WP 2FA plugin changelog

This is the plugin’s changelog, which is mainly a detailed list of all the plugin changes and bug fixes introduced in every version update. Refer to the plugin release notes for a high level overview of what is new and improved with every plugin version update.

4.2.1 (2026-10-14)

Functionality & plugin improvements

• Updated the Freemius SDK to version 2.13.5.
• Added a link to the Wordfence Login Security migration guide in the wizard and migrator page.
• Improved the Wordfence migration completion notice to confirm that all users’ 2FA configurations and backup codes have migrated and that Wordfence Login Security can be uninstalled. Made the notice more visible and removed the OK button.

Security fixes

• Fixed saving the setting that allows or blocks custom email addresses for HOTP, OOB methods. The additional settings panel now stays open when the toggle is turned off, until changes are saved.
• Fixed an invisible WP 2FA submenu item under Dashboard that linked to a 404 page after updating to version 4.2.0.

4.2.0 (2026-10-06)

New features & functionality

• Added automatic migration of users’ 2FA configurations from Wordfence Login Security. Users are migrated when they log in, while administrators can track migration progress and see when all users have been migrated.
• Added smart tags to the email and SMS template editors under White labeling.
• Added support for the new self-hosted licensing system while maintaining support for existing Freemius licences.
• Added WordPress.org Live Preview support for the free edition through WordPress Playground.
• Added a temporary 15 minutes user lockout after 5 failed 2FA verification attempts.

Security fixes

• Fixed a CSRF vulnerability affecting REST request handling. Thanks to Filip Kowalski for responsibly reporting this issue through Patchstack.
• Fixed a customer-reported multisite issue where an unresolved user role could remove the user’s configured 2FA method across the network and stop 2FA prompts.

Functionality & plugin improvements

• Raised the minimum required WordPress version from 5.5 to 5.7 to match the functions used by the plugin.
• Improved settings import validation to reject invalid 2FA configuration data.
• Settings imports now keep the “Limit access to the plugin settings” restriction in effect.
• Aligned multisite settings export permissions with import permissions, requiring network administrator access.
• Aligned permissions for removing 2FA and unlocking users on multisite with WordPress user-editing permissions.
• Improved the “Limit access to the plugin settings” option so it consistently restricts other administrators in both interfaces.
• Improved validation and CSS output handling for custom login page colors and logo URLs.
• Passkey sign-in REST routes now register their declared arguments correctly, allowing WordPress to apply the intended validation.
• Authy OneTouch logins now respect the wp_2fa_rememberme filter, matching the standard login flow.
• Default email templates now use {wp_admin_email} for the administrator contact address instead of the plugin’s sender address, without replacing customized templates.
• Authy settings are now hidden on installations where Authy has not already been configured.
• Expanded white-label customization to cover the panel showing a user’s currently configured 2FA method on their profile.
• Added information under White labeling about changing the 2FA login page URL with Melapress Login Security.
• Updated setup wizard button sizes to make the Continue action more prominent.
• Clarified the setup wizard text for grace periods, account blocking, and configuration reminders.
• Updated the 2FA reconfiguration dialog to match the new interface.
• Improved translation support by using complete sentences and proper plural forms.
• Added Dutch translation files.
• Admin notices from other Melapress plugins can now appear on WP 2FA pages.

