by WordPress.org 4.7 (209 reviews)

Two Factor

Name: Two Factor
Rating: 4.7 (209 reviews)
Author: WordPress.org

Enable Two-Factor Authentication (2FA) using time-based one-time passwords (TOTP), email, and backup verification codes.

Two Factor ranks #312 among WordPress.org plugins with 100,000+ active installations, is #18 of 1,659 in the Authentication category, a 4.7/5 rating from 209 reviews, and was last updated Sep 28, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v0.17.0 Current Version v0.17.0

Updated 1 month ago Last Update on 28 Sep, 2026

Refreshed 18 hours ago Last Refreshed on

#18 of 1,659 in Authentication Top 1% by installs Downloads -24.3% this week

View on WordPress.org

Rank

#312

— No change

Active Installs

100K+

-40.1%

KW Avg Position

20.8

0.2 worse

Downloads

+653 today

Support Resolved

67%

— No change

Rating

94%

Review 4.7 out of 5

4.7 (209 reviews)

Next Milestone 200K

Total Progress 83.4%

100K+ 200K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 16,575 more installs to reach 200K+

Rank Changes

Current #312

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.7

209 reviews

Overall 94%

184 (88%)

15 (7%)

0 (0%)

2 (1%)

8 (4%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

67%

Resolution Rate

Security History

Source: WPVulnerability

1 known vulnerability on record · 1 in the last 24 months · checked 1 week ago

Sep 30, 2026

Two Factor [two-factor] < 0.17.0

CVE-2026-100508 · Fixed in v0.17.0

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 0.17.0
Last Updated: Sep 28, 2026
Requires WP: 7.0+
Tested Up To: 7.1.4
PHP Version: 7.4 or higher
Author: WordPress.org

Support & Rating

Rating: ★ ★ ★ ★ ★ 4.7
Reviews: 209
Support Threads: 6
Resolved: 67%

Keywords

2FA authentication MFA security totp

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

Two Factor is for WordPress site owners and users who want stronger login security than a password alone. It solves the problem of accounts being compromised by requiring a second authentication step, such as a TOTP app, email code, or backup code.

TOTP authenticator app support
Email verification codes
Backup verification codes
Per-user 2FA configuration
Admin settings to disable providers site-wide
Dummy method for testing
Action and filter hooks
Compatible with login_redirect filter

Frequently Asked Questions

Common questions about Two Factor

This plugin supports the last two major versions of WordPress and the minimum PHP version supported by those WordPress versions.

The best place to report bugs, feature suggestions, or any other (non-security) feedback is at the Two Factor GitHub issues page. Before submitting a new issue, please search the existing issues to check if someone else has reported the same feedback.

The plugin contributors and WordPress community take security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions. To report a security issue, please visit the WordPress HackerOne program.

If you have backup codes enabled, you can use one of those to regain access. If you don't have backup codes or have used them all, you'll need to contact your site administrator to reset your account. This is why it's important to always enable backup codes and keep them in a secure location.

The plugin previously supported FIDO U2F, which was a predecessor to WebAuthn. There is an open issue to add WebAuthn support here.

Yes. For passkeys and hardware security keys, you can install the Two-Factor Provider: WebAuthn plugin. It integrates directly with Two-Factor and adds WebAuthn-based authentication as an additional two-factor option for users.

Yes. The Two-Factor plugin is compatible with WordPress Multisite. Each user configures their own 2FA settings via their profile, and because authentication codes are stored in WordPress user meta, the configuration is tied to the user account and valid across all sites in the network. However, there are no network-wide settings — a super admin cannot enforce or configure 2FA globally from the Network Admin dashboard. To manage 2FA for a specific user, edit their profile on any site where they have an account.

As an administrator, go to Users → All Users in the WordPress admin, click Edit on the affected user's profile, scroll down to the Two-Factor Options section, and uncheck all enabled methods, then click Update User. This will remove 2FA for that user, allowing them to log in with their password alone. You can also do this via WP-CLI with wp two-factor disable --yes, which performs a full reset (see the WP-CLI Commands section above). Once they're back in, encourage them to re-enable 2FA and generate fresh backup codes.

Not through the plugin's interface — there are no built-in enforcement settings. However, developers can use the two_factor_providers_for_user filter to control which providers are available per user or role, and combine it with custom logic to redirect users who haven't set up 2FA. Native enforcement support is a known and tracked feature request — follow the discussion at GitHub issue #255.