BaseCloud

BaseCloud Shield is a lightweight yet powerful security plugin that enforces Two-Factor Authentication (2FA) on your WordPress login page. Unlike other bloat-heavy plugins, BaseCloud Shield focuses on reliability and flexibility in OTP delivery.
Key Features:
<ul>
<li>Plug & Play: Works immediately using standard WordPress email delivery.</li>
<li>Multi-Recipient System: Send OTPs to the logging-in user, a manager email, or selected users.</li>
<li>Multi-Channel Delivery: Choose multiple delivery methods simultaneously (Email, SendGrid, WhatsApp, SMS, Webhook).</li>
<li>WhatsApp Integration: Send OTPs directly via WhatsApp using Twilio API.</li>
<li>SMS Integration: Deliver OTPs via SMS using Twilio API.</li>
<li>SendGrid API V3: Native integration for high-deliverability emails.</li>
<li>Webhook Support: Connect to custom webhooks for advanced automation flows.</li>
<li>Secure OTPs: 6-digit one-time passwords that expire automatically.</li>
<li>Browser Trust: “Remember this device” functionality to reduce friction for authorized users.</li>
<li>Advanced Attack Protection (v1.4.2): Credential stuffing detection, progressive delays, username enumeration protection.</li>
</ul>
<h3>External Services</h3>
This plugin may connect to external third-party services depending on your configuration. Below is a detailed explanation of what services are used, what data is sent, and when:
SendGrid Email API (Optional)
If you select “SendGrid API” as your delivery method in the plugin settings, this plugin will send data to SendGrid’s email service to deliver one-time password (OTP) codes.
<ul>
<li>Service: SendGrid by Twilio</li>
<li>What it’s used for: Sending two-factor authentication codes via email with improved deliverability</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled</li>
<li>Data sent:
<ul>
<li>Recipient email address (user’s email or manager email if configured)</li>
<li>Sender email address (configured in plugin settings)</li>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>6-digit one-time password code</li>
<li>Email subject and HTML body</li>
</ul>
</li>
<li>API Endpoint: https://api.sendgrid.com/v3/mail/send</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/legal/privacy</li>
</ul>
Important: You must have a SendGrid account and API key to use this feature. You are responsible for complying with SendGrid’s terms of service and ensuring proper data handling practices.
Twilio API for WhatsApp & SMS (Optional)
If you select “WhatsApp” or “SMS” as delivery methods, the plugin will send data to Twilio’s API to deliver one-time password codes.
<ul>
<li>Service: Twilio</li>
<li>What it’s used for: Sending two-factor authentication codes via WhatsApp and/or SMS</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled with WhatsApp/SMS selected</li>
<li>Data sent:
<ul>
<li>Recipient phone number (from user meta field ‘billing_phone’)</li>
<li>Sender phone number (WhatsApp number or SMS number configured in settings)</li>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>6-digit one-time password code</li>
<li>Message body</li>
</ul>
</li>
<li>API Endpoint: https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/legal/privacy</li>
</ul>
Important: You must have a Twilio account with WhatsApp and/or SMS capabilities enabled. Phone numbers must be stored in user meta (field: ‘billing_phone’). You are responsible for complying with Twilio’s terms of service.
Custom Webhook (Optional)
If you select “Webhook” as a delivery method, the plugin will send login notification data to a webhook URL you configure.
<ul>
<li>Service: Custom webhook endpoint (configured by you)</li>
<li>What it’s used for: Sending login notifications to external systems for custom processing</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled</li>
<li>Data sent:
<ul>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>User email address</li>
<li>6-digit one-time password code</li>
<li>Recipient information array</li>
<li>Timestamp of login attempt</li>
</ul>
</li>
<li>Endpoint: User-configured webhook URL</li>
</ul>
Important: When using the webhook option, you are responsible for the security and privacy compliance of the endpoint you configure. Ensure your webhook endpoint uses HTTPS and follows proper data protection practices.
Standard WordPress Email (Default)
By default, this plugin uses WordPress’s built-in <code>wp_mail()</code> function, which does not involve any external services unless your WordPress installation is configured to use a third-party SMTP service.

