Title: miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)
Author: miniOrange
Published: <strong>9. julija 2015</strong>
Last modified: 1. oktobra 2026

---

Tykace pytaś

![](https://ps.w.org/miniorange-2-factor-authentication/assets/banner-772x250.png?
rev=3707551)

![](https://ps.w.org/miniorange-2-factor-authentication/assets/icon-256x256.gif?
rev=2652528)

# miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)

 Wót [miniOrange](https://profiles.wordpress.org/cyberlord92/)

[Ześěgnuś](https://downloads.wordpress.org/plugin/miniorange-2-factor-authentication.6.4.0.zip)

 * [Drobnostki](https://dsb.wordpress.org/plugins/miniorange-2-factor-authentication/#description)
 * [Pógódnośenja](https://dsb.wordpress.org/plugins/miniorange-2-factor-authentication/#reviews)
 *  [Instalacija](https://dsb.wordpress.org/plugins/miniorange-2-factor-authentication/#installation)
 * [Wuwiśe](https://dsb.wordpress.org/plugins/miniorange-2-factor-authentication/#developers)

 [Pódpěra](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/)

## Wopisanje

### WordPress Two-Factor Authentication (2FA)

WordPress websites are frequently targeted by brute force attacks, credential stuffing
attacks, phishing attempts, and unauthorized login attempts. Passwords alone are
no longer sufficient to protect administrator accounts, customer accounts, and sensitive
website data. **Which is exactly why 2FA has become essential.**

### What’s New in 6.4.0

 * **Magic Link Login** — a passwordless „email me a login link“ option at wp-login.
   php, as an alternative to typing an OTP.
 * **Trusted Devices (free)** — a recognized browser skips repeat **2FA** prompts
   for 7 days after a successful challenge.
 * **Recent Logins panel** — each user can see their own last 10 login attempts (
   date, IP, success/failure) on their own profile, no admin access required.
 * **2FA Adoption dashboard widget** — see at a glance how many required users have**
   2FA** configured, right from wp-admin.
 * **2FA setup reminder emails** — an optional recurring nudge for users who are
   required to set up **2FA** but haven’t yet.
 * **Security alert emails** — a user is notified whenever their **2FA** method 
   is changed or reset by an admin, so they notice if it wasn’t them.
 * **Cloud email relay** — plugin emails (OTP, verification links, backup codes,
   and more) now send through miniOrange’s cloud relay, so delivery no longer depends
   on the site having SMTP configured.
 * **Redesigned admin UI** — the 2FA Configurations screen is now split into focused
   Access Rules, Login Experience, Methods, Notifications, and Advanced pages with
   WordPress-native styling.
 * **„Protect Staff, Not Shoppers“ WooCommerce preset** — one click on the Quick
   Setup screen requires **2FA** for Administrator, Editor, Author, and Shop Manager,
   and leaves Customer unchecked so checkout stays frictionless.
 * **Per-role grace periods** — give specific roles a different grace period, and
   a different enforce-or-block action when it expires, than the site-wide default.
 * **Compliance Log report** — a Reports tab showing admin-initiated **2FA** changes(
   who did what, to whom, when), useful as MFA evidence for PCI DSS, GDPR, or cyber-
   insurance requirements.
 * **Security hardening** — see the full Changelog below for details, including 
   brute-force protection on backup-code validation and closing a gap where premium-
   locked methods were still reachable on the backend.

### Also in recent releases

 * **Unlimited users on the free plan** — no user cap, no per-seat charge.
 * **Passkey (WebAuthn/FIDO2) — free** — passwordless **2FA** with Face ID, Touch
   ID, Windows Hello, or a hardware security key.
 * **Push Notification 2FA (Premium)** — approve the login from your phone with 
   one tap, no code to type.

The miniOrange **2-Factor Authentication** plugin adds an additional layer of security
to WordPress logins by requiring users to verify their identity using a second authentication
factor. Even if a password is compromised, unauthorized users cannot access accounts
without completing the **2FA** verification process.

The **2FA** plugin supports multiple **Two-Factor Authentication (2FA)** and **Multi-
Factor Authentication (MFA)** methods, including **Google Authenticator**, **Microsoft
Authenticator**, **Authy**, **Passkey**, **Email OTP**, **SMS OTP**, **WhatsApp 
OTP**, **Telegram OTP**, **Push Notification**, backup codes, security questions,
and hardware token authentication.

