Brightery

<p>Brightery Secure 2FA adds a strong second login step for WordPress accounts while staying lightweight in runtime.</p>
<p>Features:</p>
<ul>
<li>Authenticator app (TOTP) support.</li>
<li>Passkeys / WebAuthn support for Touch ID, Face ID, Windows Hello, fingerprint readers, and device PIN.</li>
<li>Role-based enforcement: require selected user groups to enroll.</li>
<li>Forced enrollment page to block protected users until they configure security.</li>
<li>Backup codes.</li>
<li>Encrypted TOTP secret storage using WordPress salts.</li>
<li>Login throttling for repeated primary-login and second-factor failures.</li>
<li>Lightweight audit logs stored inside WordPress options.</li>
<li>Email alerts for enrollment changes and lockouts.</li>
<li>Trusted devices so users can skip 2FA on approved browsers for a limited period.</li>
<li>CSV export for security logs.</li>
<li>Advanced log filters and search.</li>
<li>Custom labels for trusted devices and passkeys.</li>
<li>Optional revocation of other sessions after security changes.</li>
<li>Optional blocking of WordPress application passwords for protected / 2FA-enabled users.</li>
<li>Lightweight runtime: the plugin mostly runs on login, profile, AJAX, settings pages, WooCommerce account pages, and authenticated REST requests.</li>
</ul>
<h3>Important Notes</h3>
<ul>
<li>HTTPS is required for passkeys in production.</li>
<li>This build is optimized for normal interactive WordPress logins and admin access enforcement.</li>
<li>Passkey attestation trust-chain validation is intentionally not enforced in order to remain lightweight and dependency-free.<br />
The plugin still validates challenge, origin, RP ID hash, user presence, optional user verification, signature, and signature counter.</li>
<li>This lightweight build supports ES256 passkeys.</li>
<li>TOTP setup includes a local QR-code renderer so the setup secret stays on your own WordPress site during enrollment.</li>
<li>The plugin stores account-security data such as trusted-device records, passkey metadata, security logs, and a limited recent login-context history.</li>
<li>A privacy-policy suggestion plus WordPress personal-data exporter and eraser integrations are included.</li>
<li>There are no non-GPL third-party runtime libraries bundled with this plugin;<br />
the distributed JavaScript and CSS files are included as human-readable source.</li>
</ul>
<h3>Security Model</h3>
<ul>
<li>TOTP secrets are encrypted before storing in user meta.</li>
<li>Backup codes are stored hashed.</li>
<li>Passkeys verify origin, RP ID hash, challenge, signature, and signature counter.</li>
<li>Rate limiting helps slow repeated login and 2FA guessing attempts.</li>
<li>The plugin can require passkey user verification for biometric/PIN-backed sign-in.</li>
</ul>
<h3>Privacy</h3>
<p>Brightery Secure 2FA stores security-related account data so it can protect logins and help administrators investigate suspicious access.<br />
The plugin adds suggested privacy-policy text to WordPress and registers personal-data exporter/eraser callbacks for the data it stores.</p>
<h3>Source Code and Licensing</h3>
<ul>
<li>All distributed plugin PHP, JS, and CSS files are included as human-readable source.</li>
<li>The local QR renderer is bundled directly in <code>assets/js/bs2fa-qr.js</code> as readable source code.</li>
<li>No non-GPL runtime libraries are required for normal plugin operation.</li>
</ul>


Brightery Secure 2FA

Production-focused two-factor authentication for WordPress with authenticator apps, passkeys, forced enrollment, and advanced session hardening.

Holovid

<p>You have a WordPress site and you want to protect it from hackers? This plugin is made for you!</p>
<p>Today, a simple password is no longer enough. Hackers have tools to guess, steal or intercept them. Two-factor authentication (2FA) is like adding an extra lock to your door: even if someone finds your key, they cannot get in without the second lock.</p>
<p>Holovid® Secure Connect offers you two ways to protect your site:</p>
<ul>
<li>TOTP mode (temporary code)</li>
</ul>
<p>A 6-digit code that changes every 30 seconds. You find it in the Holovid® ID app on your phone (or in Google Authenticator, Authy, etc.). You type the code, and you are in. It is the most common system, compatible with all authenticator apps.</p>
<ul>
<li>Secure Connect mode (codeless)</li>
</ul>
<p>This one is even simpler: you do not type anything at all. A QR Code appears on your WordPress login page, you scan it with the Holovid® ID app, you confirm with a tap on your phone, and you are logged in. Fast, effortless.</p>
<p>But Secure Connect is not just convenient. It protects you against a particularly sneaky category of attacks: proxy phishing (known as “AiTM” attacks, such as Tycoon 2FA or EvilProxy). These attacks create a fake copy of your login page to intercept your TOTP code in real time. With Secure Connect, this technique does not work, because the signature is bound to the real domain of your site.</p>
<p>Both modes can coexist on your site. Each user chooses the one they prefer from their profile.</p>
<h4>What makes this plugin different</h4>
<ul>
<li>Two levels of protection to choose from: a classic temporary code or a codeless login from your phone.</li>
<li>Resistant to proxy phishing: Secure Connect prevents hackers from intercepting your authentication, even if they copy your login page.</li>
<li>Nothing leaves your server: TOTP mode works without calling any external service. The QR Code is generated directly by your server, in pure PHP, without going through Google or any other service.</li>
<li>Your secrets are encrypted: TOTP keys are protected with AES-256-GCM encryption in your database. Even if the database leaks, they remain unreadable.</li>
<li>One device = one account: each WordPress account is linked to a single phone. If someone tries to log in with a different device, the plugin detects it and denies access.</li>
<li>Backup codes: in TOTP mode, 10 single-use codes are generated in case you lose your phone.</li>
<li>Lightweight and dependency-free: no external library, no third-party service on the TOTP side. The plugin does everything itself.</li>
<li>French and English: the interface automatically adapts to your WordPress language.</li>
</ul>
<h4>In a nutshell</h4>
<p>  TOTP (temporary code)<br />
  Secure Connect (codeless)</p>
<p>  How does it work?<br />
  You type a 6-digit code<br />
  You scan a QR Code and confirm</p>
<p>  Compatible with other apps?<br />
  Yes (Google Authenticator, Authy, etc.)<br />
  No, Holovid® ID only</p>
<p>  Works offline?<br />
  Yes<br />
  No (requires internet)</p>
<p>  Resistant to proxy phishing?<br />
  No<br />
  Yes</p>
<p>  Backup codes?<br />
  Yes (10 codes)<br />
  No (an admin can deactivate)</p>
<h3>External services</h3>
<p>This plugin connects to the Holovid® ID server for the Secure Connect (codeless) authentication mode. The TOTP mode does not use any external service.</p>
<h4>Holovid® ID API (api.holovid.net)</h4>
<p>When Secure Connect is enabled, the plugin communicates with the Holovid® ID API hosted in Gravelines, France, in the following situations:</p>
<ul>
<li><strong>Registration</strong>: when a user activates Secure Connect, the plugin requests a cryptographic challenge from the API. The site domain name is sent.</li>
<li><strong>Login</strong>: when a user logs in with Secure Connect, the plugin polls the API to check whether the user has confirmed the authentication on their phone. The challenge nonce and session token are sent.</li>
<li><strong>Device verification</strong>: when a device change is detected, the plugin checks with the API whether the previous device registration is still active. The account identifier and site domain are sent.</li>
<li><strong>Login page</strong>: the Secure Connect login page loads a JavaScript SDK from the API server to display the QR Code and handle the authentication flow.</li>
</ul>
<p>No personal data (name, email, password) is ever sent to the API. Only cryptographic identifiers (nonce, session token, account ID) and the site domain are transmitted.</p>
<p>This service is provided by Holovid SAS (Bergerac, France).</p>
<ul>
<li><a href="https://holovid.cloud/conditions-generales-dutilisation/" rel="nofollow ugc">Terms of Service</a></li>
<li><a href="https://holovid.cloud/politiques/" rel="nofollow ugc">Privacy Policy</a></li>
</ul>


Holovid® Secure Connect

Two-factor authentication: TOTP codes or codeless Secure Connect login. Anti-phishing, encrypted secrets, no external dependencies.

Brightery Secure 2FA vs Holovid® Secure Connect