BaseCloud Shield

Enterprise-grade Two-Factor Authentication (2FA) with support for Email, SendGrid API, Webhooks, WhatsApp, and SMS delivery.

miniOrange

twofactorauthentication

twofactor

Google Authenticator

miniOrange WP 2FA plugin adds an extra layer of security to your WordPress website by protecting user logins from unauthorized access, brute-force attacks, and password theft.
This powerful 2FA – Two-factor authentication for WordPress solution is easy to configure using a step-by-step setup wizard that supports multiple authentication methods such as Google Authenticator, Microsoft Authenticator, OTP via Email, SMS, WhatsApp, Telegram, and more.
Whether you are a beginner or an advanced user, the WordPress Two Factor Authentication plugin ensures maximum security while keeping the login experience smooth and user-friendly.
Quick Links: <a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa" rel="nofollow ugc">Official Website</a> | <a href="https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication" rel="nofollow ugc">Setup Guide</a> | <a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#pricing" rel="nofollow ugc">Pricing Plans</a> | <a href="https://faq.miniorange.com/" rel="nofollow ugc">Support</a>
<h3>What is the WP 2FA Authenticator Plugin for WordPress?</h3>
The WP 2FA Authenticator plugin adds an extra verification step (OTP or approval) beyond your password. This two-step login process enhances security without disrupting daily operations.
Easy to install and configure, this WordPress 2FA plugin helps protect your website from credential theft and unauthorized access.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/rE-awZZt13Q?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>WordPress W2FA Plugin Features (Free Version)</h3>
<ul>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step1" rel="nofollow ugc">User Role-Based Configuration</a>: Apply 2FA or MFA selectively based on user roles or configure it individually per user for more control over who needs additional verification.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step3" rel="nofollow ugc">Backup Access Support</a>: Let users generate and use backup codes or email verification links to log in when their primary 2FA method is unavailable.</li>
<li>Guided Setup Wizard: An intuitive step-by-step wizard makes it easy to configure and deploy 2FA—no technical skills required.</li>
<li>Multi-Language Support: The plugin is translation-ready and supports major languages, including French, Spanish, Italian, and German.</li>
<li>Free for up to 3 Users: Includes full access to 2FA features for up to three users—ideal for small teams or personal sites.</li>
<li>Customize Email Templates: Personalize OTP and 2FA emails to reflect your brand and improve user trust.</li>
<li>2FA Login Reports & IP Alerts: Track login activity and get email alerts for logins from new IP addresses.</li>
<li>Custom Post-Login Redirection: Redirect users to any page after 2FA, like a dashboard, homepage, or custom URL.</li>
<li>Custom Labels in Authenticator Apps: Customize the account name shown in Google Authenticator and other apps for clearer identification.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress" rel="nofollow ugc">2FA for Popular Login Forms</a>: Enable 2FA on WooCommerce, Theme My Login, Elementor, and other login forms.</li>
</ul>
<h3>Supported WP 2FA Authentication Methods</h3>
<h4>TOTP-Based Authentication</h4>
Compatible with:
<ul>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Google Authenticator</a>: A widely trusted TOTP app that generates rotating login codes every 30 seconds—ideal for fast and offline verification.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Microsoft Authenticator</a>: Easily syncs with your Microsoft account and supports time-based one-time passcodes for secure WordPress login.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">LastPass Authenticator</a>: Combines password management with strong 2FA protection by generating time-based codes linked to your LastPass account.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Duo Authenticator</a>: Enterprise-ready authentication app offering secure TOTP codes and push notifications for streamlined two-factor login.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Authy 2-Factor Authenticator</a>: Supports multi-device syncing and cloud backups while generating secure TOTP codes for your WordPress login.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">FreeOTP</a> and others</li>
</ul>
These authenticator apps enable secure WordPress 2FA using time-based one-time passwords (TOTP).
<h4>OTP Authentication</h4>
<ul>
<li><a href="https://plugins.miniorange.com/otp-over-email-for-wordpress-two-factor-authentication-2fa-mfa" rel="nofollow ugc">OTP via Email</a>: Send one-time passcodes to users directly via email for secure and convenient login verification with OTP Over Email support.</li>
