Two Factor Authentication Premium adds a one-time authenticator code after the password for WordPress customers who have TFA enabled. The login prompt appears after the plugin identifies the account as one that uses TFA.

Set up authenticator codes

The plugin works with standard TOTP and HOTP codes from apps such as Google Authenticator and Authy. TOTP codes are time-based; HOTP codes follow a sequence. Users can scan a graphical QR code to configure an app on a phone or tablet. Codes come from an authenticator app; the plugin does not send them by email.

Choose who must use TFA

• Make TFA available to selected roles, such as administrators but not subscribers. Users can turn it on or off where website policy permits.
• Require TFA for specified visitor levels after a defined period. Premium can also redirect users to the setup page for immediate setup.
• Let administrators access other users’ codes and turn TFA on or off when needed.

Manage settings and account recovery

Users can manage their settings in the dashboard or on the front end with the [twofactor_user_settings] shortcode. Premium enables custom layouts for this settings area, so users can manage TFA without dashboard access. When the front-end form is used to activate TFA, Premium can require the user’s current code. Trusted devices can skip code entry for a chosen number of days, and emergency codes provide another way to sign in if a user loses access to their phone or tablet.

Connect login forms and protect stored keys

The plugin supports Theme My Login forms and widgets, WooCommerce, Affiliates-WP, Ultimate Membership Pro, CozmosLabs Profile Builder, and WP Members shortcode forms. Premium adds support for login forms from Ultimate Member, Elementor Pro, bbPress, Easy Digital Downloads, RegistrationMagic, the Gravity Forms User Registration add-on, and Paid Memberships Pro shortcode forms. For other third-party forms, Premium can accept the TFA code appended to the password.

WP Multisite is supported when the plugin is network activated. TFA secret keys can be encrypted with an on-disk encryption key. The plugin can also alert users when a successful password entry is followed by repeated incorrect TFA codes, which may indicate that someone has learned the password.