Two Factor Authentication Premium adds configurable two-factor authentication (TFA) to WordPress sign-ins. After a password is accepted, visitors with TFA enabled enter a one-time code. Users without TFA enabled are not prompted for one.

The add-on supports standard TOTP and HOTP protocols, including authenticator apps such as Google Authenticator and Authy. Users can scan a graphical QR code to set up an app, which generates their codes. Codes are not sent by email or SMS.

Apply role rules and setup deadlines

• Choose which roles can use TFA, such as administrators but not subscribers.
• Allow users to turn TFA on or off where the site policy permits.
• Require TFA for specified visitor levels after a defined period. To require immediate setup, redirect users to the setup page.

Manage settings, devices, and recovery

Users can manage TFA in the WordPress dashboard or through the [twofactor_user_settings] shortcode on a front-end page. Premium enables custom layouts for the shortcode and can require users to enter their current TFA code before activating TFA through the front-end form.

• Allow users to mark devices as trusted and skip code entry for a chosen number of days. Trusted-device use requires HTTPS on the login form and cookies to be kept on the device.
• Provide emergency codes for users who lose access to a phone or tablet.
• Let administrators access other users’ codes and turn TFA on or off when needed.
• Encrypt TFA secret keys with an on-disk encryption key.

Additional checks can alert users when a correct password is followed by repeated incorrect TFA codes, a pattern that may indicate someone has learned the password.

Connect supported login forms

The plugin supports Theme My Login forms and widgets, WooCommerce and Affiliates-WP login forms, Ultimate Membership Pro, CozmosLabs Profile Builder, and WP Members shortcode forms. Premium adds support for Ultimate Member, Elementor Pro, bbPress, Easy Digital Downloads, RegistrationMagic, the Gravity Forms User Registration add-on, and shortcode login forms from Paid Memberships Pro.

For other third-party login forms, Premium can accept the TFA code appended to the password, without additional coding. WordPress Multisite is supported when the plugin is network activated.