WordPress TOTP, and nothing else
TOTP is the standard behind authenticator apps. When a user sets it up, they scan a QR code into their app once. From then on the app produces a new 6-digit code every 30 seconds without needing a network connection, and WordPress checks it after the password.
The plugin keeps to one method on purpose. There is no option to send codes by email and no passkey support, so if you need either of those, this plugin won't provide it.
Available as soon as the plugin is active. No role is required to use it until you choose.
Require 2FA for WordPress admins, by role
You pick which roles must use two-factor: administrators only, or editors, shop managers and others too. A user in a required role who hasn't set it up yet does so during sign-in, after the password and before any session exists. There is no grace period and no "remind me later", so a stolen password alone never opens a required account, not even once.
Editors, authors and other users who can't open the security console set up their codes on a plain page under Users, so they never need access to the plugin's screens.
No roles are required by default.
10 backup codes for each user
During set-up each user gets 10 one-time backup codes. Each one replaces an authenticator code once. They are meant to be printed or stored in a password manager, away from the phone they back up.
Guessing the code is slow
A six-digit code could in theory be guessed, so wrong answers are rationed. After 10 wrong codes the second step pauses for 15 minutes. Each further pause doubles, up to a full day. Combined with the password lockout described on the WordPress brute force protection page, guessing either factor becomes very slow.
On whenever 2FA is in use.
A WordPress 2FA plugin for multisite networks
Two-factor works across a WordPress multisite network, so one set of codes covers a user on every site they can sign in to.
When a phone is lost
A lost or wiped phone shouldn't cost anyone their account. In order of convenience:
- use one of the 10 backup codes;
- use one of the site's 8 recovery codes, generated in advance;
- request the single-use emergency link, emailed only to administrator addresses;
- with server access, run wp securegate recover over WP-CLI, or add WPSG_SAFE_MODE to wp-config.php, which lifts 2FA along with the other login locks.
Always available. Recovery codes work only after they have been generated.
An alert when an admin signs in from somewhere new
Two-factor stops a stolen password. It helps to know when someone tries one, too. When an administrator signs in from a network their account has never used before, WP SecureGate records it, and emails you once if you have switched email alerts on. The email shows the IP, location, network, device and browser, so you can tell at a glance whether it was you.
The rest of the sign-in protection, from lockouts to the ownership lock, is on the WordPress login security plugin page.
Detection is on by default. Email alerts are off until you switch them on.
Part of WP SecureGate: Login security →