by David Anderson / Team Updraft 4.4 (77 reviews)

Two Factor Authentication

Name: Two Factor Authentication
Rating: 4.4 (77 reviews)
Author: David Anderson / Team Updraft

Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (Google Authenticator, Authy, etc.)

Two Factor Authentication ranks #1,329 among WordPress.org plugins with 20,000+ active installations, is #55 of 1,578 in the Authentication category, a 4.4/5 rating from 77 reviews, and was last updated Aug 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.16.0 Current Version v1.16.0

Updated 1 month ago Last Update on 13 Aug, 2026

Refreshed 14 hours ago Last Refreshed on

#55 of 1,578 in Authentication Top 5% by installs

View on WordPress.org

Rank

#1,329

— No change

Active Installs

20K+

-14.4%

KW Avg Position

— No change

Downloads

880.6K

+2 today

Support Resolved

— No change

Rating

88%

Review 4.4 out of 5

4.4 (77 reviews)

Next Milestone 30K

Total Progress 34.4%

20K+ 30K+

235

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 6,565 more installs to reach 30K+

Rank Changes

Current #1,329

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

4.4

77 reviews

Overall 88%

62 (81%)

2 (3%)

3 (4%)

1 (1%)

9 (12%)

Security History

Source: WPVulnerability

2 known vulnerabilities on record · 0 in the last 24 months · checked 1 week ago

Dec 18, 2018

Two Factor Authentication [two-factor-authentication] < 1.3.13

CVE-2018-20231 · Fixed in v1.3.13
Apr 20, 2015

Two Factor Authentication [two-factor-authentication] < 1.1.10

CVE-2015-9355 · Fixed in v1.1.10

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.16.0
Last Updated: Aug 13, 2026
Requires WP: 3.4+
Tested Up To: 7.1
PHP Version: 5.6 or higher
Author: David Anderson / Team Updraft

Support & Rating

Rating: ★ ★ ★ ★ ☆ 4.4
Reviews: 77
Support Threads: 0
Resolved: 0%

Keywords

2FA TFA google authenticator two factor two factor auth

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,751

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,006

WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security - Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

1M+ installs

#62

MainWP Child - Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners and administrators who want to add two-factor authentication to their login forms. It solves the problem of password-only logins being vulnerable to compromise by requiring a one-time code via TOTP or HOTP alongside the password.

Supports TOTP and HOTP protocols
Displays graphical QR codes
Per-role TFA availability
Front-end settings via shortcode
Encrypts TFA secret keys
WooCommerce login form support
Works with Theme My Login
WP Multisite compatible

Frequently Asked Questions

Common questions about Two Factor Authentication

Basically, it's to do with securing your logins, so that there's more than one link in the chain needing to be broken before an unwanted intruder can get in your website. By default, your WordPress accounts are protected by only one thing: your password. If that's broken, then everything's wide open. "Two factor" means adding a second requirement. Usually, this is a code that comes to a device you own (e.g. phone, tablet) - so, someone can't get into your website without getting hold of your device. You can get a longer answer from Wikipedia. Sometimes it is also called multi-factor authentication instead of two-factor - because someone could secure their systems with as many factors as they like.

Read this: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

Since "two factor authentication" just means "a second something is necessary to get in", this answer depends upon the particular set-up. In the most common case, a numeric code is shown on your phone, tablet or other device. This code be sent via an SMS; this then depends on the mobile phone network working. This plugin does not uses that method. Instead, it uses a standard mathematical algorithm to generate codes that are only valid once each, or for only for 30 seconds (depending on which algorithm you choose). Your phone or tablet can know the code after it has been set up once (often, by just scanning a bar-code off the screen).

This depends on your particular make of phone, and your preferences. Google have produced a popular app called "Google Authenticator", which is a preferred option for many people because it is easy to use and can be set up via just scanning a bar code off your screen - follow this link, and ignore the first paragraph that is talking about 2FA on your Google account (rather than being relevant to this plugin).

Many and various devices and programs can generate the codes. One option is an add-on for your web browser; for example, here are some apps and add-ons for Google Chrome. Wikipedia lists various programs for different computers.

If your pass-code used to work, but no longer does, then check that the time on your device that generates them is accurate. If you cannot get in and need to disable two-factor authentication, then add this to your wp-config.php file, using FTP or the file manager in your hosting control panel: define('TWO_FACTOR_DISABLE', true); Add it next to where any other line beginning with "define" is. Alternatively, if you have FTP or cPanel access to your web hosting space, you can de-activate the plugin; see this article.

If someone has access to your email account, then they can send a password-reset code there using the password-reset mechanisms built into WordPress. Therefore, if the two-factor code was also sent there, then ability to read your email allows the breaking of both factors, and hence is no longer truly two factor authentication. Some users might have two factor authentication on their email account, but this is not knowable or controllable from inside WordPress, and so giving this option to users means that the administrator cannot see or enforce two-factor authentication. And even in this case, email is often sent between servers unencrypted, and so is susceptible to man-in-the-middle attacks beyond the control of WordPress.

These are the names of the two mathematical algorithms that are used to create the special codes. These are industry-standard algorithms, devised by expert cryptographers. HOTP is less popular, but the device that generates the codes does not need to know the correct time (instead, the codes are generated in a precise sequence). TOTP is much more popular, and generates codes that are only valid for 30 seconds (and so your device needs to know the time). I'd recommend TOTP, as HOTP can be annoying if something causes the sequences to get out of sync.

[twofactor_user_settings] I deliberately entered a wrong password, and it let me login! You have a password manager extension installed in your web browser, with the correct password entered in it. It has automatically replaced your wrong password with the right one from its saved store. This behaviour has been observed and confirmed by several users. You can verify it by using the web developer tools in your browser to look at the HTTP data sent to WordPress, and observe which password is actually in it. You can also open a fresh web browser with no such extension in it to re-test. Note that the two factor authentication plugin has no mechanism to compare or approve passwords; this is done by WordPress core. If the wrong password is sent, then this is handled by WordPress, and the login will not proceed.