FactorGuard – Two-Factor Authentication

FactorGuard is a lightweight, privacy-first Two-Factor Authentication (2FA) plugin for WordPress. It adds a rock-solid two-step verification layer to the default WordPress login page — without relying on any external cloud service or third-party API.

After a user enters the correct username and password, they must complete a second step: enter a one-time code sent to their email or use a time-based code from an authenticator app like Google Authenticator or Authy.

🔒 Zero external API calls. All verification happens on your own server.

Core Features:

• ⚡ Email OTP — send a one-time passcode to the user’s registered email address
• 📱 Authenticator App (TOTP) — full RFC 6238 support for Google Authenticator, Authy, Microsoft Authenticator, and any TOTP-compatible app
• 🔑 One-time backup codes — hashed recovery codes so users never get locked out
• 🔐 Military-grade encryption — TOTP secrets encrypted at rest using libsodium XSalsa20-Poly1305
• 🚫 Replay attack protection — accepted TOTP codes are invalidated for the current time-slice
• ⏱️ Brute force & rate limiting — configurable lockout after too many failed attempts
• 🎛️ Flexible settings — OTP code length (4–10 digits), code expiry (1–60 min), lockout duration
• 🧙 Setup wizard — guided onboarding to configure your preferred 2FA method in minutes
• 🌐 API-safe — automatically bypasses OTP for REST API and XML-RPC requests
• 🌍 Translation ready — fully internationalised and .pot file included
• 🧹 Clean uninstall — removes all plugin data on uninstall (opt-in)

How It Works – Email OTP

1. User enters their username and password on the login page
2. If credentials are correct and OTP is enabled, a verification code is emailed to the user
3. The login form shows an OTP input field (username/password fields are hidden)
4. User enters the code sent to their email
5. On success, login completes. On failure, the attempt is counted toward the lockout limit

How It Works – TOTP (Authenticator App)

1. Site admin enables TOTP under Settings > FactorGuard
2. Each user visits their Profile page and scans the QR code with their authenticator app
3. Users enter the 6-digit code shown in their app to activate TOTP on their account
4. On subsequent logins, the login form asks for the current authenticator app code instead of sending an email