WordPress login protection with flexible TFA controls
Two Factor Authentication Premium adds an extra authentication step for WordPress users who have TFA enabled. Users enter a one-time code after their password, helping site owners apply stronger login controls across selected roles, user levels, and supported login forms.
The plugin supports standard TOTP and HOTP protocols, including authenticator applications such as Google Authenticator and Authy. Graphical QR codes make it easier for users to scan setup details into an app on a phone or tablet.
Premium features for administrators and users
- Make TFA available on a per-role basis, such as enabling it for administrators but not subscribers.
- Allow individual users to turn TFA on or off where the site policy permits it.
- Require TFA for specified user levels after a defined period, including immediately forcing setup by redirecting users to the setup page.
- Allow trusted devices so users can avoid entering a TFA code on every login for a chosen number of days.
- Provide emergency codes for situations where a user loses access to a phone or tablet.
- Let administrators access other users’ codes and turn TFA on or off when needed.
- Require the current TFA code before a user can activate TFA through the front-end settings form.
Premium also supports custom designing of layouts used with the [twofactor_user_settings] shortcode. This lets users manage settings from the front end without needing access to the WordPress dashboard. TFA prompts are not shown until the user has been identified as someone with TFA enabled, so users without TFA do not see an unnecessary second-factor request.
Compatibility across login environments
The plugin works with Theme My Login forms and widgets, WooCommerce and Affiliates-WP login forms, Ultimate Membership Pro, and CozmosLabs Profile Builder. Premium adds support for login forms from Ultimate Member, Elementor Pro, bbPress, Easy Digital Downloads, RegistrationMagic, the Gravity Forms User Registration add-on, and shortcode forms from Paid Memberships Pro.
Premium can also work with third-party login forms without additional coding by allowing the TFA code to be appended to the end of the password. WP Multisite is supported when the plugin is network activated. Additional security checks can alert users when a password appears to have been discovered, indicated by successful password entry followed by repeated incorrect TFA codes. TFA-generating secret keys can be encrypted with an on-disk encryption key.
Practical setup workflow
Install and activate the plugin, then choose which roles or user levels should use TFA. Users can scan the displayed QR code into a compatible authenticator app and manage their settings through the dashboard or the front-end shortcode. Site owners can then configure trusted-device periods, setup requirements, emergency codes, and supported login-form behavior according to the site’s needs.