Whether you manage a **WooCommerce** store, membership website, LMS platform, enterprise
portal, educational institution, government website, or agency-managed environment,**
WordPress 2FA** helps secure user accounts and reduce the risk of account compromise.

The **free** plan supports **unlimited users** with Google Authenticator (TOTP),**
Passkey**, Email OTP, and Security Questions. **Premium** adds more 2FA methods (
SMS OTP, WhatsApp OTP, **Push Notification**, email verification link, and more),
enforcement policies, trusted devices, multisite support, custom branding, and more.

### Why Use (2FA) Two-Factor Authentication for WordPress?

**Protect Administrator Accounts**
 Administrator accounts are the primary target
of attackers. **WordPress Two-Factor Authentication (2FA)** ensures that only verified
users can access administrative dashboards.

**Prevent Unauthorized Access**
 Even if passwords are stolen through phishing attacks
or data breaches, additional **authentication** requirements help prevent unauthorized
access.

**Improve WordPress Login Security**
 **WordPress MFA** strengthens login security
by combining passwords with additional verification methods.

**Reduce Account Takeover Risks**
 **Multi-factor authentication** significantly
reduces the likelihood of successful account takeover attempts.

**Secure WooCommerce Customer Accounts**
 Protect customer profiles, order information,
payment details, and store management accounts using **WooCommerce Two-Factor Authentication(
2FA)**.

Quick Links:
 [Setup Guide](https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication)
| [Features](https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa)
| [Pricing Plans](https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#pricing)
| [Support](https://faq.miniorange.com/)

### WordPress 2FA Plugin Explained in Minutes

### Passkey 2FA — Free

**Passkey** replaces the password with a cryptographic key stored on the user’s 
device. Nothing is typed, so nothing can be phished — making Passkey one of the 
strongest **2FA** methods available today, and it’s free in this plugin.

 * Register a **Passkey** from the user profile in seconds
 * Works with Face ID, Touch ID, Windows Hello, and Android biometrics
 * Works with hardware security keys such as YubiKey, Titan, and SoloKey
 * Use **Passkey** as passwordless login or as the second **2FA** step
 * Multiple passkeys per user, with backup codes as fallback
 * No external calls — **Passkey** verification happens entirely on your own site

### Push Notification 2FA — Premium

**Push Notification 2FA** sends a login approval request directly to the user’s 
phone. They tap Approve and the login completes — no six-digit code, no SMS delay,
no copy-paste. It’s one of the fastest **2FA** methods for teams that log in many
times a day.

### WordPress 2FA Core Features

miniOrange provides comprehensive **WordPress Two-Factor Authentication (2FA)** 
and **Multi-Factor Authentication** capabilities for websites of all sizes.

### Google Authenticator and OTP Authentication for WordPress

Secure WordPress logins using multiple **2FA** authentication methods:

 * **Google Authenticator** (TOTP-based 2FA)
 * **Passkey** Authentication (WebAuthn/FIDO2, passwordless & phishing-resistant)
 * **Email OTP** Verification
 * Security Questions (KBA)
 * Backup Codes
 * **Microsoft Authenticator** _(Premium)_
 * **Authy Authenticator** _(Premium)_
 * **LastPass Authenticator** _(Premium)_
 * **SMS OTP** Verification _(Premium)_
 * **WhatsApp OTP** Authentication _(Premium)_
 * **Telegram OTP** Authentication _(Premium)_
 * **Push Notification** Authentication _(Premium)_
 * Email Verification Link _(Premium)_
 * Hardware Token Authentication _(Premium)_

### WordPress MFA Policies and User Authentication

 * Enforce **2FA** for all users
 * Role-based **authentication** policies
 * User-specific **MFA** settings
 * Trusted device support
 * Grace period configuration
 * Backup authentication methods
 * Force **2FA** setup on login

### WooCommerce Two-Factor Authentication (2FA)

Protect WooCommerce stores with enhanced login **security** and customer account
protection.

 * Secure customer accounts with **WooCommerce 2FA**
 * Protect store managers and administrators
 * Improve customer **WooCommerce login security**
 * Compatible with WooCommerce login and account pages

### Passwordless Login for WordPress

Allow users to securely access WordPress without traditional passwords.

 * **Passkey** passwordless login
 * Magic Link Login
 * OTP Login (without password)
 * Email Verification Login

### Login Security and Account Protection

Improve overall **WordPress login security** using advanced authentication controls.

