/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ Two Factor (2FA) Authentication via Email

Two Factor (2FA) Authentication via Email

By Sully

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Two Factor (2FA) Authentication via Email Review - In-Depth Analysis

Enhance your WordPress site's security with this Two-Factor Authentication (2FA) plugin using email for verification.

Performance Overview

WPS Score

6.57/10

User Rating

5/5 (based on 4+ reviews)

Active Installations

9,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

5 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin provides a simple and effective way to enable two-factor authentication (2FA) via email for your WordPress site. It is lightweight and can be activated on a per-user basis or for all administrators and editors with just a single line of code in your wp-config.php file.

With WordPress powering over 40% of all websites, it has become a prime target for hackers. Implementing 2FA significantly enhances your site's security by requiring an additional verification step during login.

To use this plugin, simply enable it and edit user accounts to activate 2FA for individual users. Ensure your WordPress site is configured to send and receive emails correctly, preferably using an SMTP plugin for reliable email delivery.

Comparing to Alternatives

Two Factor (2FA) Authentication via Email offers a straightforward email-based 2FA solution among several established alternatives that provide multi-method authentication.

Top alternatives

Strengths

Simple and lightweight, easy to use without complex configuration
Quick setup with toggle activation per user or site-wide via config file
Focused specifically on email-based 2FA, reducing unnecessary features
Good developer support and responsiveness
Supports localization for broader usability

Weaknesses

Limited to email-based 2FA only, lacking other authentication methods
Has had a medium severity security vulnerability in the past (fixed in latest version)
Smaller user base compared to some alternatives
No pro version with extended features available

User Sentiment Analysis

With a perfect 5-star rating from all reviewers and no negative feedback, users appreciate the plugin's simplicity and effectiveness.

Positive highlights

'Simple, lightweight and easy to use – should be baked into WordPress IMO' – nathantpc
'Easiest way to boost security going, no crazy configuration needs' – bopsbees
'Very convenient for personal use or for protecting client websites' – Jeremy Wu
'Simple and lightweight plugin. Love it' – Tapash

Common complaints

Weaknesses

Past medium severity security vulnerability (fixed in version 1.9.9)
Limited to email as the sole 2FA method
No advanced features or customization options

Who Should Use This?

Best for

Users or site administrators seeking a simple, no-fuss email-based two-factor authentication solution to enhance security quickly and easily.

Not ideal for

Those needing multi-method 2FA options like SMS or authenticator apps, or requiring advanced security features and customization.

Pricing & Value

Free version includes

The free version provides straightforward email-based two-factor authentication with easy setup and user management.

Final Verdict

Two Factor (2FA) Authentication via Email is an excellent choice for users wanting a lightweight, simple, and effective email-based 2FA solution. It boasts a perfect user rating and quick setup, making it ideal for those prioritizing ease of use without complex configurations.

However, it is limited to email authentication only and has had a medium severity security vulnerability in the past, now fixed. Users requiring multi-factor options or advanced features may want to explore other alternatives. Overall, it offers solid value as a free plugin for basic 2FA needs.

Other Notable Features

Here are a few other notable features of this free Two Factor (2FA) Authentication via Email plugin.

2FA

Two Factor Authentication

Email Authentication

Screenshots

FAQ

If you are not receiving the email to login then in order to regain access to your account, you’ll have to disable the plugin. The only way to do this is by renaming the plugin folder from two-factor-2fa-via-email to two-factor-2fa-via-email.backup or equivalent.

Yes! As of version 1.5.2 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_LINK_EXPIRES_MINUTES', 10);

Where the number 10 is, change this to whatever value (in minutes) you prefer.

Yes! As of version 1.6 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_ENABLE_ADMINS', true);

Yes! As of version 1.6 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_ENABLE_EDITORS', true);

Yes! As of version 1.9.2 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_ENABLE_CONTRIBUTORS', true);

Yes! As of version 1.7.1 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_ENABLE_SUBSCRIBERS', true);

Yes! As of version 1.6 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_ENABLE_ALL', true);

Yes! As of version 1.6 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_NOTIFICATION_EMAIL', '[email protected]');

Change [email protected] to your preferred email.

Yes! As of version 1.9 you can now add a defined constant to your wp-config.php file;

define('SS88_2FAVE_API_DISABLE_ALL', true);

As of version 1.9.1 you can use the filter SS88_2FAVE_custom_redirect like so:

add_filter('SS88_2FAVE_custom_redirect', function($URL) {      if(current_user_can('editor')) return 'https://custom.com/page/here';     else return $URL;  });

As of version 1.9.1 you can use the filter SS88_2FAVE_isEnabled like so:

add_filter('SS88_2FAVE_isEnabled', function($isEnabled, $UserID, $type) {      // $isEnabled = Prior value     // $UserID = ID of user     // $type = Values are API or LOGIN      return $isEnabled;  }, 10, 3);

Please note that if you have SS88_2FAVE_ENABLE_ALL, SS88_2FAVE_ENABLE_ADMINS, SS88_2FAVE_ENABLE_EDITORS, SS88_2FAVE_ENABLE_CONTRIBUTORS, SS88_2FAVE_ENABLE_SUBSCRIBERS, or SS88_2FAVE_API_DISABLE_ALL set, the filter SS88_2FAVE_isEnabled will not work.