Title: FactorGuard – Two-Factor Authentication Author: Usman Ali Qureshi Published: Agosto 31, 2026 Last modified: Agosto 31, 2026 --- Search plugins ![](https://ps.w.org/factorguard/assets/banner-772x250.png?rev=3674744) ![](https://ps.w.org/factorguard/assets/icon.svg?rev=3674628) # FactorGuard – Two-Factor Authentication By [Usman Ali Qureshi](https://profiles.wordpress.org/usmanaliqureshi/) [Download](https://downloads.wordpress.org/plugin/factorguard.1.0.0.zip) * [Details](https://ceb.wordpress.org/plugins/factorguard/#description) * [Reviews](https://ceb.wordpress.org/plugins/factorguard/#reviews) * [Installation](https://ceb.wordpress.org/plugins/factorguard/#installation) * [Development](https://ceb.wordpress.org/plugins/factorguard/#developers) [Support](https://wordpress.org/support/plugin/factorguard/) ## Description **FactorGuard** is a lightweight, privacy-first Two-Factor Authentication (2FA) plugin for WordPress. It adds a rock-solid two-step verification layer to the default WordPress login page — without relying on any external cloud service or third-party API. After a user enters the correct username and password, they must complete a second step: enter a one-time code sent to their email **or** use a time-based code from an authenticator app like Google Authenticator or Authy. > 🔒 **Zero external API calls. All verification happens on your own server.** **Core Features:** * ⚡ **Email OTP** — send a one-time passcode to the user’s registered email address * 📱 **Authenticator App (TOTP)** — full RFC 6238 support for Google Authenticator, Authy, Microsoft Authenticator, and any TOTP-compatible app * 🔑 **One-time backup codes** — hashed recovery codes so users never get locked out * 🔐 **Military-grade encryption** — TOTP secrets encrypted at rest using libsodium XSalsa20-Poly1305 * 🚫 **Replay attack protection** — accepted TOTP codes are invalidated for the current time-slice * ⏱️ **Brute force & rate limiting** — configurable lockout after too many failed attempts * 🎛️ **Flexible settings** — OTP code length (4–10 digits), code expiry (1–60 min), lockout duration * 🧙 **Setup wizard** — guided onboarding to configure your preferred 2FA method in minutes * 🌐 **API-safe** — automatically bypasses OTP for REST API and XML-RPC requests * 🌍 **Translation ready** — fully internationalised and `.pot` file included * 🧹 **Clean uninstall** — removes all plugin data on uninstall (opt-in) #### How It Works – Email OTP 1. User enters their username and password on the login page 2. If credentials are correct and OTP is enabled, a verification code is emailed to the user 3. The login form shows an OTP input field (username/password fields are hidden) 4. User enters the code sent to their email 5. On success, login completes. On failure, the attempt is counted toward the lockout limit #### How It Works – TOTP (Authenticator App) 1. Site admin enables TOTP under Settings > FactorGuard 2. Each user visits their Profile page and scans the QR code with their authenticator app 3. Users enter the 6-digit code shown in their app to activate TOTP on their account 4. On subsequent logins, the login form asks for the current authenticator app code instead of sending an email ## Screenshots [⌊General settings for email OTP length, expiry, rate limiting, and lockout behavior.⌉⌊ General settings for email OTP length, expiry, rate limiting, and lockout behavior .⌉[ General settings for email OTP length, expiry, rate limiting, and lockout behavior. [⌊Authenticator App settings with profile enrollment guidance for QR-code setup.⌉⌊ Authenticator App settings with profile enrollment guidance for QR-code setup.⌉[ Authenticator App settings with profile enrollment guidance for QR-code setup. [⌊FactorGuard setup wizard for choosing the site's two-factor verification method.⌉⌊ FactorGuard setup wizard for choosing the site's two-factor verification method.⌉[ FactorGuard setup wizard for choosing the site’s two-factor verification method. [⌊User profile two-factor section showing active authenticator status and backup- code controls.⌉⌊User profile two-factor section showing active authenticator status and backup-code controls.