 * Secure user verification
 * Trusted device management
 * Backup authentication options
 * Account recovery methods
 * Strong access control policies
 * Login reports & IP alerts
 * Custom redirects after login
 * Custom SMS gateway integration _(Premium)_
 * Custom branding & white labeling _(Premium)_
 * Multisite support _(Premium)_

### Works with Popular WordPress Plugins

Compatible with:
 – WooCommerce – Elementor – Ultimate Member – BuddyPress – Theme
My Login – LoginPress – Custom login forms

### Free vs Premium

**Free** — unlimited users, **Passkey**, **Google Authenticator** (and other TOTP
apps), **Email OTP**, backup codes, security questions, role-based **2FA**, **WooCommerce
2FA**, passwordless login.

**Premium** — **Push Notification 2FA**, **SMS OTP**, **WhatsApp OTP**, **Telegram
OTP**, hardware tokens, trusted devices, custom SMS gateway, custom branding & white-
labelling, multisite **2FA**, advanced reporting.

### External Services

Some **2FA** methods require communication with miniOrange services to send or verify
OTP, SMS, email, push, or account-related requests. These services are used only
when you configure or use the related **2FA** method.

**Passkey** and **Google Authenticator** (TOTP) are verified entirely on your own
site and make no external calls.

Service links:
 [miniOrange Terms](https://www.miniorange.com/usecases/miniOrange_User_Agreement.pdf)
| [miniOrange Privacy Policy](https://www.miniorange.com/privacypolicy)

## Screenshots

[⌊WordPress Two-Factor (2FA) Authentication Dashboard⌉⌊WordPress Two-Factor (2FA)
Authentication Dashboard⌉[

WordPress Two-Factor (2FA) Authentication Dashboard

[⌊Google Authenticator setup as Two-step authentication (2FA)⌉⌊Google Authenticator
setup as Two-step authentication (2FA)⌉[

Google Authenticator setup as Two-step authentication (2FA)

[⌊2-Factor Authentication (2FA) Plugin – Quick Settings⌉⌊2-Factor Authentication(
2FA) Plugin – Quick Settings⌉[

2-Factor Authentication (2FA) Plugin – Quick Settings

[⌊Reset User 2FA configuration from the 2FA Plugin⌉⌊Reset User 2FA configuration
from the 2FA Plugin⌉[

Reset User 2FA configuration from the 2FA Plugin

[⌊Custom Email Templates – Whitelabelling with your Brand | WP 2FA⌉⌊Custom Email
Templates – Whitelabelling with your Brand | WP 2FA⌉[

Custom Email Templates – Whitelabelling with your Brand | WP 2FA

[⌊Two-Factor setup for SMS Verification with OTP (WP 2FA Plugin)⌉⌊Two-Factor setup
for SMS Verification with OTP (WP 2FA Plugin)⌉[

Two-Factor setup for SMS Verification with OTP (WP 2FA Plugin)

[⌊Test WP 2FA Plugin⌉⌊Test WP 2FA Plugin⌉[

Test WP 2FA Plugin

## Instalacija

#### Install and Configure WordPress Two-Factor Authentication

**Step 1: Install the WordPress 2FA Plugin**

 1. Go to Plugins  Add New
 2. Search for **miniOrange 2FA** or **Two Factor Authentication**
 3. Click Install and then Activate the plugin
 4. Navigate to the miniOrange **2FA** settings page from the WordPress dashboard

**Step 2: Configure Google Authenticator or OTP Authentication**

 1. Select your preferred **2FA** method — **Google Authenticator**, **Microsoft Authenticator**,**
    Email OTP**, **SMS OTP**, **WhatsApp OTP**, or **Telegram OTP**
 2. Complete the verification process and configure your **two-factor authentication**
    settings
 3. Test your **WordPress Two-Factor Authentication** setup

**Step 3: Configure WordPress MFA Policies**

 1. Enable **Multi-Factor Authentication** for administrators, editors, customers, 
    or other WordPress user roles
 2. Configure role-based **authentication** policies, trusted devices, and backup **
    2FA** methods
 3. Enforce **WordPress 2FA** policies across your website

**Step 4: Configure WooCommerce Two-Factor Authentication** _(optional)_

 1. Protect WooCommerce customers, store managers, and administrators with additional**
    2FA** verification
 2. Enable **passwordless login** (Magic Link, Email Verification, or OTP Login) if
    needed

## FAQ

### What is WordPress Two-Factor Authentication?

**WordPress Two-Factor Authentication (2FA)** is a login security mechanism that
requires users to provide two forms of identity verification before access is granted.
The miniOrange **2FA** plugin integrates **multi-factor authentication** directly
into the WordPress login process, supporting **Passkey**, **Google Authenticator**,**
Email OTP**, **SMS OTP**, **WhatsApp OTP**, **Telegram OTP**, and more.

