WP 2FA – Features

WP 2FA is the #1 user-rated 2FA plugin for WordPress. It is easy to use, quick to deploy, and helps you and your users better protect your website and data. Not convinced? – Check out our feature list below:

2FA methods:
Authenticator app
Log in using time-based one-time codes generated by an authenticator app on your phone or computer, such as Google Authenticator, Authy, or Microsoft Authenticator.
Passkeys
A passwordless login method that replaces passwords with cryptographic keys stored securely on your device and unlocked using biometrics or a PIN.
Hardware security key
Log in using a physical hardware security key for phishing-resistant authentication. Currently supports YubiKey, with support for additional hardware keys coming soon.
SMS one-time codes
Receive a one-time login code via SMS, delivered through supported providers such as Twilio or Clickatell.
Email login link
After entering your username and password, receive an email with a secure login link. Click the link to complete the login, with no one-time code required.
Email one-time codes (HOTP)
Log in using a one-time code sent to your email address. Each code can be used only once, providing a simple email-based 2FA option.
Zero-setup email 2FA
Users are automatically protected with email-based two-factor authentication, without needing to install apps, configure devices, or take any action.
Connect any 2FA provider
WP 2FA includes an extensible API that lets you integrate third-party 2FA services and use them for WordPress logins, even if we do not support them.
Backup methods:
Email one-time codes as backup
Use email-delivered one-time codes as a backup authentication method if your primary 2FA option is unavailable.
Backup codes
Generate single-use backup codes that can be printed, saved securely, or emailed to you. These codes let you access your account if your primary 2FA method isn’t available, such as when your phone battery is dead.
Whitelabelling:
Use site styling automatically
Disable the plugin’s default styling so authentication pages inherit your website’s CSS and theme.
Editable email templates
Customize all authentication and notification emails.
Editable SMS templates
Edit all SMS messages used for two-factor authentication.
Editable 2FA code page text
Customize all text shown on the 2FA verification screen.
2FA code page styling
 Fully brand the 2FA code entry page using built-in styling controls.
Editable wizard text
Customize all text used in setup and login wizards.
Custom wizard welcome slide
Add an optional introductory slide at the start of authentication wizards.
Custom email sender details
Override the “from” email address and sender name used for all authentication and notification emails.
Custom CSS & styling
Apply custom CSS to fully control the styling of all user-facing pages.
2FA Policies:
2FA policies per user role
Configure all 2FA enforcement rules, allowed methods, grace periods, and trusted device settings differently per user role.
Require users to configure 2FA
Enforce 2FA for all users, specific roles, individual users, or entire sites (including multisite).
Allow or restrict 2FA methods
Control which 2FA methods users are allowed to use or are blocked from using.
Configurable grace period
Allow users to set up 2FA immediately or within a defined time window, with configurable actions once the grace period expires (for example, block login or force setup).
Grace period notifications
Notify users about upcoming 2FA enforcement via the dashboard and during the login process.
Prevent users from removing or changing 2FA
Optionally restrict users from disabling 2FA or switching authentication methods.
Require 2FA for password resets
Require users to verify with a one-time 2FA code before completing a password reset.
Extra security features:
Restrict access to 2FA settings
Limit access to WP 2FA settings so only selected administrators can modify 2FA policies and methods.
2FA code brute-force protection
Automatically invalidates a one-time code after a failed attempt and issues a new one to reduce brute-force risk.
Trusted devices
Allow users to mark devices as trusted to reduce repeated 2FA prompts.
Trusted device controls
Define how long devices are remembered and when users must re-authenticate (for example, when cookies change).
Setup, configuration & management:
Setup & configuration wizards
Guided install and configuration wizards let admins set up the plugin and key 2FA options in just a few clicks.
User-friendly 2FA setup
Step-by-step wizards guide users through configuring, changing, and using 2FA methods.
2FA management in user profiles
Users can view, change, or remove their configured 2FA methods directly from their profile (subject to admin policy).
2FA status overview for admins
View each user’s 2FA status and configured method directly from the WordPress Users screen.
Temporary 2FA bypass for support
Allow selected users to log in once without 2FA to assist with troubleshooting or account recovery.
Import & export 2FA settings
Easily migrate or replicate plugin and 2FA policy settings across multiple websites.
Deployment & compatibility:
Plug-and-play custom login page support
Works automatically with custom WordPress login pages and login pages created with third-party plugins, with no additional configuration or customization required.
Frontend 2FA setup pages
Allow users to configure and manage 2FA from frontend pages, without access to the WordPress dashboard, ideal for eCommerce, membership, and learning platforms.
Post-setup redirect control
Redirect users to a specific page after completing 2FA setup on the frontend.
Multisite network support
Fully compatible with WordPress multisite, with support for configuring different 2FA policies per site.
Works with non-default login URLs
Compatible out of the box with websites that use custom login URLs or restrict access to wp-login.php.
Integrations:
WooCommerce integration
Add 2FA settings to the WooCommerce customer portal with one click. No custom code required.
REST API for custom integrations
Use dedicated REST API endpoints to integrate the plugin’s 2FA functionality—such as requesting or verifying one-time codes—into custom forms, workflows, or external services.

