Brightery

<p>Brightery Secure 2FA adds a strong second login step for WordPress accounts while staying lightweight in runtime.</p>
<p>Features:</p>
<ul>
<li>Authenticator app (TOTP) support.</li>
<li>Passkeys / WebAuthn support for Touch ID, Face ID, Windows Hello, fingerprint readers, and device PIN.</li>
<li>Role-based enforcement: require selected user groups to enroll.</li>
<li>Forced enrollment page to block protected users until they configure security.</li>
<li>Backup codes.</li>
<li>Encrypted TOTP secret storage using WordPress salts.</li>
<li>Login throttling for repeated primary-login and second-factor failures.</li>
<li>Lightweight audit logs stored inside WordPress options.</li>
<li>Email alerts for enrollment changes and lockouts.</li>
<li>Trusted devices so users can skip 2FA on approved browsers for a limited period.</li>
<li>CSV export for security logs.</li>
<li>Advanced log filters and search.</li>
<li>Custom labels for trusted devices and passkeys.</li>
<li>Optional revocation of other sessions after security changes.</li>
<li>Optional blocking of WordPress application passwords for protected / 2FA-enabled users.</li>
<li>Lightweight runtime: the plugin mostly runs on login, profile, AJAX, settings pages, WooCommerce account pages, and authenticated REST requests.</li>
</ul>
<h3>Important Notes</h3>
<ul>
<li>HTTPS is required for passkeys in production.</li>
<li>This build is optimized for normal interactive WordPress logins and admin access enforcement.</li>
<li>Passkey attestation trust-chain validation is intentionally not enforced in order to remain lightweight and dependency-free.<br />
The plugin still validates challenge, origin, RP ID hash, user presence, optional user verification, signature, and signature counter.</li>
<li>This lightweight build supports ES256 passkeys.</li>
<li>TOTP setup includes a local QR-code renderer so the setup secret stays on your own WordPress site during enrollment.</li>
<li>The plugin stores account-security data such as trusted-device records, passkey metadata, security logs, and a limited recent login-context history.</li>
<li>A privacy-policy suggestion plus WordPress personal-data exporter and eraser integrations are included.</li>
<li>There are no non-GPL third-party runtime libraries bundled with this plugin;<br />
the distributed JavaScript and CSS files are included as human-readable source.</li>
</ul>
<h3>Security Model</h3>
<ul>
<li>TOTP secrets are encrypted before storing in user meta.</li>
<li>Backup codes are stored hashed.</li>
<li>Passkeys verify origin, RP ID hash, challenge, signature, and signature counter.</li>
<li>Rate limiting helps slow repeated login and 2FA guessing attempts.</li>
<li>The plugin can require passkey user verification for biometric/PIN-backed sign-in.</li>
</ul>
<h3>Privacy</h3>
<p>Brightery Secure 2FA stores security-related account data so it can protect logins and help administrators investigate suspicious access.<br />
The plugin adds suggested privacy-policy text to WordPress and registers personal-data exporter/eraser callbacks for the data it stores.</p>
<h3>Source Code and Licensing</h3>
<ul>
<li>All distributed plugin PHP, JS, and CSS files are included as human-readable source.</li>
<li>The local QR renderer is bundled directly in <code>assets/js/bs2fa-qr.js</code> as readable source code.</li>
<li>No non-GPL runtime libraries are required for normal plugin operation.</li>
</ul>


Brightery Secure 2FA

Production-focused two-factor authentication for WordPress with authenticator apps, passkeys, forced enrollment, and advanced session hardening.

rathsh

<p><strong>Rat Two-Factor Authentication</strong> is a lightweight yet powerful security plugin that adds an extra layer of protection to your WordPress site through email-based One-Time Password (OTP) verification.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Email-based OTP verification</strong> – Secure 6-digit codes sent to user’s email</li>
<li><strong>Lightweight and fast</strong> – Minimal impact on site performance</li>
<li><strong>User-friendly interface</strong> – Clean, responsive design that works on all devices</li>
<li><strong>Flexible settings</strong> – Enable 2FA globally or per user</li>
<li><strong>Role-based requirements</strong> – Require 2FA for specific user roles</li>
<li><strong>Session management</strong> – Secure session handling with timeout protection</li>
<li><strong>AJAX-powered</strong> – Smooth user experience without page reloads</li>
<li><strong>Auto-submit functionality</strong> – Automatically submits form when 6 digits are entered</li>
<li><strong>Resend functionality</strong> – Users can request new codes with cooldown protection</li>
<li><strong>Mobile-friendly</strong> – Optimized for mobile login experiences</li>
<li><strong>Security-first</strong> – Nonce protection, input sanitization, and secure coding practices</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>User enters their username and password normally</li>
<li>If 2FA is enabled, they’re redirected to an OTP verification screen</li>
<li>A 6-digit code is sent to their registered email address</li>
<li>User enters the code to complete login</li>
<li>Code expires after 10 minutes for security</li>
</ol>
<h4>Perfect For</h4>
<ul>
<li><strong>Business websites</strong> requiring enhanced security</li>
<li><strong>E-commerce stores</strong> protecting customer accounts</li>
<li><strong>Membership sites</strong> with sensitive user data</li>
<li><strong>Multi-author blogs</strong> securing contributor access</li>
<li><strong>Any WordPress site</strong> wanting better login security</li>
</ul>
<h4>Admin Features</h4>
<ul>
<li><strong>Global 2FA setting</strong> – Enable for all users</li>
<li><strong>Force 2FA option</strong> – Make it mandatory for selected roles</li>
<li><strong>Role-based configuration</strong> – Choose which roles require 2FA</li>
<li><strong>User profile integration</strong> – Users can enable/disable 2FA individually</li>
<li><strong>Clean admin interface</strong> – Easy to configure and manage</li>
</ul>
<h4>Developer Friendly</h4>
<ul>
<li><strong>Well-documented code</strong> with inline comments</li>
<li><strong>WordPress coding standards</strong> compliant</li>
<li><strong>Hook system</strong> for customization</li>
<li><strong>Lightweight codebase</strong> for easy modification</li>
<li><strong>No external dependencies</strong> – Pure WordPress integration</li>
</ul>
<h4>Security Features</h4>
<ul>
<li><strong>Nonce verification</strong> for all AJAX requests</li>
<li><strong>Input sanitization</strong> and validation</li>
<li><strong>Secure OTP generation</strong> using WordPress built-in functions</li>
<li><strong>Session timeout</strong> protection (10 minutes)</li>
<li><strong>Rate limiting</strong> on resend requests</li>
<li><strong>No plain text storage</strong> of OTP codes</li>
</ul>
<h3>Configuration</h3>
<h4>Global Settings</h4>
<p>Navigate to <strong>Settings > Two-Factor Auth</strong> to configure:</p>
<ul>
<li><strong>Enable 2FA Globally</strong>: Turn on 2FA for all users</li>
<li><strong>Force 2FA for All Users</strong>: Make 2FA mandatory regardless of user preference</li>
<li><strong>Required User Roles</strong>: Select specific roles that must use 2FA</li>
</ul>
<h4>User Settings</h4>
<p>Each user can enable/disable 2FA in their profile:</p>
<ol>
<li>Go to <strong>Users > Profile</strong> (or <strong>Users > Your Profile</strong>)</li>
<li>Find the “Two-Factor Authentication” section</li>
<li>Check “Enable 2FA” to activate for that user</li>
<li>Save the profile</li>
</ol>
<h4>Email Configuration</h4>
<p>The plugin uses WordPress’s built-in <code>wp_mail()</code> function. Ensure your site can send emails properly. Consider using:</p>
<ul>
<li>SMTP plugins for reliable email delivery</li>
<li>Email services like SendGrid, Mailgun, or Amazon SES</li>
<li>Proper SPF/DKIM records for your domain</li>
</ul>
<h3>Support</h3>
<p>For support, feature requests, or bug reports:</p>
<ul>
<li><strong>Plugin Support</strong>: <a href="https://wordpress.org/support/plugin/rat-two-factor-authentication" rel="ugc">WordPress.org Support Forum</a></li>
<li><strong>Documentation</strong>: Available in the plugin’s admin area</li>
<li><strong>Bug Reports</strong>: Please provide detailed information about your setup</li>
</ul>
<h3>Contributing</h3>
<p>We welcome contributions! The plugin follows WordPress coding standards and best practices.</p>
<h3>Privacy Policy</h3>
<p>This plugin:<br />
* Stores minimal user data (2FA preference and temporary OTP hashes)<br />
* Does not send data to external services<br />
* Uses WordPress’s built-in email system<br />
* Follows WordPress privacy guidelines<br />
* Allows data export/erasure as per GDPR requirements</p>
<h3>Technical Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.6 or higher (or equivalent MariaDB)</li>
<li>Ability to send emails from WordPress</li>
<li>Modern web browser with JavaScript enabled</li>
</ul>
<h3>Credits</h3>
<p>Developed with ❤️ by the Rat Plugins team, focused on creating lightweight, powerful, and user-friendly WordPress plugins.</p>
<h3>License</h3>
<p>This plugin is licensed under the GPL v2 or later.</p>
<blockquote>
<p>This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.</p>
<p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.</p>
</blockquote>


Rat Two-Factor Authentication

Lightweight and powerful Two-Factor Authentication plugin for WordPress with email-based OTP verification.

Brightery Secure 2FA vs Rat Two-Factor Authentication