### Does this plugin support Google Authenticator?

Yes. The plugin fully supports **Google Authenticator** and all TOTP-based authenticator
apps, including **Microsoft Authenticator**, **Authy**, and **LastPass Authenticator**.

### Does this 2FA plugin support Microsoft Authenticator?

Yes. The plugin supports **Microsoft Authenticator** and any TOTP-compatible authenticator
app for **WordPress two-factor authentication**.

### Can I enforce 2FA for all users?

You can choose which roles should require **2FA** and which accounts must complete
setup. The **free** plan supports **unlimited users** completing setup with Google
Authenticator, Passkey, Email OTP, or Security Questions. **Premium** adds more 
2FA methods along with trusted devices, stronger enforcement, and multisite support.

### Does this plugin support Passkey login?

Yes. **Passkey** authentication is available in the **free** version, letting users
sign in using device biometrics (fingerprint, face recognition) or security keys
based on the WebAuthn/FIDO2 standard. It provides a fast, passwordless, and phishing-
resistant **2FA** experience.

### Does this plugin support Push Notification authentication?

Yes, as a **premium** **2FA** method. Users simply approve or deny a **push notification**
sent to their registered mobile device to complete login, without manually entering
an OTP.

### Can I enable 2FA for administrators only?

Yes. The plugin supports role-based **authentication** policies, allowing you to
enforce **2FA** exclusively for administrators, editors, or any specific WordPress
user role.

### How do I add 2FA to WordPress?

Install and activate this plugin, open the miniOrange **2FA** dashboard, choose 
which users or roles should use **two-factor authentication**, and select a method(**
Google Authenticator**, **Email OTP**, **SMS OTP**, and more). The built-in setup
wizard walks you through each configuration step.

### Is WordPress 2FA free with this plugin?

Yes. The free plan supports **unlimited users** with Google Authenticator, Passkey,
Email OTP, and Security Questions. **Premium** unlocks more 2FA methods (SMS, WhatsApp,
Push Notification, email verification link, and more) plus trusted devices, custom
branding, multisite support, and other advanced **authentication** options.

### Does this plugin support WooCommerce Two-Factor Authentication?

Yes. You can protect **WooCommerce** login and related flows so customers and shop
staff complete **2FA** verification wherever you enable it. Full **WooCommerce Two-
Factor Authentication** is supported.

### Does this plugin support WhatsApp OTP Authentication?

Yes. **WhatsApp OTP authentication** is available as a premium **2FA** method. Users
receive a one-time password via WhatsApp to complete the **two-factor authentication**
process.

### Does this 2FA plugin support Passwordless Login?

Yes. The plugin supports **passwordless login** for WordPress, including Magic Link
Login, **Email OTP** login, and other verification-based login flows that do not
require a traditional password.

### What is the difference between Two-Factor Authentication and Multi-Factor Authentication?

**Two-Factor Authentication (2FA)** uses exactly two verification factors: typically
a password plus one additional factor. **Multi-Factor Authentication (MFA)** uses
two or more factors and is a broader term. The miniOrange plugin supports both **
2FA** and **MFA** configurations for WordPress.

### What if I get locked out?

You can use backup codes, the email verification recovery option, or disable the
plugin via FTP to regain access.

### Is my 2FA data sent to miniOrange’s servers?

Not for every method. **Passkey (WebAuthn/FIDO2)** and the **Authenticator app (
TOTP)** are verified entirely on your own site — no data is sent to miniOrange for
these two methods. SMS, WhatsApp, Telegram, and Push Notification (Premium methods)
route through miniOrange’s service, since delivering an SMS, chat message, or push
notification requires it.

### How do you handle security vulnerability reports?

Every fixed security issue is listed in this plugin’s changelog, including the version
it shipped in. If you believe you’ve found a vulnerability, please report it privately
to mfasupport@xecurify.com (subject: „Security“) rather than disclosing it publicly,
so it can be investigated and patched first.

