Add a verification step to WordPress logins

miniOrange 2FA Premium adds a verification step after a user enters a WordPress password. Administrators can set requirements for specific visitors or roles to help protect administrator accounts, customer accounts and sensitive site data.

The add-on works with WooCommerce, Elementor, Ultimate Member, BuddyPress, Theme My Login, LoginPress and custom login forms. It can be used on stores, membership websites, learning platforms, enterprise portals and other WordPress environments.

Choose a method for sign-in

The free plan includes Google Authenticator (TOTP), Passkey, Email OTP and Security Questions. Premium adds SMS OTP, WhatsApp OTP, Telegram OTP, push notification authentication, email verification links, Microsoft Authenticator, Authy, LastPass Authenticator and hardware token authentication.

With push authentication, a user approves a login request on their phone instead of entering a six-digit code. Hardware tokens provide an option for sites that use physical authentication devices.

Check where verification happens

Passkey and Google Authenticator (TOTP) verification execute on the site without external calls. Passkeys can use Face ID, Touch ID, Windows Hello, Android biometrics or security keys such as YubiKey, Titan and SoloKey. A user can use a passkey for passwordless login or as a second step, register multiple passkeys and keep backup codes as a fallback.

Some configured methods communicate with miniOrange services to send or verify OTP, SMS, email, push or account-related requests.

Set account rules and recovery

Apply authentication requirements by role or user. Premium includes enforcement policies, trusted device management, backup authentication settings, account recovery methods, custom redirects after login and strong access controls. Login reports and IP alerts help administrators review authentication activity. Sites that need their own SMS gateway can configure a custom SMS gateway.

Manage branding and WooCommerce access

Premium supports multisite 2FA, custom branding and white-labeling for organizations managing multiple WordPress sites or customizing the authentication experience. For WooCommerce, additional login verification can protect customer accounts, order information, payment details and shop management accounts. Role-based settings let administrators set different requirements for store teams and other user groups.

Install and test the login flow

1. Install the plugin on the WordPress site and open its settings.
2. Select authentication methods, then configure requirements for users or roles, trusted devices, recovery, redirects and any branding options.
3. If using SMS, email, push or related methods, configure the required miniOrange service connection.
4. Test the selected login flow before applying enforcement policies to users.