Two Factor (2FA) Authentication via Email Plugin

A simple, lightweight, yet effective plugin to enable two factor (2FA) authentication via email. You can enable this on an individual user basis, for all administrators, editors, or all accounts with one line of code in your wp-config.php file.

WordPress is the world’s most popular content management system (CMS), with over 40% of all websites running on it. As such, it has become a prime target for hackers looking to exploit vulnerabilities to gain unauthorized access to websites. One of the best ways to enhance the security of a WordPress site is to enable two-factor authentication (2FA) for administrators.

• Simply enable the plugin then edit a user account to enable 2FA for that individual user.
• Please make sure your WordPress website sends and receives emails correctly. The best way is to use a SMTP plugin.

Use the automatic installer via WordPress or download the plugin and:

1. Upload the plugin files to the /wp-content/plugins/two-factor-2fa-via-email directory.
2. Activate the plugin through the ‘Plugins’ screen in WordPress.
3. Navigate to your profile or any other users and enable to toggle 2FA to enable per account.

1. 

   Under each user account settings, you can click the toggle to turn 2FA on/off.

2. 

   When 2FA is enabled, the user will see this screen after a log-in.

3. 

   An example of an error screen.

4. 

   An email sent to the site admin when the 2FA plugin is disabled.

1.8

• Added 1.7.1 to trunk in WP Plugin Directory for rollback compatibility
• We are now using $priority 1 on the wp_login hook
• Added theme/folder compatibility. As of v1.4 developers could add ss88-2fa-page.php to their theme directory. We now support an additional directory ss88-2fa i.e. wp-content/themes/xxx/ss88-2fa/2fa-page.php. v1.4 functionality will be removed in a future release in favor for the new directory ss88-2fa.
• Added support for advanced developers to use a custom 2FA email. You can now override the 2FA email by copying assets/html/login-email.php to your theme’s directory. Upload this file to wp-content/themes/xxx/ss88-2fa/login-email.php to customize it!

1.7.1

• A new constant has been integrated which can be added in wp-config.php to override individual user settings to force 2FA to be enabled for Subscribers. Add SS88_2FAVE_ENABLE_SUBSCRIBERS to your wp-config.php i.e. define('SS88_2FAVE_ENABLE_SUBSCRIBERS', true);.

1.7

• Localization integration

1.6.4

• Integration with the default Remember Me checkbox from WordPress

1.6.3

• Integration with Ultimate Member

1.6.2

• Removed accidental code forcing everyone who logged in to receive a 2FA screen

1.6.1

• Deactivation fatal error fix

1.6

• New Features:
• Wording changed when SMTP is not enabled.
• The plugin now sends an email to the site admin if the plugin is deactivated. The email can be overridden by defining the constant SS88_2FAVE_NOTIFICATION_EMAIL in wp-config.php i.e. define('SS88_2FAVE_NOTIFICATION_EMAIL', '[email protected]');
• Three new constants added which can be added in wp-config.php to override individual user settings to force 2FA to be enabled. They are: SS88_2FAVE_ENABLE_ALL (to enable for every single account), SS88_2FAVE_ENABLE_ADMINS (to enable only for Administrators), and SS88_2FAVE_ENABLE_EDITORS (to enable for Editors) i.e. define('SS88_2FAVE_ENABLE_ALL', true);.

1.5.2

• Replaced sanitize_url in favor of esc_url
• Added a new constant SS88_2FAVE_LINK_EXPIRES_MINUTES so that users can define their own link expiry time in minutes
• Added a JavaScript countdown timer to the login page

1.5.1

• Email content fix

1.5

• ‘Fancy’ emails
• Moving files into appropriate folders
• Re-order of security features when logging in

1.4

• Added PHP_INT_MAX to wp_login hook
• Added support for advanced developers to use a custom 2FA template. You can now override the 2FA page by copying assets/2fa-page.php to your theme’s directory. Upload this file to wp-content/themes/xxx/ss88-2fa-page.php to customize it!

1.3

• Fixed ‘dismiss’ link on notification
• Added support for SMTP Mailer check

1.2

• Added support link to plugin page

1.1

• Fix openssl key
• Fix echo’ing

1.0

• Initial release.