### Can I require 2FA for my WooCommerce staff without slowing down checkout for customers?

Yes. The **Quick Setup** screen includes a one-click „Protect Staff, Not Shoppers“
preset when WooCommerce is active — it selects Administrator, Editor, Author, and
Shop Manager for **2FA**, and leaves the Customer role unchecked so checkout stays
frictionless. You can still enable it for customers manually if your store needs
that.

### How does miniOrange 2FA compare to Wordfence’s built-in two-factor authentication?

Wordfence bundles a basic TOTP/Passkey **2FA** option inside its full security suite(
firewall, malware scanning, and more). miniOrange is a **2FA** specialist: it supports
more methods out of the box (Passkey, Authenticator app, Email OTP, Security Questions
free; SMS, WhatsApp, Telegram, Push Notification, and hardware tokens on Premium)
without the overhead of a bundled firewall or scanner.

### How does miniOrange 2FA compare to WP 2FA?

Both are focused, single-purpose **2FA** plugins. miniOrange supports a wider range
of verification methods — including SMS, WhatsApp, Telegram, Push Notification, 
and hardware tokens on Premium — plus a dedicated WooCommerce „Protect Staff, Not
Shoppers“ role preset.

### I’m moving away from Solid Security (formerly iThemes Security) or Kadence Security — will this cover what I need?

For **two-factor authentication** specifically, yes: role-based enforcement, per-
role grace periods with per-role actions (enforce vs. block), backup codes, and 
account-recovery options are all available without bundling an unrelated site-builder
or firewall suite.

## Reviews

![](https://secure.gravatar.com/avatar/3ae68b453ebff6ea387a92c46bf9c1117779fe5a5b2cfc1c78e5bb6ee692e275?
s=60&d=retro&r=g)

### 󠀁[Great MiniOrange Customer Support](https://wordpress.org/support/topic/great-miniorange-customer-support/)󠁿

 [blakeandrew](https://profiles.wordpress.org/blakeandrew/) 18. septembra 2026

Anuradha helped me greatly getting the plugin working to perfection!

![](https://secure.gravatar.com/avatar/a8891756ba7021706e52f976a31078f8dbf1cfd006f4176cb0fbcbb73b250200?
s=60&d=retro&r=g)

### 󠀁[Excellent plugin, easy to use!](https://wordpress.org/support/topic/excellent-plugin-easy-to-use-41/)󠁿

 [magdalion](https://profiles.wordpress.org/magdalion/) 1. septembra 2026

Excellent security plugin, very easy to use and the support is right on the spot!
🙂

![](https://secure.gravatar.com/avatar/190dabfa9cb6f9542a43931dda00218bc05a6087fc96eb31877668a2fc471af5?
s=60&d=retro&r=g)

### 󠀁[Support Help from miniOrange](https://wordpress.org/support/topic/support-help-from-miniorange/)󠁿

 [abgallery](https://profiles.wordpress.org/abgallery/) 2. junija 2026 1 reply

Abhiraj Pratap Singh was very helpful and very patient. We appreciate the time that
was spent with us to solve the 2FA issue.

![](https://secure.gravatar.com/avatar/373c02d4c8c788b2a55734137535cfdc3f042f894a6ee23ce8b64f45e3afee3e?
s=60&d=retro&r=g)

### 󠀁[Great plugin and technical support](https://wordpress.org/support/topic/great-plugin-and-technical-support-6/)󠁿

 [victornunez](https://profiles.wordpress.org/victornunez/) 20. maja 2026 1 reply

It works exactly as described; the free version is brilliant, but if you need to
be able to control more aspects—as is the case for me—the paid version is well worth
it. What’s more, their customer support is fantastic; they respond very quickly 
to any queries or issues you might have. Highly recommended—for me, it’s now an 
absolute must-have. Well done to the developers.

![](https://secure.gravatar.com/avatar/f3a32731af9ed8f5a9d09505596b261037aaab047e4f45ec16329fb0b7189fca?
s=60&d=retro&r=g)

### 󠀁[Great plugin and customer support](https://wordpress.org/support/topic/great-plugin-and-customer-support-36/)󠁿

 [qlemar06](https://profiles.wordpress.org/qlemar06/) 11. měrca 2026

Anuradha has been great at assisting us with the plugin setup and answering our 
questions promptly. Everything is working as expected and the customer service is
top notch. Thank you again!