⌉[ User profile two-factor section showing active authenticator status and backup-code controls. ## Installation 1. Upload the `factorguard` folder to the `/wp-content/plugins/` directory 2. Activate the plugin through the ‘Plugins’ menu in WordPress 3. Go to Settings > FactorGuard to configure the plugin 4. Make sure your WordPress site can send emails (test with a password reset if unsure) #### Privacy and External Services FactorGuard performs OTP and authenticator app verification locally on your WordPress site. It does not send verification codes, authentication secrets, site data, or user data to a FactorGuard service. Email OTP messages are sent through WordPress using `wp_mail()`. Your site’s configured mail delivery provider may process those emails according to that provider’s terms and privacy policy. QR codes for authenticator app setup are generated locally using libraries bundled with the plugin. No external QR code API is contacted. The bundled TOTP library includes optional remote provider classes, but FactorGuard initializes only the local QR provider and does not use those remote providers. #### Recovery Notice Before forcing two-factor authentication for all users, confirm that at least one administrator has a working verification method, has generated backup codes, and can access those codes if email delivery or an authenticator app is unavailable. ## FAQ ### Does this work with custom login forms? FactorGuard hooks into the default WordPress login page at `/wp-login.php`. For custom login forms, developers can use the `factorguard_bypass` filter to control the behavior programmatically. ### Does this affect REST API or XML-RPC authentication? No. The plugin automatically detects API requests and skips OTP verification for them. Application passwords and other API authentication methods continue to work normally. ### What if the email doesn’t arrive? If the email fails to send, the user will see an error message and can try logging in again to trigger a new email. Check your WordPress email delivery settings if this persists. ### Does FactorGuard contact external services? No. FactorGuard does not contact a FactorGuard server or any third-party API during normal operation. Email delivery is handled by your WordPress site’s configured mail system. ### What should I do before forcing two-factor authentication for all users? Verify that your administrator account can complete login with the selected method, confirm that WordPress email delivery works, and generate backup codes from your WordPress profile. ### Where do users scan the authenticator app QR code? After an administrator enables Authenticator App support under Settings > FactorGuard, each user can enroll from their WordPress profile page. The profile screen shows the QR code, manual setup key, confirmation field, and backup-code controls. ### Can I exclude specific users from OTP? Yes. Use the `factorguard_user_can_bypass` filter. Example: `add_filter( 'factorguard_user_can_bypass',' __return_true' );` to bypass for all users, or check user roles/capabilities in your callback. ### Does TOTP require any server extensions? TOTP setup requires the PHP libsodium extension so FactorGuard can encrypt authenticator app secrets at rest. FactorGuard will not create new authenticator app enrollments if secrets cannot be encrypted. QR codes are generated locally using bundled libraries, and no external QR code API is needed. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “FactorGuard – Two-Factor Authentication” is open source software. The following people have contributed to this plugin. Contributors * [ Usman Ali Qureshi ](https://profiles.wordpress.org/usmanaliqureshi/) [Translate “FactorGuard – Two-Factor Authentication” into your language.](https://translate.wordpress.org/projects/wp-plugins/factorguard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/factorguard/), check out the [SVN repository](https://plugins.svn.wordpress.org/factorguard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/factorguard/) by [RSS](https://plugins.trac.wordpress.org/log/factorguard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release with email OTP and TOTP (authenticator app) support ## Meta * Version **1.0.0** * Last updated **6 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.6 or higher ** * Tested up to **7.1** * PHP version ** 8.2 or higher ** * Language * [English (US)](https://wordpress.org/plugins/factorguard/) * Tags * [2FA](https://ceb.wordpress.org/plugins/tags/2fa/)[authentication](https://ceb.wordpress.org/plugins/tags/authentication/) [login security](https://ceb.wordpress.org/plugins/tags/login-security/)[otp](https://ceb.wordpress.org/plugins/tags/otp/) [two factor](https://ceb.wordpress.org/plugins/tags/two-factor/) * [Advanced View](https://ceb.wordpress.org/plugins/factorguard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/factorguard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/factorguard/reviews/) ## Contributors * [ Usman Ali Qureshi ](https://profiles.wordpress.org/usmanaliqureshi/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/factorguard/)