Choose your plan

* Multisite network licensing: you need a license that covers the number of sites you have on your network.


Trusted by world renowned brands and agencies

wp 2fa ibm
wp 2fa sej
wp 2fa fix runner
virgin pulse
wp 2fa ccbill

4.6 - 4.7 stars rating

More than 100,000+ active installs


Who should use WP 2FA?

WP 2FA is designed for all WordPress websites and business owners, administrators, and managers who want to add an extra layer of security to their website’s authentication. At the same time, the plugin offers the team, customers, and members more flexibility without any security trade-offs.

Do I need coding skills to use WP 2FA?

No. You can use the plugin to its full potential without any coding knowledge. WP 2FA is designed to be easy to use so that any person of any technical background can use the plugin.

What license do I need for my multisite network?

On a multisite network all users are network users that are assigned access to to different sites. Therefore you need a license that covers the number of sites on your multisite network.

Is the pricing yearly?

Yes, all of the plugin’s license plans are on a yearly subscription basis. A license renewal is automatically set up upon purchase, which you can cancel whenever you want from your account page. We will also send you reminders a few weeks before the renewal comes due.

Which payment methods are accepted?

We accept all major credit cards including Visa, Mastercard, and American Express, as well as PayPal payments.

Can I change my plan later on?

Absolutely! You can upgrade or downgrade your plan at any time. When you upgrade an existing plan you only pay a prorated amount. When you downgrade, you get an extension of your subscription.

Are there any other fees, such as setup fees?

No. There are no other fees on any of our plans.

Do I get updates for the premium plugin?

Yes! Premium plugin updates are included with all plans. This means that as long as you have a valid plan, you will receive updates, ensuring that your plugin remains up to date and running reliably.

Do you offer support if I need help?

Yes, we support our customers every step of the way. You can reach us through the in-plugin support page or by opening a support ticket from the support section on our websites. Our customer support team will be more than happy to assist you.

What is Priority support in the Enterprise plan?

We always do our best to reply to your support requests as soon as possible, regardless of the plan that you are paying for. However, support requests from paying users of the Enterprise plan are given priority and they are guaranteed a reply within the first 6 to 8 hours during the normal business hours (Monday to Friday, from 9 AM until 6 PM Central European Time).

Can I cancel my account/subscription at any time?

Yes. If you ever decide that the plugin isn’t the best solution for your business, you can cancel your subscription from your account page. When canceling a subscription, renewals are canceled as well. The license key and plugin’s functionality will remain valid until the end of the paid term.

How does WP 2FA send SMSs?

WP 2FA sends SMS OTPs via a 3rd party subscription service, with the plugin supporting both Twilio and Clickatell SMS Gateway services. SMS delivery charges depend on your SMS Gateway service of choice.

Can I try the plugin before I buy it?

The plugin is not available for trial, however, you are fully protected by our 30-day money back guarantee. If you do not like the plugin over the next 30 days after purchase, we will refund 100% of your money. We make it that easy!

Do you offer refunds?

Yes, we do! We have a 30-day money back guarantee. We stand behind the quality of our product and we test our plugins extensively. However, we also understand that in some edge cases technical problems may arise. We will try our best to solve them, however, you are always protected by the 30-day money back guarantee, which means you can request a refund within the first 30 days from purchase without any questions asked. We make it that easy!

I have other pre-sale questions, can you help?

Yes! You can ask us any question by getting in touch with us.

Uploading WP 2FA as a zip file in WordPress
WP 2FA in the WordPress plugin repository
Close

Installing WP 2FA Free

Congratulations on taking the first step towards enhancing your WordPress site's security with WP 2FA Free! You're now on your way to protecting your valuable data and ensuring peace of mind. No coding or technical knowledge is required.

 

Below are two ways to install WP 2FA on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for WP 2FA.

Download the WP 2FA plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2