works.
Tested up to WP 6.8.5 (Current: 6.9.4)
v0.3
Current Version v0.3
Updated 2 months ago
Last Update on 23 Jan, 2026
Refreshed 6 hours ago
Last Refreshed on
Rank
#28,948
—
No change
Active Installs
10+
-47.4%
KW Avg Position
33
—
No change
Downloads
349
+2 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 20
10+
20+
4,088
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 3 more installs to reach 20+
Rank Changes
Current
#28,948
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Tracked Keywords
Showing 2 of 2Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 0.3
- Last Updated
- Jan 23, 2026
- Requires WP
- 5.0+
- Tested Up To
- 6.8.5
- PHP Version
- 7.4 or higher
- Author
- Web Guy
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer
7K+ installs
#2,715
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
30K+ installs
#953
InfiniteWP Client
200K+ installs
#253
Nextend Social Login and Register
200K+ installs
#256
Anti-Malware Security and Brute-Force Firewall
100K+ installs
#298
Frequently Asked Questions
Common questions about Tiny 2FA + Brute Force Protection
Only TOTP at this time. This is the most common 2FA method, the one you're probably most familiar with already. It's more secure than 2FA via SMS or email, but not as secure as a hardware key (overkill for most people), which is probably the only other option I'd consider adding.
There are many mobile, desktop, and browser apps that support TOTP, including: Google Authenticator, Microsoft Authenticator, Proton Authenticator, Ente Auth, Authy, Bitwarden, LastPass, and 1Password.
Simply regenerate (↻) in your profile settings to get a new key.
Yes. For extra security, you can define your encryption key in wp-config.php: define( 'TINY_2FA_ENCRYPTION_KEY', 'your-64-character-hex-key-here' ); You can find your current key in /wp-content/tiny-2fa-backup.php. This ensures your key survives database issues if somehow it's lost.
Other than storing secret keys in an encrypted format (apparently most sites just save them in plaintext), it's a pretty standard implementation (but having any 2FA in place is infinitely more secure than no 2FA at all).
As it turns out, generating QR codes is not a trivial matter. I explored generating them locally, but it added a lot of bloat to the plugin. So, I've opted to use an external service instead. I'm using QuickChart (rather than Google, a popular choice) to generate QR codes, and for extra privacy, proxying the requests through Cloudflare. QuickChart will only ever know the secret key, but not the site name, username, or IP address it belongs to. Cloudflare will know the server IP the request is coming from, but still not the name of the website or user.
The way I've envisioned Backup Codes is simple: immediately upon enabling 2FA, Backup Codes will be on by default. This means that you'll receive codes by email until you're certain you've set up an authentication app correctly, and then you should disable them.
I don't like the current implementation of the common Backup Codes feature that comes with most 2FAs. I think it creates a burden for the user to back them up, which if they're capable of doing, they're also capable of backing up their secret key in the first place without adding an unnecessary chore and new vulnerability while they're at it. I think I've been able to improve upon the concept of Backup Codes, at least in the WordPress environment where most users are going to be the admin of their own website anyway. The entire point of Backup Codes in the first place is to offer a second chance to avoid being locked out of your account in case you lost your secret key. But for most WordPress websites, and probably many websites in general these days, the added vulnerability doesn't seem to match the intended usefulness. I'm open to being wrong about this. If you feel my thinking is flawed or you have any other suggestion for improving the security of Tiny 2FA, please let me know.