WordPress.org

Français

Obtenir WordPress
WordPress.org

Plugin Directory

Two Factor

Two Factor

Par WordPress.org
Télécharger
Prévisualisation en direct

Description

The Two-Factor plugin adds an extra layer of security to your WordPress login by requiring users to provide a second form of authentication in addition to their password. This helps protect against unauthorized access even if passwords are compromised.

Setup Instructions

Important: Each user must individually configure their two-factor authentication settings.

For Individual Users

  1. Navigate to your profile: Go to « Users » « Your Profile » in the WordPress admin
  2. Find Two-Factor Options: Scroll down to the « Two-Factor Options » section
  3. Choose your methods: Enable one or more authentication providers (noting a site admin may have hidden one or more so what is available could vary):
    • Authenticator App (TOTP) – Use apps like Google Authenticator, Authy, or 1Password
    • Email Codes – Receive one-time codes via email
    • Backup Codes – Generate one-time backup codes for emergencies
    • Dummy Method – For testing purposes only (requires WP_DEBUG)
  4. Configure each method: Follow the setup instructions for each enabled provider
  5. Set primary method: Choose which method to use as your default authentication
  6. Save changes: Click « Update Profile » to save your settings

For Site Administrators

  • Plugin settings: The plugin provides a settings page under « Settings Two-Factor » to configure which providers should be disabled site-wide.
  • User management: Administrators can configure 2FA for other users by editing their profiles
  • Security recommendations: Encourage users to enable backup methods to prevent account lockouts

Available Authentication Methods

Authenticator App (TOTP) – Recommended

  • Security: High – Time-based one-time passwords
  • Setup: Scan QR code with authenticator app
  • Compatibility: Works with Google Authenticator, Authy, 1Password, and other TOTP apps
  • Best for: Most users, provides excellent security with good usability

Backup Codes – Recommended

  • Security: Medium – One-time use codes
  • Setup: Generate 10 backup codes for emergency access
  • Compatibility: Works everywhere, no special hardware needed
  • Best for: Emergency access when other methods are unavailable

Email Codes

  • Security: Medium – One-time codes sent via email
  • Setup: Automatic – uses your WordPress email address
  • Compatibility: Works with any email-capable device
  • Best for: Users who prefer email-based authentication

FIDO U2F Security Keys

  • Deprecated and removed due to loss of browser support.

Dummy Method

  • Security: None – Always succeeds
  • Setup: Only available when WP_DEBUG is enabled
  • Purpose: Testing and development only
  • Best for: Developers testing the plugin

Important Notes

HTTPS Requirement

  • All methods work on both HTTP and HTTPS sites

Browser Compatibility

  • TOTP and email methods work on all devices and browsers

Account Recovery

  • Always enable backup codes to prevent being locked out of your account
  • If you lose access to all authentication methods, contact your site administrator

Security Best Practices

  • Use multiple authentication methods when possible