Bug fixes

• Fixed settings imports leaving settings created after an export unchanged instead of restoring the exported configuration.
• Corrected the status labels shown for created, updated, and unchanged settings after an import.
• Corrected integer and boolean validation, including handling of valid 0 and false values, and addressed PHP 7.4 compatibility in the validator.
• Fixed test emails leaving supported subject tags and the {backup_codes} placeholder unreplaced. Backup-code previews use sample codes rather than real recovery codes.
• Fixed a PHP undefined-variable warning when an invalid Yubico token causes a parsing error.
• Fixed white-label placeholder replacement altering custom CSS rules and generating Array to string conversion warnings.
• Fixed the default “User account unlocked” email missing the site name and closing text, and corrected its HTML formatting.
• Fixed failed email and SMS sends being recorded as successful, which could prevent users from retrying.
• Fixed Twilio connection errors, server errors, and invalid responses being treated as successful SMS sends.
• Fixed repeated loading of the email 2FA screen sending excessive code emails and repeatedly invalidating earlier codes.
• Fixed plugin deletion failing or remaining stuck when DISABLE_2FA_LOGIN is enabled.
• Removed redundant Go back and Continue buttons from the method selection screen after upgrading existing installations.
• Fixed the report generation progress screen showing an incorrect total user count.
• Fixed reports classifying users as “Configured (but not required)” when 2FA is required for all users and the excluded-users list is empty.
• Fixed PHP warnings from openssl_decrypt() when malformed codes reach the out-of-band login handler.
• Fixed missing grace period information in login notices for users signing in with passkeys.
• Fixed REST-based 2FA logins ignoring the WordPress “Remember Me” selection.
• Fixed the malformed URL for the passkey profile script that caused a 404 error on the WooCommerce My Account 2FA page.
• Fixed interrupted user policy updates being marked as complete, preventing later attempts to refresh the user’s policy state.
• Restored one-time code tag replacement in email subject lines.
• Fixed zero-setup email 2FA being assigned to and required for users whose roles are excluded from 2FA.
• Fixed passkey configuration buttons not following the setting that enables or disables WP 2FA styling.
• Stopped loading passkey assets on the WooCommerce My Account 2FA page when passkeys are disabled by the applicable policy.
• Fixed fatal errors during QR code generation when the PHP iconv extension is unavailable.
• Fixed missing PHP xmlwriter support causing fatal errors on the Profile and Edit User pages.

4.1.0 (2026-07-21)

New functionality

• Added an option to customize the OTP code validity period for zero-setup 2FA.

Security fix

• Fixed the Customize email templates heading on the white labeling page.

Functionality & plugin improvements

• Improved email delivery guidance and test email error messages, with clearer troubleshooting information and links to the email deliverability documentation.
• Improved the front-end 2FA settings validation message and styling when the page slug has not been configured.
• Authy OneTouch approval requests are now validated entirely server-side. Approval identifiers are single-use and are no longer exposed to the browser.
• Moved the user profile backup-method link customization to the relevant user profile section of the white labeling settings.
• Improved the login error shown when an unexpected issue prevents 2FA verification.
• Improved spacing between the Add Passkey button and the passkeys table when the backup methods information link is displayed.

Bug fixes

• Fixed the Customize email templates heading on the white labeling page.
• Fixed Twilio SMS delivery failures after upgrading to version 4.0, which could prevent users from receiving login or setup codes even when their Twilio credentials verified successfully.
• Fixed missing Edit Page and View Page buttons in the Premium edition’s front-end settings page.
• Fixed the Bypass 2FA when logging in with passkeys setting being disabled when switching between REST and native passkey modes.
• Fixed the new-interface announcement modal repeatedly appearing because the selected option could not be saved.
• Fixed passkey registration failing after closing and reopening the Add a Passkey modal in the same browser tab.
• Fixed the Remember this device checkbox being unresponsive on WooCommerce login forms in the Premium edition until a failed verification attempt occurred.

4.0.0 (2026-07-07)

New User Interface (UI)

• A completely redesigned plugin interface, offering improved navigation, a more streamlined setup experience, better organization of settings, and a modern design.

Important: Switching to the new interface is a one-way process. New installations use the new interface by default, while upgrades retain the current interface and can switch at any time via a new Switch to the new WP 2FA Interface setting under General Settings.

New feature

• Added an Export table as CSV feature in the Reports, allowing administrators to export 2FA status data for analysis and reporting.

