WP 2FA – Two-factor authentication for WordPress

New features Passkeys support – allow users to use Passkeys, a cryptographic and secure passwordless solution.

Passkeys support – allow users to use Passkeys, a cryptographic and secure passwordless solution.

Plugin & functionality improvements Removed some redundant text from the Free edition first-time setup wizard. Added a number of KB links to the admin notification email that is sent when a user bypasses 2FA due to lack of frontend configuration options. Simplified the user flow in the wizard by removing some redundant steps when only one 2FA method is available. Added the new tag {wp_admin_email} to be used in the email templates. This one retrieves the site administration email address. Added the final steps of the wizard, to the white labeling module, making it possible to white label all the wizards’ slides. Removed the plugin usage survey notice from the plugin. Strengthened the authentication flow validation and improved the database query sanitization to prevent potential security vulnerabilities. These enhancements ensure more robust protection of user accounts and data integrity. The 2FA setup wizard now automatically opens when users are redirected to the custom frontend 2FA configuration page after login, eliminating the need to click “Configure 2FA” to start the 2FA configuration process. Improved the 2FA code page logic so it properly hides the “Log in” button and “Remember this device” options when When a 2FA method becomes unavailable, for example, due to service outage.

Removed some redundant text from the Free edition first-time setup wizard.

Added a number of KB links to the admin notification email that is sent when a user bypasses 2FA due to lack of frontend configuration options.

Simplified the user flow in the wizard by removing some redundant steps when only one 2FA method is available.

Added the new tag {wp_admin_email} to be used in the email templates. This one retrieves the site administration email address.

Added the final steps of the wizard, to the white labeling module, making it possible to white label all the wizards’ slides.

Removed the plugin usage survey notice from the plugin.

Strengthened the authentication flow validation and improved the database query sanitization to prevent potential security vulnerabilities. These enhancements ensure more robust protection of user accounts and data integrity.

The 2FA setup wizard now automatically opens when users are redirected to the custom frontend 2FA configuration page after login, eliminating the need to click “Configure 2FA” to start the 2FA configuration process.

Improved the 2FA code page logic so it properly hides the “Log in” button and “Remember this device” options when When a 2FA method becomes unavailable, for example, due to service outage.

The [wp-2fa-setup-notice] shortcode now properly respects the configure_2fa_url set in the plugin settings. Fixed: When using REST validation method, disabling the anti-brute force attack protection now works correctly. Fixed: On WordPress multisite installations with WooCommerce active, users logging into a subsite’s admin area are now correctly redirected to that subsite’s admin dashboard after completing 2FA authentication. Fixed: When using REST API validation method, users can now successfully authenticate through WordPress’s interim login modal (session timeout re-login).

The [wp-2fa-setup-notice] shortcode now properly respects the configure_2fa_url set in the plugin settings.

When using REST validation method, disabling the anti-brute force attack protection now works correctly.

On WordPress multisite installations with WooCommerce active, users logging into a subsite’s admin area are now correctly redirected to that subsite’s admin dashboard after completing 2FA authentication.

When using REST API validation method, users can now successfully authenticate through WordPress’s interim login modal (session timeout re-login).