Two Factor Authentication Premium

Two Factor Authentication Premium adds a one-time code step after the password for WordPress users with TFA enabled. Site owners can set who uses TFA and how login forms request the code.

Authenticator codes and recovery

The extension supports standard TOTP and HOTP codes from authenticator apps such as Google Authenticator and Authy. Users can scan a QR code to set up an app on a phone or tablet. TOTP codes are time-based and typically change every 30 seconds; HOTP codes follow a sequence. The add-on does not send codes by email.

Premium includes emergency codes for users who lose access to their device. It can also encrypt TFA secret keys with an on-disk encryption key. Additional security checks can alert users when a password is entered successfully and repeated incorrect TFA codes suggest someone may know it.

Role policies and user options

Administrators can make TFA available to selected roles, such as administrators but not subscribers, and let users enable or disable it where website policy permits. Premium can require TFA for specified user levels after a defined period, including requiring setup immediately by redirecting users to the setup page.

• Allow users to trust a device for a chosen number of days, so they do not have to enter a TFA code on every login from that device. Trusted devices require HTTPS on the login form and cookies to be retained.
• Let administrators view other users’ codes and turn their TFA on or off.
• Require the current TFA code when a user activates TFA through the front-end settings form.

Users can manage settings in the dashboard or through the [twofactor_user_settings] shortcode, without dashboard access. Premium allows custom layouts for the shortcode form. The TFA prompt appears only after the plugin identifies a user who has TFA enabled.

Login form coverage

The plugin supports Theme My Login forms and widgets, WooCommerce, Affiliates-WP, Ultimate Membership Pro, CozmosLabs Profile Builder, and WP Members shortcode forms. Premium adds support for login forms from Ultimate Member, Elementor Pro, bbPress, Easy Digital Downloads, RegistrationMagic, the Gravity Forms User Registration add-on, and shortcode forms from Paid Memberships Pro.

For other third-party login forms, Premium can accept the TFA code appended to the end of the password, without additional coding. On WordPress Multisite, activate the plugin across the network to use it.

Setup

Install and activate the plugin, pick the roles or user levels covered by TFA, and configure any setup requirements. Users scan the displayed QR code with a compatible authenticator app, then manage their settings in the dashboard or through the front-end shortcode. Site owners can set trusted-device periods and configure emergency codes and supported login-form behavior.