BaseCloud

BaseCloud Shield is a lightweight yet powerful security plugin that enforces Two-Factor Authentication (2FA) on your WordPress login page. Unlike other bloat-heavy plugins, BaseCloud Shield focuses on reliability and flexibility in OTP delivery.
Key Features:
<ul>
<li>Plug & Play: Works immediately using standard WordPress email delivery.</li>
<li>Multi-Recipient System: Send OTPs to the logging-in user, a manager email, or selected users.</li>
<li>Multi-Channel Delivery: Choose multiple delivery methods simultaneously (Email, SendGrid, WhatsApp, SMS, Webhook).</li>
<li>WhatsApp Integration: Send OTPs directly via WhatsApp using Twilio API.</li>
<li>SMS Integration: Deliver OTPs via SMS using Twilio API.</li>
<li>SendGrid API V3: Native integration for high-deliverability emails.</li>
<li>Webhook Support: Connect to custom webhooks for advanced automation flows.</li>
<li>Secure OTPs: 6-digit one-time passwords that expire automatically.</li>
<li>Browser Trust: “Remember this device” functionality to reduce friction for authorized users.</li>
<li>Advanced Attack Protection (v1.4.2): Credential stuffing detection, progressive delays, username enumeration protection.</li>
</ul>
<h3>External Services</h3>
This plugin may connect to external third-party services depending on your configuration. Below is a detailed explanation of what services are used, what data is sent, and when:
SendGrid Email API (Optional)
If you select “SendGrid API” as your delivery method in the plugin settings, this plugin will send data to SendGrid’s email service to deliver one-time password (OTP) codes.
<ul>
<li>Service: SendGrid by Twilio</li>
<li>What it’s used for: Sending two-factor authentication codes via email with improved deliverability</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled</li>
<li>Data sent:
<ul>
<li>Recipient email address (user’s email or manager email if configured)</li>
<li>Sender email address (configured in plugin settings)</li>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>6-digit one-time password code</li>
<li>Email subject and HTML body</li>
</ul>
</li>
<li>API Endpoint: https://api.sendgrid.com/v3/mail/send</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/legal/privacy</li>
</ul>
Important: You must have a SendGrid account and API key to use this feature. You are responsible for complying with SendGrid’s terms of service and ensuring proper data handling practices.
Twilio API for WhatsApp & SMS (Optional)
If you select “WhatsApp” or “SMS” as delivery methods, the plugin will send data to Twilio’s API to deliver one-time password codes.
<ul>
<li>Service: Twilio</li>
<li>What it’s used for: Sending two-factor authentication codes via WhatsApp and/or SMS</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled with WhatsApp/SMS selected</li>
<li>Data sent:
<ul>
<li>Recipient phone number (from user meta field ‘billing_phone’)</li>
<li>Sender phone number (WhatsApp number or SMS number configured in settings)</li>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>6-digit one-time password code</li>
<li>Message body</li>
</ul>
</li>
<li>API Endpoint: https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/legal/privacy</li>
</ul>
Important: You must have a Twilio account with WhatsApp and/or SMS capabilities enabled. Phone numbers must be stored in user meta (field: ‘billing_phone’). You are responsible for complying with Twilio’s terms of service.
Custom Webhook (Optional)
If you select “Webhook” as a delivery method, the plugin will send login notification data to a webhook URL you configure.
<ul>
<li>Service: Custom webhook endpoint (configured by you)</li>
<li>What it’s used for: Sending login notifications to external systems for custom processing</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled</li>
<li>Data sent:
<ul>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>User email address</li>
<li>6-digit one-time password code</li>
<li>Recipient information array</li>
<li>Timestamp of login attempt</li>
</ul>
</li>
<li>Endpoint: User-configured webhook URL</li>
</ul>
Important: When using the webhook option, you are responsible for the security and privacy compliance of the endpoint you configure. Ensure your webhook endpoint uses HTTPS and follows proper data protection practices.
Standard WordPress Email (Default)
By default, this plugin uses WordPress’s built-in <code>wp_mail()</code> function, which does not involve any external services unless your WordPress installation is configured to use a third-party SMTP service.

BaseCloud Shield

Enterprise-grade Two-Factor Authentication (2FA) with support for Email, SendGrid API, Webhooks, WhatsApp, and SMS delivery.