Improvements

• The “learn more about backup codes” URL shown on the user profile is now editable via white labeling, allowing brands to replace or remove the default link.
• Updated the bundled Select2 library to a more recent and secure version.
• Hardened the shortcode return parameter handling to use proper URL validation instead of strip_tags(), preventing potential URL manipulation.
• Updated the SSL check to use wp_die() instead of bare exit() calls for safer request termination.
• Refreshed the install wizard copy across all four slides for clearer, more welcoming language and consistent use of the term “secondary 2FA method” instead of “alternative”.
• Improved the libxml missing extension notice (required for TOTP method) with a clearer, more actionable message directing users to their hosting provider.
• Moved the main *2FA code page text * field to the top of the White Labeling → Customize 2FA code page tab,
• Shortened the default SMS templates on fresh installs to stay under 160 characters, improving deliverability with strict carriers while remaining Twilio-compliant.
• The verification code input on the 2FA login screen is now auto-focused, so users can start typing their code immediately without clicking into the field.
• The {login_code} placeholder now also works in email subject lines, not only in the email body.
• Improved feedback on the 3rd party integrations page: verification modals for Twilio, Clickatell, and all other providers are now consistently styled and show clear error messages when credentials are empty or invalid.
• Verified 3rd party integration credentials are now automatically saved on successful validation, so they persist after a page refresh.
• Declared WooCommerce compatibility with HPOS, Cart/Checkout Blocks, and the Product Block Editor, so WP 2FA no longer appears as “uncertain” in the WooCommerce compatibility dashboard.
• Removed declare(strict_types=1) from all files to improve compatibility with WordPress hooks and prevent intermittent TypeError fatals when filters or actions pass loosely-typed values.
• Removed a large block of commented-out legacy code from wp-2fa.php for cleaner code and easier maintenance.
• Fixed inconsistent text domain usage in the deactivation class (was 'textdomain', now correctly uses 'wp-2fa'), ensuring all deactivation strings are translatable.
• Updated the deactivation feedback form to version 1.1.
• Refactored the plugin’s licensing architecture to improve maintainability and support future enhancements.
• Removed the Quick Links feature from the plugin, along with its underlying code.
• Removed the Survey and Changelog banners from the plugin UI.
• Removed an obsolete white labeling option under *Method selection*.
• Added a check when enabling the “Use custom logo” option: if no logo has been uploaded, a clear error message is now shown pointing to the 2FA code page design settings.
• Removed the unecessary “Activate free version” button from Premium licensing prompt.
• Improved custom CSS handling for buttons on the user profile area, so all WP 2FA buttons consistently pick up plugin styling (or the user’s custom CSS overrides) instead of falling back to WordPress defaults inconsistently.
• Added help text under all subtitles on *White Labeling → Customize 2FA code page → Edit content*, providing a short description for each rich-text field.
• Added missing hint help text on the *Customize setup wizard* page for the Email (HOTP), Yubico, Clickatell, Twilio, and Authy methods, explaining what the hint field controls during 2FA setup.
• Added an upgrade modal that explains the benefits of full white labeling when users click locked white labeling options.
• Passkeys can now be revoked only by the person who generated them instead of other site administrators.

Bug fixes

• Fixed: The WooCommerce /my-account/{2fa-endpoint}/ URL returned a 404 after any rewrite rules flush triggered from an admin request (e.g. saving Settings → Permalinks).
• Optimized performance by removing unnecessary front-end checks for an expired event banner.
• Fixed: wp_delete_post was being called with a post ID of 0 when saving settings under WordPress 6.9, triggering a _doing_it_wrong() notice and causing 500 errors on sites using Acorn / Sage.
• Fixed: PHP Deprecated htmlspecialchars(): Passing null to parameter #1 shown inside the SMS template boxes on PHP 8.3 with WordPress 6.9.4+.
• Fixed: PHP Deprecated Automatic conversion of false to array in the Authy and role settings controller extensions on PHP 8.3 multisite installations.
• Fixed: PHP Notice Function WP_Scripts::add was called incorrectly. The script with the handle "wp_2fa_yubico" was enqueued with dependencies that are not registered: wp2fa-dialog in WordPress 6.9.1+.
• Fixed: The Locked user status was not displayed next to a user after their grace period expired and they attempted to log in again.
• Fixed: Users who configured 2FA voluntarily (without being enforced by a policy) were shown as Configured instead of the correct Configured (but not required) status.
• Fixed: Users not covered by 2FA enforcement were shown as “User has not logged in yet, 2FA status is unknown” instead of “Not required”.
• Fixed: Passkeys were always counted as 0 on the Reports page, regardless of how many passkeys had actually been registered.
• Fixed: Horizontal scrolling caused by the encryption and enforcement dashboard notices when viewing WP 2FA admin pages.
• Fixed: CSS selectors that started with a number (e.g. #2fa-user-global-configuration) have been renamed to valid, wp-2fa-prefixed selectors for consistency and to work correctly with SCSS/LESS preprocessors.
• Fixed: The FlyOut remote configuration fetch is now respectful of user preferences, aligning better with WordPress.org compliance expectations.

Breaking changes

• JSON settings exports created in versions earlier than 4.0 cannot be imported to a version 4.0 install. Recreate the settings export using version 4.0.
• Email template customization is now available as an Enterprise feature. Existing custom email templates will continue to work without interruption.

Changelog for previous versions of WP 2FA:

Version 3 | Version 2 | Version 1