Updated on 7 July, 2026
WP 2FA plugin version 3 changelog
WP 2FA plugin changelog for all version 3 builds and releases.
3.1.1.2 (2026-02-25)
Plugin & functionality improvements
- Added a check in the wizard for when a user is setting up 2FA over email, to restrict user to only use the email address on account if they are not allowed to use any other email address.
- Improved the survey admin notice logic so that once acted upon, it does not reappear after plugin updates.
3.1.1.1 (2026-02-19)
This is a Premium-only release.
Bug fixes
- Fixed a licensing glitch that could cause false quota alerts in certain sites and Premium plan configurations.
3.1.1 (2026-02-18)
New features
- Added a deactivation form feedback, to optionally capture user feedback.
Plugin & functionality improvements
- Added the feedback survey notice to gater user insights and help us improve the plugin.
- Removed the Clickatell SDK files from the Free edition of the plugin – these are just required for the premium edition..
- Refactored the Freemius SDK licensing components for better maintainability.
Bug fixes
- Fixed a bug which caused users to not be logged out after completing 2FA setup via Twilio, Authy, or Clickatell methods when the logout-after-setup policy is enabled.
- Fixed a bug causing the login button on the 2FA code page to not reflect the custom color configured in the white label settings.
- Fixed a user-reported error: PHP Fatal error: Uncaught TypeError: strpos(): Argument #1 ($haystack) which could occur in /extensions/trusted-devices/class-core.php:299
- Fixed: default email address generation incorrectly stripping the first letter from domains starting with “w”. Credits for reporting this go to David Scott.
- Fixed an issue causing the 2FA bypass feature to malfunction if used with the Free edition of Melapress Login Security.
- * Fixed an error that could appear when using WP Engine Single Sign-on feature with WP 2FA active.
3.1.0 (2025-12-17)
New features
- Passkeys support – allow users to use Passkeys, a cryptographic and secure passwordless solution.
Plugin & functionality improvements
- Removed some redundant text from the Free edition first-time setup wizard.
- Added a number of KB links to the admin notification email that is sent when a user bypasses 2FA due to lack of frontend configuration options.
- Simplified the user flow in the wizard by removing some redundant steps when only one 2FA method is available.
- API Credentials for methods such as Twilio, Authy, Clickatell and Yubikey are now encrypted.
- Added more text to the white labeling module: the link for backup methods on the login page can now be edited.
- The 2FA method names can not be edited through the method selection white labeling tab.
- Added the new tag {wp_admin_email} to be used in the email templates. This one retrieves the site administration email address.
- Added the wizard notice text when setting up “Link over email 2FA” method to the white labeling module.
- Added the modal prompt that shows up when user tries to close the wizard mid-way while configuring a backup method to the white labeling module.
- Added the text and logos inside the TOTP method helper text to the white labeling module.
- Added the final steps of the wizard, to the white labeling module, making it possible to white label all the wizards’ slides.
- Adjusting the default SMS templates to match the required guidelines for auto-population of 2FA code when used on mobile devices.
- Added a new tag {domain} that can be used in the SMS templates.
- Removed the plugin usage survey notice from the plugin.
- Strengthened the authentication flow validation and improved the database query sanitization to prevent potential security vulnerabilities. These enhancements ensure more robust protection of user accounts and data integrity.
- The 2FA setup wizard now automatically opens when users are redirected to the custom frontend 2FA configuration page after login, eliminating the need to click “Configure 2FA” to start the 2FA configuration process.
- Improved the 2FA code page logic so it properly hides the “Log in” button and “Remember this device” options when When a 2FA method becomes unavailable, for example, due to service outage.
- Updated the Twilio integration validator so now it can properly validate and accept alphanumeric sender IDs.
Bug fixes
- Fixed: The shortcode now properly respects the configure_2fa_url set in the plugin settings.
- Fixed: When using REST validation method, disabling the anti-brute force attack protection now works correctly.
- Fixed: On WordPress multisite installations with WooCommerce active, users logging into a subsite’s admin area are now correctly redirected to that subsite’s admin dashboard after completing 2FA authentication.
- Fixed: The “Initial setup text” in White Labeling → 2FA Method Selection now displays correctly when only one 2FA method is available.
- Fixed a number of typos in the 2FA method selection tab inside White Labeling page (.
- Fixed: When using REST API validation method, users can now successfully authenticate through WordPress’s interim login modal (session timeout re-login).
- Fixed: The {reconfigure_or_configure_capitalized} tag in the White Labeling → Method Reconfiguration templates now displays the “Reconfigure” label for methods already configured by the user and “Configure” for methods not yet set up.
3.0.1 (2025-11-19)
Plugin & functionality improvements
- Improved the handling and messaging when the required
libxmlPHP extension is missing during the TOTP QR-code generation. - Added a unique CSS class to the TOTP invalid-code error message to improve white labeling customization options.
- Added the Black Friday / Cyber Monday campaign banners (21 Nov – 1 Dec).
- Updated the plugin logo in the WordPress admin menu (correct size, colours, and alignment).
Bug fixes
- Fixed a fatal error in
class-authentication.phprelated tohash_equals()receiving an invalid argument type. - Fixed a “Copy” button issue on the frontend TOTP setup screen caused by missing
window.wp.i18ndestructuring. - Removed unwanted timeout script in the 2FA login form that cleared the TOTP input field after 200ms.
3.0.0 (2025-09-23)
New features
- Zero-setup email 2FA method: automatically enroll users with 2FA without requiring any user setup or intervention (Premium).
- Added an option to enable/disable automatic email notifications when a user logs in but cannot configure 2FA (Premium).
Plugin & functionality improvements
- Backup codes are now 16 digits long for improved security.
- Extended the maximum allowed grace period to 90 days.
- Updated the plugin logo and artwork.
- Replaced the php-jwt library with in-house developed solution for improved security and performance.
- Added a new upgrade banner notification.
- Accessibility improvements across all plugin wizards; users can now configure 2FA using only the keyboard.
- Plugin no longer redirects to the Policies page after updating, improving the upgrade flow and avoiding unwanted redirection loops.
- Added the plugin’s branding signature to all Free edition email templates.
- Updated the default “From” name and email address used when sending emails.
- Improved the method selection step in the setup wizard by reducing the number of displayed methods for a lighter, cleaner look and feel.
- Improved the build process to better separate Free and Premium editions, in line with WordPress coding standards.
- Improved help texts in several areas of the plugin’s Settings page.
- Added a check to handle missing parameters on the lost password page, preventing a fatal error and displaying a proper message instead.
Bug fixes
- Fixed a user-reported PHP error which occurs in certain circumstances; “Uncaught TypeError: call_user_func_array(): Argument #1 ($callback) ‘wp_2fa_action_doing_it_wrong_run’ not found.”
- Fixed typos in the email template shown when a user logs in but cannot configure 2FA due to setup misconfiguration.
- Fixed a fatal error on multisite installations when users without the
manage_optionscapability attempted access. - Fixed a bug preventing backup codes from being enabled when Yubico was the only available method.
- Fixed a bug in the “log out user after 2FA configuration” feature which caused users to be logged out without finalizing 2FA configuration in some cases.
- Fixed an issue with the Twilio integration that caused alphanumeric IDs to be rejected by the plugin.
- Fixed an issue on multisite where users removed from an excluded subsite were not prompted to configure 2FA when still enforced on another subsite.
- Fixed several other user-reported PHP warnings that could occur under certain conditions.