miniOrange

twofactorauthentication

twofactor

Google Authenticator

<h3>Two Factor Authentication (2FA) for WordPress</h3>
Secure your WordPress login with powerful Two Factor Authentication (2FA).
miniOrange 2FA plugin protects your website from brute-force attacks, password leaks, and unauthorized access using OTP, SMS, Email, and Authenticator apps like Google Authenticator.
Improve your WordPress login security with multi-factor authentication (MFA) by adding a second verification step after password login. The free plan allows up to 5 users to complete 2FA setup on your site; premium removes that cap and adds advanced enforcement (trusted devices, multisite, branding, and more).
Set up 2FA for WordPress in minutes for admins, editors, and customers where you enable it.
Enable 2FA on standard wp-login, WooCommerce login, and custom login forms—each login can require a second factor for users who have completed setup (subject to your role and user limits on free).
<ul>
<li>Easy setup wizard</li>
<li>Multiple 2FA methods including OTP, SMS, Email, and authenticator apps</li>
<li>Works with WordPress login, WooCommerce login, and many custom login forms</li>
<li>Suitable for blogs, business sites, WooCommerce stores, and enterprise sites</li>
</ul>
Quick Links: 
<a href="https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication" rel="nofollow ugc">Setup Guide</a> | 
<a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa" rel="nofollow ugc">Features</a> | 
<a href="https://faq.miniorange.com/" rel="nofollow ugc">Support</a>
<h3>WordPress 2FA Login Security</h3>
Widely used on WordPress sites to strengthen login authentication and help prevent unauthorized access.
<h3>Why Use Two Factor Authentication (2FA)?</h3>
Passwords alone are not secure anymore.
Adding 2FA to WordPress login: 
– Prevents brute-force attacks 
– Protects against password leaks 
– Secures admin & user accounts 
– Adds an extra verification layer 
– Strengthens overall WordPress login security
<h3>Key Features of miniOrange WordPress 2FA Plugin</h3>
<ul>
<li>Free 2FA for up to 5 users (complete setup per user; premium for unlimited)</li>
<li>Multiple 2FA methods – OTP, SMS, Email, Authenticator Apps </li>
<li>Google Authenticator & TOTP support</li>
<li>Backup login methods (backup codes, email links)</li>
<li>Role-based 2FA enforcement</li>
<li>Step-by-step setup wizard</li>
<li>Custom login form support</li>
<li>WooCommerce & popular plugin compatibility</li>
<li>Login reports & IP alerts</li>
<li>Custom redirects after login</li>
<li>Passwordless login support (OTP login without password)</li>
</ul>
<h3>Supported 2FA Authentication Methods</h3>
<h4>Authenticator Apps (TOTP-based 2FA)</h4>
<ul>
<li>Google Authenticator </li>
<li>Microsoft Authenticator </li>
<li>Authy Authenticator </li>
<li>Duo Authenticator </li>
<li>LastPass Authenticator </li>
</ul>
<h4>OTP-Based Authentication</h4>
<ul>
<li>OTP via Email </li>
<li>OTP via SMS </li>
<li>OTP via WhatsApp (Premium) </li>
<li>OTP via Telegram </li>
<li>Email verification link </li>
<li>Security questions </li>
</ul>
<h3>2FA for WordPress Websites</h3>
Ideal for:
<ul>
<li>WordPress admins securing wp-login </li>
<li>WooCommerce stores protecting customer accounts </li>
<li>Membership websites </li>
<li>LMS / eLearning platforms </li>
<li>Agencies managing client websites </li>
<li>Corporate & enterprise WordPress security </li>
</ul>
<h3>Advanced 2FA Features (Premium)</h3>
<ul>
<li>Enforce 2FA for all users </li>
<li>Trusted devices (remember user devices) </li>
<li>Passwordless login (OTP login) </li>
<li>Role-based policies </li>
<li>Custom branding & white labeling </li>
<li>Multisite support </li>
<li>Custom SMS gateway integration </li>
<li>Session & access control </li>
<li>Force 2FA setup on login </li>
</ul>
<h3>Easy 2FA Setup</h3>
<ol>
<li>Install & activate plugin </li>
<li>Choose users/roles for 2FA </li>
<li>Select authentication method </li>
<li>Done! Your WordPress login is secured </li>
</ol>
<h3>Works with Popular WordPress Plugins</h3>
Compatible with: 
– WooCommerce 
– Elementor 
– Ultimate Member 
– BuddyPress 
– Theme My Login 
– LoginPress 
– Custom login forms
<h3>Why Choose miniOrange 2FA</h3>
miniOrange 2FA provides several authentication methods in one plugin, including OTP, authenticator apps, email verification, SMS, WhatsApp, and Telegram options. It also supports WooCommerce and many custom login forms, helping site owners add 2FA login security across common WordPress login flows.
<h3>External Services</h3>
Some 2FA methods require communication with miniOrange services to send or verify OTP, SMS, email, push, or account-related requests. These services are used only when you configure or use the related 2FA method.
Service links: 
<a href="https://www.miniorange.com/usecases/miniOrange_User_Agreement.pdf" rel="nofollow ugc">miniOrange Terms</a> | 
<a href="https://www.miniorange.com/privacypolicy" rel="nofollow ugc">miniOrange Privacy Policy</a>
<h3>Video Guide</h3>
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/rE-awZZt13Q?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>

miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)

Piyush provided the assistance I needed. the great support team for the free version is also... Very much appreciated!  5 stars are well deserved.

Great plugin with great support

Easy to use and Aswesome support


It's indeed a great plugin, with lot of options for many scenarios. 



One thing that it lacks is customization of the page of OTP, but you can modify /wp-content/plugins/miniorange-2-factor-authentication/controllers/twofa/mo2fa-common-login.php if you know what you're doing (it's just HTML to edit, nothing more).



The plugin have a good documentation and video tutorials, and, a nice thing, a support box right inside the plugin's page to contact support if you need anything.


Great plugin with nice funtionality

Add 2FA to WordPress login with OTP, SMS, Email, and authenticator apps. Free plan supports setup for up to 5 users.

BaseCloud Shield vs miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)