Repolode
Submit
WordPress

WordPress/two-factor

A WordPress plugin that adds a second login verification step, such as a one-time code, on top of the password.

View on GitHubWebsite
Stars
826
Forks
192
Open issues
63
Last commit
3 days ago

What is it?

Two-Factor is a WordPress plugin that requires users to confirm their identity with a second form of authentication after entering their password. It is aimed at site administrators and members who want protection against account takeover when passwords are weak, reused, or leaked.

The plugin is distributed through the WordPress.org plugin directory and is maintained within the WordPress project. Its code is PHP, and it targets WordPress sites, including multisite installations, as its test suites cover both single-site and multisite setups.

Developers can run a Docker-based development environment via npm scripts, execute the test suites, and generate code coverage reports. Versioned releases are deployed automatically from Git tags through a GitHub Actions workflow.

Key features

  • 01Adds a second authentication step after the password login.
  • 02Supports single-site and multisite WordPress installations.
  • 03Provides a Docker-based development environment with npm scripts.
  • 04Includes single-site and multisite test suites with optional coverage reports.
  • 05Releases are deployed automatically to the WordPress.org plugin directory.

Use cases

  • Protecting administrator accounts on a WordPress site against password theft.
  • Adding a second login check for multi-user or multisite WordPress networks.
  • Contributing to or testing a WordPress security plugin locally.

Quick start

  1. 1

    Install and launch Docker

  2. 2

    Clone the repository

    git clone https://github.com/wordpress/two-factor.git
  3. 3

    Install dependencies

    npm install
  4. 4

    Start the development environment

    npm run env start

Things to know

  • It is a WordPress plugin, so it only works on a WordPress site.
  • The development environment requires Docker to be installed and running.
  • It is licensed under GPL-2.0, a copyleft license.

In collections

Login, SSO & identity servers

Topics

#wordpress#wordpress-plugin#2fa#authentication#totp#php

FAQ

What is two-factor?
A WordPress plugin that adds a second login verification step, such as a one-time code, on top of the password. Two-Factor is a WordPress plugin that requires users to confirm their identity with a second form of authentication after entering their password. It is aimed at site administrators and members who want protection against account takeover when passwords are weak, reused, or leaked.
Is two-factor free to use? What license does it have?
two-factor is open source under the GPL-2.0 license. Check the license terms before using it in commercial products.
Is two-factor still maintained?
Actively maintained. The last commit to two-factor was on Nov 5, 2026.
What can I use two-factor for?
Protecting administrator accounts on a WordPress site against password theft. Adding a second login check for multi-user or multisite WordPress networks. Contributing to or testing a WordPress security plugin locally.
How do I install two-factor?
Install and launch Docker Clone the repository: git clone https://github.com/wordpress/two-factor.git Install dependencies: npm install Start the development environment: npm run env start
Where can I get two-factor?
The source code and installation instructions are on GitHub: https://github.com/WordPress/two-factor

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects

Bubka / 2FAuth

A self-hosted web app for storing 2FA accounts and generating TOTP, HOTP and Steam Guard security codes, as an alternative to Google Authenticator.

Security#2fa#totp#hotp
4.2K+9 this week308PHPAGPL-3.0Well maintainedUpdated 4 days ago