![](https://secure.gravatar.com/avatar/7c897312c0c45533a2cf383f0c0d588d2e474fcab596c189e9bfe09dacb1e0ff?
s=60&d=retro&r=g)

### 󠀁[Customer service/support is just… WOW](https://wordpress.org/support/topic/customer-service-support-is-just-wow/)󠁿

 [dreizinreport](https://profiles.wordpress.org/dreizinreport/) 19. nowembra 2025

My paywalled weblog was hacked and nearly wrecked.  At which point, I realized that
I needed to trim down on the paths in (too many different intermediary login options),
as well as to prevent “brute force” and to ward off anonymous scumbags and their
throwaway/fake email addresses, by way of 2FA. The guys at miniOrange patiently 
worked with me to integrate 2FA while overcoming the longtime technical debt inherited
from my paywall's creation by a committed but totally non-professional (and long
gone) webmaster.  At my request, they created a module (which, somehow, they did
not offer previously) to allow for subscriber-initiated changes to an already-selected
2FA OTP delivery method; hopefully this will be of use to many more of their own
customers, going forward.  They are clearly eager to work with their customers for
a bespoke solution, as needed, at a VERY reasonable rate—which is fortunate, as 
my guess is that most solutions will require some custom integration over the base
service fee.  Also, despite the time zone difference, for a U.S. customer they are
quite easy to work with, very flexible and accommodating, in the (U.S. ET) morning
or late evening or both.  I am SO GLAD that I found miniOrange, and I wish them 
continued growth and all possible success!!!

 [ Read all 385 reviews ](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/)

## Sobustatkujuce a wuwijarje

„miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google
Authenticator)“ jo software wótwórjonego žrědła. Slědujuce luźe su pśinosowali k
toś tomu tykacoju.

Sobustatkujuce

 *   [ miniOrange ](https://profiles.wordpress.org/cyberlord92/)
 *   [ twofactor ](https://profiles.wordpress.org/twofactor/)
 *   [ twofactorauthentication ](https://profiles.wordpress.org/twofactorauthentication/)
 *   [ Google Authenticator ](https://profiles.wordpress.org/hsn97/)

[Translate “miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)” into your language.](https://translate.wordpress.org/projects/wp-plugins/miniorange-2-factor-authentication)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/miniorange-2-factor-authentication/),
check out the [SVN repository](https://plugins.svn.wordpress.org/miniorange-2-factor-authentication/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/miniorange-2-factor-authentication/)
by [RSS](https://plugins.trac.wordpress.org/log/miniorange-2-factor-authentication/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 6.4.0

 * New: Magic Link Login — a passwordless „email me a login link“ option at wp-login.
   php, with Off / Optional / Mandatory modes.
 * New: Trusted Devices (free) — a recognized browser skips repeat 2FA prompts for
   7 days after a successful challenge.
 * New: Recent Logins panel — self-service login history (date, IP, success/failure)
   on each user’s own profile.
 * New: 2FA Adoption dashboard widget showing how many required users have 2FA configured.
 * New: Optional 2FA setup reminder emails for users who are required to set up 
   2FA but haven’t yet.
 * New: Security alert email sent to a user when their 2FA method is changed, or
   reset by an admin.
 * New: „Protect Staff, Not Shoppers“ one-click WooCommerce role preset on the Quick
   Setup screen (Administrator, Editor, Author, Shop Manager; Customer left unchecked).
 * New: Optional security note on the WooCommerce My Account dashboard, shown only
   when WooCommerce is active.
 * New: Per-role grace periods, and a per-role action (enforce vs. block) for when
   a role’s grace period expires, in addition to the existing site-wide default.
 * New: Compliance Log report under Reports — records admin-initiated 2FA resets(
   who, whom, when) for PCI DSS / GDPR / cyber-insurance documentation. Export is
   a Premium feature.
 * Improvement: Plugin emails (OTP, verification links, backup codes, setup reminders,
   and more) now send through miniOrange’s cloud relay instead of the site’s local
   SMTP, so delivery no longer depends on the site having SMTP configured.
 * Improvement: Redesigned admin UI — the 2FA Configurations screen is now split
   into focused Access Rules, Login Experience, Methods, Notifications, and Advanced
   pages with WordPress-native styling.
 * Improvement: Backup codes are now generated and validated locally instead of 
   via a remote service call.
 * Security: Closed a gap where the free plugin’s SMS and Email-Verification-Link
   methods could be used on the backend despite being premium-locked in the UI.
 * Security: Fixed missing rate limiting on backup-code validation, which allowed
   unlimited guesses; it now uses the same account lockout as every other 2FA method.
 * Security: Added rate limiting (a short per-request cooldown, an hourly cap per
   user/IP/destination, and a site-wide daily cap) to every email the plugin sends
   on demand — OTP over email, backup-code resends, and account-recovery link resends—
   so none of them can be used to spam a user’s inbox or exhaust the site’s email
   quota.
 * Security: Fixed a sanitization-ordering bug where a request URL was written to
   the audit log before, not after, being passed through esc_url_raw().
 * Security: Added a missing capability check on the setup-wizard „skip“ action,
   which was reachable by an unauthenticated visitor via the nonce embedded in the
   public login-challenge popup.
 * Security: Removed a minor information disclosure where the account-recovery email
   failure message differed depending on whether the target account could manage_options.

