Rad 2FA — Two-Factor Login (Email & Authenticator App)

This plugin adds a second authentication factor for the user roles you choose. After a correct username and password, an extra code is required — the site admin picks the method:

• Email — a one-time numeric code sent to the user’s email address.
• Authenticator app (TOTP) — a standard 6-digit code from an app such as Google Authenticator, Authy, or Microsoft Authenticator (this plugin is not affiliated with or endorsed by Google). Each user connects the app in their own profile: scan the QR code or enter the secret key manually.

If the site uses TOTP but a specific user hasn’t connected the app yet, they temporarily get an email code at login instead — so nobody gets locked out.

Features:

• Enable 2FA per user role
• Two verification methods: email code or authenticator app (TOTP)
• Configurable email code length, lifetime, and attempt limit
• Admin screens and email codes follow each user’s own WordPress language setting (Users → Profile → Language) — no site-wide language switch needed
• Email codes are stored only as a hash; the TOTP secret is stored encrypted (AES-256-CBC)
• The QR code is generated entirely in the browser — the secret is never sent to a third-party service

Credits

The QR code on the authenticator app setup screen is rendered client-side using QRCode.js by davidshimjs (MIT license). This plugin bundles the minified build; the unminified source is available at https://github.com/davidshimjs/qrcodejs

Donate

If you find this plugin useful, please consider supporting its development.

https://buymeacoffee.com/rad181