<li><a href="https://plugins.miniorange.com/otp-over-sms-for-wordpress-two-factor-authentication-2fa-mfa" rel="nofollow ugc">OTP via SMS</a>: Get login codes to users through SMS for fast two-step OTP login verification on mobile devices.</li>
<li><a href="https://plugins.miniorange.com/login-with-telegram-as-a-two-factor-method-for-wordpress" rel="nofollow ugc">OTP over Telegram</a>: Use Telegram for OTP authentication if you prefer messaging-based login verification.</li>
<li><a href="https://plugins.miniorange.com/whatsapp-two-factor-authentication-setup-for-wordpress-2fa-plugin" rel="nofollow ugc">OTP over WhatsApp (Premium)</a>: Use WhatsApp 2FA to send login passcodes directly to the user’s WhatsApp account for a faster and familiar authentication experience.</li>
<li><a href="https://plugins.miniorange.com/how-to-setup-email-verification-for-2-factor-authentication-wordpress-2fa" rel="nofollow ugc">Email Verification via Link</a>: Let users verify their login using a secure one-click email verification link—no passcode entry needed.</li>
<li><a href="https://plugins.miniorange.com/setup-security-questions-for-two-factor-authentication-wordpress-2fa" rel="nofollow ugc">Security Questions</a>: Add a personal security layer by asking predefined questions during login, ideal as a backup or secondary method.</li>
</ul>
<h3>Upgrade to miniOrange WP 2FA Premium for Advanced Security</h3>
The premium WordPress Two Factor Authentication plugin offers complete control over user authentication policies with advanced features such as unlimited OTP transactions, trusted devices, multisite compatibility, and full branding control.
It is ideal for enterprises, eCommerce websites, and business-critical WordPress environments requiring strict login security.
<h3>Premium Features</h3>
<ul>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step1" rel="nofollow ugc">2FA for All Users & Roles</a>: Enforce 2FA across your entire website or apply it selectively to specific user roles or individual users.</li>
<li>Unlimited Email OTP Transactions: Send unlimited email-based one-time passcodes—ideal for large-scale user bases and frequent login environments.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress?select-2fa=2fa-for-specific-role#step2" rel="nofollow ugc">Role-Based 2FA Policies</a>: Create different 2FA rules for each user role—require stronger authentication for admins while offering simpler methods for customers.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step2" rel="nofollow ugc">User-Specific 2FA Management</a>: Enable or disable 2FA for individual users directly from their profile or admin settings.</li>
<li><a href="https://plugins.miniorange.com/enable-2fa-on-specific-pages-wordpress" rel="nofollow ugc">Page-Protection with 2FA</a>: Add two-factor authentication (2FA) protection to selected pages for enhanced security.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step3" rel="nofollow ugc">Backup Login Options</a>: Allow users to log in using alternate methods like security questions, email-based OTP, or backup codes when the default method is inaccessible.</li>
<li>Custom Redirect After 2FA: Send users to a specific page (dashboard, custom welcome, etc.) after completing 2FA authentication.</li>
<li><a href="https://plugins.miniorange.com/how-to-setup-custom-security-questions-kba-from-wordpress-wp-2fa" rel="nofollow ugc">Custom Security Questions</a>: Set your own challenge questions to match your organization’s security policies.</li>
<li>Force 2FA Setup on Login: Automatically prompt users to configure 2FA on their next login and restrict access until it’s enabled.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-remember-device-with-two-factor-authentication-2fa" rel="nofollow ugc">Trusted Devices Feature</a>: Let users remember their device or browser to bypass 2FA on trusted systems for future logins.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-login-popup-tab-wordpress#step2" rel="nofollow ugc">Customizable Login UI</a>: Easily style 2FA prompts and popups to match your theme and brand—no coding needed.</li>
<li>Multisite Compatibility: Support for WordPress multisite networks, with 2FA settings across up to 3 subsites included.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-login-popup-tab-wordpress#step1" rel="nofollow ugc">White Labeling & Branding</a>: Fully rebrand the login or registration forms with your logo, colors, and email templates to offer a seamless branded experience.</li>
<li>Shortcodes for User Profile Controls: Add 2FA management shortcodes to user account pages so users can enable, disable, or reconfigure their 2FA settings.</li>
