WP 2FA - Two-factor authentication for WordPress (Premium)

The delicate day for two-factor is when the deadline expires

You decide everyone on the team should use two-factor. You turn on the requirement, the notice goes out and some people leave it for later. The deadline arrives and by mid-morning someone cannot get in to publish. The plugin was already installed: the trouble began when the rule reached specific people.

Requiring two-factor works more like a change of habits than a technical setting. The useful question is not which method is safest, but who has to set it up, how long you give them, what happens if they do not, and how they get back in if they lose their phone.

WP 2FA Premium, by Melapress, has a control for each of those questions: per-role policies, grace periods, a configurable consequence when the period ends and several recovery routes.

Seven ways to confirm a login

The Premium edition adds methods to those of the free version, which covers authenticator apps and email codes:

• Authenticator app (TOTP): Google Authenticator, Authy, Microsoft Authenticator and other compatible apps.
• Email codes: single use.
• Passkeys: passwordless, unlocked with biometrics or a PIN, and several per user.
• YubiKey physical key: the only hardware key supported.
• SMS: one-time codes through Twilio or Clickatell.
• Email link: log in with one click, without typing a code.
• Zero-setup email: applied automatically, with no action from the user.

Per-role policies, with a deadline and a consequence

From WP 2FA, Sitewide 2FA Policies you decide the scope and the conditions:

• Who is required: everyone, specific users or roles, or no one, in which case it stays optional.
• Per role: requirement, allowed methods, deadline and trusted devices.
• Deadline: immediately or with a grace period, such as 3 days, with reminder emails.
• On expiry: you choose what happens, such as restricting dashboard access or blocking the account.
• Other rules: two-factor on password reset, code expiration and usage reports.

Ways out for someone who loses their phone

Before requiring it of anyone, settle how an account gets recovered. These are the routes:

• Backup codes: single use, to print, save or send by email.
• Another administrator: can reset the user's two-factor.
• One-time bypass: allows the next login without two-factor, for support or recovery.
• Last resort: if there is no other administrator, manually deactivate the plugin, log in and configure it again.

Rolling it out in phases, customers included

SMS requires an account with Twilio or Clickatell, and its cost depends on that provider. If you use email, first check that your site delivers messages. This is a reasonable sequence, to adapt and test on your site:

1. Activating the plugin starts the wizard, which cannot be reopened, though all its settings remain in the policies.
2. Set up your own account and a backup method.
3. Require two-factor for administrators and editors, with a grace period.
4. Extend the policy to the remaining roles.

For a store, there is one-click integration with WooCommerce customer accounts, and users can manage their two-factor from pages on the site, without entering the dashboard. It supports custom login pages, custom login URLs and multisite.

If you want protection beyond the login

WP 2FA takes care of confirming who gets in. Its features do not include a firewall or a malware scanner. For that part, Wordfence Premium combines a firewall and scanner with TOTP two-factor and passkeys, and Solid Security Pro brings together brute force protection, a vulnerability scanner and version management.

Loginizer Pro focuses on limiting attempts and closing entry points such as XML-RPC, as well as asking for a second factor.

Common questions before requiring it

Can I require it for only some roles?

Yes. Policies are configured per role, and you can also target specific users.

Does it work with custom login pages?

Yes, including WooCommerce ones, and also with custom login URLs.

Which physical keys does it support?

Only YubiKey among hardware keys. The passkeys on your devices are a separate method.