Two Factor Authentication Premium adds a one-time code step to WordPress sign-in for visitors who have TFA enabled. The code prompt appears after the add-on identifies the account as TFA-enabled. The plugin supports standard TOTP and HOTP codes, which users generate in an authenticator app such as Google Authenticator or Authy. A graphical QR code helps them set up the app. Codes are not sent by email or SMS.

Set TFA policies and recovery options

Site owners can make TFA available to selected roles, such as administrators but not subscribers. Users can turn it on or off where the website policy allows. Premium can require TFA for specified visitor levels after a defined period, or redirect users to the setup page to require immediate setup.

• Allow trusted devices to skip code entry for a chosen number of days.
• Provide emergency codes for users who lose access to their phone or tablet.
• Let administrators access other users’ codes and turn TFA on or off when needed.
• Require the current TFA code before users activate TFA through the front-end options form.

Front-end settings and login forms

The [twofactor_user_settings] shortcode lets users manage their TFA settings without visiting the WordPress dashboard. Premium supports custom layouts for this settings area. Login-form integrations include Theme My Login forms and widgets, WooCommerce, Affiliates-WP, Ultimate Membership Pro, CozmosLabs Profile Builder, and WP Members shortcode forms. Premium adds integrations for Ultimate Member, Elementor Pro, bbPress, Easy Digital Downloads, RegistrationMagic, the Gravity Forms User Registration add-on, and Paid Memberships Pro shortcode forms.

For third-party login forms without a dedicated integration, users can append their TFA code to the end of the password. The plugin also supports WP Multisite when network activated.

Additional login protections

The plugin can alert users when a password may have been discovered, based on a successful password entry followed by repeated incorrect TFA codes. TFA-generating secret keys can be encrypted with an on-disk encryption key.

To set up TFA, website owners pick the roles or user levels covered by their policy. Users scan the QR code with a compatible authenticator app, then manage their settings in the dashboard or through the front-end shortcode. Site owners can configure setup timing, trusted-device periods, emergency codes, and login-form behavior.