#### 6.3.2

 * Security fixes and improvements.

#### 6.3.1

 * Fixed unauthenticated arbitrary WordPress option deletion via the email-verification
   link handler.
 * Fixed 2FA attempt-lockout bypass (client-controlled counter) and added missing
   rate limiting to the 2FA configuration-validation endpoint.

#### 6.3.0

 * Compatibility with WordPress 7.1

#### 6.2.9

 * Free 2FA now supports **unlimited users** completing two-factor authentication
   setup.
 * Introduced **Passkey** as a new 2FA method in the free version.
 * Introduced **Push Notification** as a new premium 2FA method.
 * Performance optimizations across the 2FA plugin.

#### 6.2.8

 * Bug fixes for TOTP method and KBA method
 * Minor bug fixes and improvements.

#### 6.2.7

 * Added rate limiting
 * other bug fixes

#### 6.2.6

 * Readme changes.
 * Security fixes.

#### 6.2.5

 * Increased the free 2FA setup limit so up to **5 users** can complete two-factor
   authentication configuration.
 * Updated account recovery email behavior so the recovery link can be sent without
   checking remaining email transactions.
 * UI Improvements in 2FA plugin.
 * 2FA plugin readme changes.
 * Compatibility with WordPress 7.0

#### 6.2.4

 * Bug fixes in WP 2FA plugin
 * Readme updates in 2FA plugin

#### 6.2.3

 * Readme updates in 2FA plugin

#### 6.2.2

 * Readme updates in 2FA plugin

#### 6.2.1

 * Security fixes in 2FA plugin
 * Readme updates in 2FA plugin

#### 6.2.0

 * UI Updates – 2FA Settings

#### 6.1.7

 * Minor Fixes – 2FA User Profile

#### 6.1.5

 * Security fixes in 2FA plugin
 * Code optimization changes

#### 6.1.4

 * Bug fixes – 2FA login flow
 * Code optimization changes in WP 2FA

#### 6.1.3

 * Vulnerability fixes – Admin XSS/MITM risk via IP Lookup

#### 6.1.2

 * Vulnerability fixes – Broken Access Control

#### 6.1.1

 * Vulnerability fixes – Session Hijacking & Replay Attack (Google Authentication)

#### 6.1.0

 * UI/UX Improvements – 2FA popups
 * Vulnerability fixes – 2FA Bypass and Weak Question & Answer Validation (KBA)
 * Bug fixes – Low Transactions Notice
 * Added Debug Log Feature
 * Setup Guides Links added in Forms tab
 * Code optimization in 2FA plugin

#### 6.0.9

 * Bug fixes – 2FA Backup Code Validation

#### 6.0.8

 * Compatibility with WordPress 6.8
 * Bug fixes – 2FA Login Transaction Report

#### 6.0.7

 * UI/UX Improvements – miniOrange user Login & Registration form | Sync Transactions
   button
 * Bug fixes – Login Report feature
 * Updates – Users‘ 2FA Status table | .pot file

#### 6.0.6

 * Improvements – 2FA admin dashboard UI/UX
 * Auto file inclusion added
 * Added separate tab for 2FA reports
 * Updated Email Verification popup

#### 6.0.5

 * Updated Button CSS
 * Updated Custom Logo Branding on 2FA Popup Settings UI
 * General CSS Improvements
 * 2FA Pricing Page Removed

