/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Two Factor Authentication

Two Factor Authentication

By David Anderson / Team Updraft

Security & Privacy / Security Scanning & Malware Protection

Two Factor Authentication Review - In-Depth Analysis

Secure WordPress login with Two Factor Authentication. Supports various login forms and protocols like HOTP and TOTP.

Performance Overview

WPS Score

6.77/10

User Rating

4.4/5 (based on 77+ reviews)

Active Installations

20,000+

Update Frequency

Average It is calculated using the weighted average of same category plugins.

Security Score

6.1 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin secures WordPress login by requiring a one-time code for users with Two Factor Authentication enabled. It supports standard TOTP and HOTP protocols, allowing integration with apps like Google Authenticator and Authy.

Users can enable or disable TFA on their accounts, and site owners can enforce TFA for specific user roles. The plugin includes features such as graphical QR codes for easy setup, trusted devices, and emergency codes for account recovery.

It is compatible with multiple login forms, including WooCommerce and various membership plugins. Administrators can manage user settings without needing direct access to the dashboard. The plugin is also designed for performance and ease of use.

Comparing to Alternatives

Two Factor Authentication offers robust security features but faces stiff competition from other popular plugins in the same category.

Top alternatives

Strengths

Supports Google Authenticator integration for secure login.
Offers a pro version with advanced features.
Responsive customer support as noted by users.
Simple setup for basic two-factor authentication needs.

Weaknesses

Key features like mandatory 2FA enforcement are only in the paid version.
No support for one-time passwords via email, limiting user options.
Some users report issues with PHP 8 compatibility.
Pricing may be considered high for multiple site management.

User Sentiment Analysis

User feedback highlights both the strengths and limitations of the plugin based on real-world usage.

Positive highlights

"Just works" - praised for simplicity and effectiveness (pave1).
Responsive and helpful support team (gangof4).
Well-written code and reliable functionality (kurtmanos).
Excellent plugin performance noted (Emilio Lejit).

Common complaints

Essential features locked behind a paywall.
Lack of email-based OTP support.
High cost for multiple site usage.
Initial setup can lock users out if not done carefully.

Weaknesses

Free version lacks ability to enforce mandatory 2FA.
Requires third-party app installation for users to receive codes.
Some compatibility issues with newer PHP versions.
Pricing model not suitable for users managing many sites.

Who Should Use This?

Best for

Users seeking a straightforward two-factor authentication solution with Google Authenticator support and who are willing to invest in premium features for enhanced security.

Not ideal for

Those needing free mandatory 2FA enforcement, email-based OTP delivery, or managing multiple sites on a tight budget may find this plugin less suitable.

Pricing & Value

Free version includes

Basic two-factor authentication setup with Google Authenticator support but lacks enforcement and advanced features.

Pro version

Adds mandatory 2FA enforcement, additional authentication methods, and priority support.

Final Verdict

Two Factor Authentication is a solid choice for users prioritizing security and willing to pay for premium features. It offers reliable functionality and responsive support but limits key features in the free version.

Potential users should consider their specific needs and budget, especially if they require email OTP or manage multiple sites, as the pricing and feature set may not align with those requirements.

Other Notable Features

Here are a few other notable features of this free Two Factor Authentication plugin.

Two Factor Authentication

TFA

Google Authenticator

Screenshots

FAQ

Basically, it’s to do with securing your logins, so that there’s more than one link in the chain needing to be broken before an unwanted intruder can get in your website.

By default, your WordPress accounts are protected by only one thing: your password. If that’s broken, then everything’s wide open.

“Two factor” means adding a second requirement. Usually, this is a code that comes to a device you own (e.g. phone, tablet) – so, someone can’t get into your website without getting hold of your device. You can get a longer answer from Wikipedia.

Sometimes it is also called multi-factor authentication instead of two-factor – because someone could secure their systems with as many factors as they like.

If your pass-code used to work, but no longer does, then check that the time on your device that generates them is accurate.

If you cannot get in and need to disable two-factor authentication, then add this to your wp-config.php file, using FTP or the file manager in your hosting control panel:

define('TWO_FACTOR_DISABLE', true);

Add it next to where any other line beginning with “define” is.

Alternatively, if you have FTP or cPanel access to your web hosting space, you can de-activate the plugin; see this article.

If your pass-code used to work, but no longer does, then check that the time on your device that generates them is accurate.

If you cannot get in and need to disable two-factor authentication, then add this to your wp-config.php file, using FTP or the file manager in your hosting control panel: