by David Anderson, original plugin by Oskar Hane and enhanced by Dee Nutbourne
4.4 (77 reviews)
Two Factor Authentication
Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (Google Authenticator, Authy, etc.)
Compatible with WP 6.9
v1.16.0
Current Version v1.16.0
Updated 1 month ago
Last Update on 09 Dec, 2025
Synced 11 hours ago
Last Synced on
Rank
#1,347
+4 this week
Active Installs
20K+
—
No change
KW Avg Position
24.6
—
No change
Downloads
872.7K
+113 today
Support Resolved
0%
—
No change
Rating
88%
Review 4.4 out of 5
4.4
(77 reviews)
Next Milestone 30K
20K+
30K+
210
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 5,802 more installs to reach 30K+
Rank Changes
Current
#1,347
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
4.4
77 reviews
Overall
88%
5
62
(81%)
4
2
(3%)
3
3
(4%)
2
1
(1%)
1
9
(12%)
Tracked Keywords
Showing 5 of 5| Keyword | Position | Change | Type | Updated |
|---|---|---|---|---|
| TFA | 1 | — | Tag | 12 hours ago |
| two factor auth | 9 | — | Tag | 12 hours ago |
| google authenticator | 17 | — | Tag | 12 hours ago |
| two factor | 43 | — | Tag | 12 hours ago |
| 2FA | 53 | — | Tag | 12 hours ago |
Unlock Keyword Analytics
Track keyword rankings, search positions, and discover new ranking opportunities with a Pro subscription.
- Full keyword position tracking
- Historical ranking data
- Competitor keyword analysis
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.16.0
- Last Updated
- Dec 09, 2025
- Requires WP
- 3.4+
- Tested Up To
- 6.9
- PHP Version
- 5.6 or higher
Support & Rating
- Rating
- ★ ★ ★ ★ ☆ 4.4
- Reviews
- 77
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer
7K+ installs
#2,736
Master Addons For Elementor - White Label, Free Widgets, Hover Effects, Conditions, & Animations
40K+ installs
#929
Anti-Malware Security and Brute-Force Firewall
100K+ installs
#295
WPS Limit Login
100K+ installs
#309
reCaptcha by BestWebSoft
100K+ installs
#316
Frequently Asked Questions
Common questions about Two Factor Authentication
Basically, it's to do with securing your logins, so that there's more than one link in the chain needing to be broken before an unwanted intruder can get in your website. By default, your WordPress accounts are protected by only one thing: your password. If that's broken, then everything's wide open. "Two factor" means adding a second requirement. Usually, this is a code that comes to a device you own (e.g. phone, tablet) - so, someone can't get into your website without getting hold of your device. You can get a longer answer from Wikipedia. Sometimes it is also called multi-factor authentication instead of two-factor - because someone could secure their systems with as many factors as they like.
Read this: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/
Since "two factor authentication" just means "a second something is necessary to get in", this answer depends upon the particular set-up. In the most common case, a numeric code is shown on your phone, tablet or other device. This code be sent via an SMS; this then depends on the mobile phone network working. This plugin does not uses that method. Instead, it uses a standard mathematical algorithm to generate codes that are only valid once each, or for only for 30 seconds (depending on which algorithm you choose). Your phone or tablet can know the code after it has been set up once (often, by just scanning a bar-code off the screen).
This depends on your particular make of phone, and your preferences. Google have produced a popular app called "Google Authenticator", which is a preferred option for many people because it is easy to use and can be set up via just scanning a bar code off your screen - follow this link, and ignore the first paragraph that is talking about 2FA on your Google account (rather than being relevant to this plugin).
Many and various devices and programs can generate the codes. One option is an add-on for your web browser; for example, here are some apps and add-ons for Google Chrome. Wikipedia lists various programs for different computers.
If your pass-code used to work, but no longer does, then check that the time on your device that generates them is accurate. If you cannot get in and need to disable two-factor authentication, then add this to your wp-config.php file, using FTP or the file manager in your hosting control panel: define('TWO_FACTOR_DISABLE', true); Add it next to where any other line beginning with "define" is. Alternatively, if you have FTP or cPanel access to your web hosting space, you can de-activate the plugin; see this article.
If someone has access to your email account, then they can send a password-reset code there using the password-reset mechanisms built into WordPress. Therefore, if the two-factor code was also sent there, then ability to read your email allows the breaking of both factors, and hence is no longer truly two factor authentication. Some users might have two factor authentication on their email account, but this is not knowable or controllable from inside WordPress, and so giving this option to users means that the administrator cannot see or enforce two-factor authentication. And even in this case, email is often sent between servers unencrypted, and so is susceptible to man-in-the-middle attacks beyond the control of WordPress.
These are the names of the two mathematical algorithms that are used to create the special codes. These are industry-standard algorithms, devised by expert cryptographers. HOTP is less popular, but the device that generates the codes does not need to know the correct time (instead, the codes are generated in a precise sequence). TOTP is much more popular, and generates codes that are only valid for 30 seconds (and so your device needs to know the time). I'd recommend TOTP, as HOTP can be annoying if something causes the sequences to get out of sync.
[twofactor_user_settings] I deliberately entered a wrong password, and it let me login! You have a password manager extension installed in your web browser, with the correct password entered in it. It has automatically replaced your wrong password with the right one from its saved store. This behaviour has been observed and confirmed by several users. You can verify it by using the web developer tools in your browser to look at the HTTP data sent to WordPress, and observe which password is actually in it. You can also open a fresh web browser with no such extension in it to re-test. Note that the two factor authentication plugin has no mechanism to compare or approve passwords; this is done by WordPress core. If the wrong password is sent, then this is handled by WordPress, and the login will not proceed.