#### 6.0.4

 * Improvement – Updated Login Transaction Report UX
 * 2FA Pricing Plan updates

#### 6.0.3

 * Bug fixes – Google Authentication CSS-JS loading issue in login

#### 6.0.2

 * Setup Wizard flow changes
 * Bug fix in Setup Wizard flow

#### 6.0.1

 * Bug fixes for UI/UX 2FA plugin release

#### 6.0.0

 * Updated UI/UX of the 2FA plugin
 * Added configuration for customizations of all email templates
 * Added 2FA reconfiguration link via email as backup method
 * Added Custom Redirect URL after login
 * Extended grace period functionality
 * Removed miniOrange and DUO Authenticator 2FA methods

#### 5.8.4

 * Updated jquery jquery.dataTables.min.js version to the latest version
 * Bug fixes – Getting error on user account creation on WooCommerce

#### 5.8.3

 * Compatibility with WordPress 6.5
 * Fixed redirection issue on activation with WordPress 6.5
 * Changed refund Policy link
 * Updated miniOrange portal links

#### 5.8.2

 * Bug fix – Log out the users when the grace period is enabled
 * Improvement – Added SMTP checks for email verification
 * Improvement – Updated UX for Email Verification method
 * Fixed – Warnings in the error logs in 2FA

#### 5.8.1

 * Bug fix – Show backup codes to users after configuring Email Verification
 * Updated UI for Google Authenticator user configuration screens
 * Updated UI of Setup Wizard

#### 5.8

 * Bug fix – 2FA method was getting updated when updating a user on the user-edit
   page
 * Updated UI for OTP over SMS, OTP over Email and OTP over Telegram configuration
   screens
 * Added Email Verification method

#### 5.7.5

 * Compatibility with WordPress 6.4

#### 5.7.4

 * Bug fix – Keep end users‘ 2FA configuration when the plugin is deactivated
 * Bug fix – Attempts left for the OTP-based methods
 * Bug fix – Display App Key for Google Authenticator in 2FA inline registration

#### 5.7.3

 * Bug fixes for registration forms
 * Compatibility with WordPress 6.3

#### 5.7.2

 * Updated flow of 2FA on registration form
 * Minor bug fixes

#### 5.7.1

 * Fixes: User can configure/reconfigure/reset cloud method, SMS transactions credited
   on registration, fixed email sync issue
 * Added: Resend OTP button – SMS, Telegram, Email OTP method
 * Improvement: Forced reconfiguration after backup code login, 2FA prompt if TOTP
   is unset for admins

For older changelog entries, please see the [additional changelog.txt file](https://plugins.svn.wordpress.org/miniorange-2-factor-authentication/trunk/changelog.txt)
provided with the plugin.

## Meta

 *  Version **6.4.0**
 *  Last updated **5 dnjow**
 *  Active installations **10.000+**
 *  WordPress version ** 5.3.0 abo nowša **
 *  Tested up to **7.1.2**
 *  PHP version ** 5.3.0 abo nowša **
 *  Language
 * [English (US)](https://wordpress.org/plugins/miniorange-2-factor-authentication/)
 * Tags
 * [2FA](https://dsb.wordpress.org/plugins/tags/2fa/)[authentication](https://dsb.wordpress.org/plugins/tags/authentication/)
   [MFA](https://dsb.wordpress.org/plugins/tags/mfa/)[security](https://dsb.wordpress.org/plugins/tags/security/)
   [two factor authentication](https://dsb.wordpress.org/plugins/tags/two-factor-authentication/)
 *  [Rozšyrjony naglěd](https://dsb.wordpress.org/plugins/miniorange-2-factor-authentication/advanced/)

## Pógódnośenja

 4.5 out of 5 stars.

 *  [  329 5-star reviews     ](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/?filter=5)
 *  [  14 4-star reviews     ](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/?filter=4)
 *  [  2 3-star reviews     ](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/?filter=3)
 *  [  4 2-star reviews     ](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/?filter=2)
 *  [  36 1-star reviews     ](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/?filter=1)

[Your review](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/)

## Sobustatkujuce

 *   [ miniOrange ](https://profiles.wordpress.org/cyberlord92/)
 *   [ twofactor ](https://profiles.wordpress.org/twofactor/)
 *   [ twofactorauthentication ](https://profiles.wordpress.org/twofactorauthentication/)
 *   [ Google Authenticator ](https://profiles.wordpress.org/hsn97/)

## Pódpěra

Got something to say? Need help?

 [Forum pomocy pokazaś](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/)