<li><a href="https://plugins.miniorange.com/prevent-account-sharing-restrict-concurrent-sessions-wordpress-session-restriction" rel="nofollow ugc">Session Management Controls</a>: Restrict users from logging in on multiple devices simultaneously to prevent unauthorized access or credential sharing.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-passwordless-login-as-a-login-screen-options-wordpress-2fa" rel="nofollow ugc">Passwordless Login</a>: Let users log in using a one-time passcode—no password required—while maintaining strong account security.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress" rel="nofollow ugc">Support for Custom & Third-Party Login Forms</a>: Works seamlessly with plugins like UserPro, Login with Ajax, Theme My Login, and more.</li>
<li>Custom SMS Gateway Support: Integrate your own SMS gateway to send OTPs, giving you full control over delivery, cost, and sender branding.</li>
<li><a href="https://plugins.miniorange.com/setup-remember-whitelist-ip-2fa-wordpress" rel="nofollow ugc">Remember IP to Bypass 2FA</a>: Mark trusted IP addresses to skip 2FA prompts and streamline login for internal users or safe environments.</li>
<li>Prevent Credential Sharing: Restrict multiple logins from different IPs or devices, helping you enforce strict account access policies and stop sharing.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress?utm_source=readme&utm_medium=2fa_sg&utm_campaign=2fa_login_forms_2#step2" rel="nofollow ugc">Custom Form Integration</a>: Add 2FA to any custom login form—even those not on the supported list—through flexible integration and custom support.</li>
</ul>
<h3>How to Install and Activate the WP 2FA Plugin</h3>
<h4>Step 1: Install and Activate</h4>
Search for the miniOrange Two Factor Authentication plugin in the WordPress marketplace and activate it.
<h4>Step 2: Enable WP 2FA from Quick Setup</h4>
Go to the Quick Setup tab, choose user roles, and save settings.
<h4>Step 3: Configure Authentication Method</h4>
Select and set up your preferred <a href="https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication#step3" rel="nofollow ugc">2FA authentication method</a>, such as Google Authenticator, OTP over SMS, or WhatsApp 2FA, from the available options while logging into the form for the first time.
<h3>Built to Integrate Seamlessly</h3>
Two Factor Authentication – WordPress 2FA/MFA plugin is compatible with <a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress" rel="nofollow ugc">popular plugins</a> such as:
<ul>
<li>WooCommerce</li>
<li>Ultimate Member</li>
<li>BuddyPress</li>
<li>Elementor Pro</li>
<li>Login With Ajax</li>
<li>User Registration</li>
<li>Restrict Content Pro</li>
<li>LoginPress</li>
<li>Registration Magic</li>
<li>Admin Custom Login</li>
<li>Theme My Login</li>
<li>Profile Builder and many more.</li>
</ul>
Have a form not listed here? We offer custom integration support—just reach out.
<h3>Third-Party Custom SMS Gateway for OTP via SMS</h3>
The premium version of the miniOrange Two-Factor Authentication plugin supports any third-party SMS gateway for OTP-based login via SMS. Whether you already use a custom SMS provider or need to integrate with a local/regional provider, you can easily configure it within the plugin. <a href="https://plugins.miniorange.com/sms-email-gateways-supported-by-2fa-plugin" rel="nofollow ugc">Famous SMS gateways supported by Two Factor Authentication</a>.
<h3>Why Register with miniOrange?</h3>
Some features like OTP via SMS or Email in the Free plugin require secure transactions credited to your miniOrange account.
Most features work without registration, including: 
 * Google Authenticator 
 * Microsoft Authenticator 
 * Security questions 
 * Backup codes
For customized solutions and support, contact: 
<a href="mailto:info@xecurify.com" rel="nofollow ugc">info@xecurify.com</a> or <a href="mailto:2fasupport@xecurify.com" rel="nofollow ugc">2fasupport@xecurify.com</a>

miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)

Piyush provided the assistance I needed. the great support team for the free version is also... Very much appreciated!  5 stars are well deserved.

Great plugin with great support

Easy to use and Aswesome support


It's indeed a great plugin, with lot of options for many scenarios. 



One thing that it lacks is customization of the page of OTP, but you can modify /wp-content/plugins/miniorange-2-factor-authentication/controllers/twofa/mo2fa-common-login.php if you know what you're doing (it's just HTML to edit, nothing more).



The plugin have a good documentation and video tutorials, and, a nice thing, a support box right inside the plugin's page to contact support if you need anything.


Great plugin with nice funtionality

miniOrange WP 2FA plugin adds an extra layer of security to your WordPress website by protecting user logins from unauthorized access, brute-force att …

BaseCloud Shield vs miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)