Brightery

<p>Brightery Secure 2FA adds a strong second login step for WordPress accounts while staying lightweight in runtime.</p>
<p>Features:</p>
<ul>
<li>Authenticator app (TOTP) support.</li>
<li>Passkeys / WebAuthn support for Touch ID, Face ID, Windows Hello, fingerprint readers, and device PIN.</li>
<li>Role-based enforcement: require selected user groups to enroll.</li>
<li>Forced enrollment page to block protected users until they configure security.</li>
<li>Backup codes.</li>
<li>Encrypted TOTP secret storage using WordPress salts.</li>
<li>Login throttling for repeated primary-login and second-factor failures.</li>
<li>Lightweight audit logs stored inside WordPress options.</li>
<li>Email alerts for enrollment changes and lockouts.</li>
<li>Trusted devices so users can skip 2FA on approved browsers for a limited period.</li>
<li>CSV export for security logs.</li>
<li>Advanced log filters and search.</li>
<li>Custom labels for trusted devices and passkeys.</li>
<li>Optional revocation of other sessions after security changes.</li>
<li>Optional blocking of WordPress application passwords for protected / 2FA-enabled users.</li>
<li>Lightweight runtime: the plugin mostly runs on login, profile, AJAX, settings pages, WooCommerce account pages, and authenticated REST requests.</li>
</ul>
<h3>Important Notes</h3>
<ul>
<li>HTTPS is required for passkeys in production.</li>
<li>This build is optimized for normal interactive WordPress logins and admin access enforcement.</li>
<li>Passkey attestation trust-chain validation is intentionally not enforced in order to remain lightweight and dependency-free.<br />
The plugin still validates challenge, origin, RP ID hash, user presence, optional user verification, signature, and signature counter.</li>
<li>This lightweight build supports ES256 passkeys.</li>
<li>TOTP setup includes a local QR-code renderer so the setup secret stays on your own WordPress site during enrollment.</li>
<li>The plugin stores account-security data such as trusted-device records, passkey metadata, security logs, and a limited recent login-context history.</li>
<li>A privacy-policy suggestion plus WordPress personal-data exporter and eraser integrations are included.</li>
<li>There are no non-GPL third-party runtime libraries bundled with this plugin;<br />
the distributed JavaScript and CSS files are included as human-readable source.</li>
</ul>
<h3>Security Model</h3>
<ul>
<li>TOTP secrets are encrypted before storing in user meta.</li>
<li>Backup codes are stored hashed.</li>
<li>Passkeys verify origin, RP ID hash, challenge, signature, and signature counter.</li>
<li>Rate limiting helps slow repeated login and 2FA guessing attempts.</li>
<li>The plugin can require passkey user verification for biometric/PIN-backed sign-in.</li>
</ul>
<h3>Privacy</h3>
<p>Brightery Secure 2FA stores security-related account data so it can protect logins and help administrators investigate suspicious access.<br />
The plugin adds suggested privacy-policy text to WordPress and registers personal-data exporter/eraser callbacks for the data it stores.</p>
<h3>Source Code and Licensing</h3>
<ul>
<li>All distributed plugin PHP, JS, and CSS files are included as human-readable source.</li>
<li>The local QR renderer is bundled directly in <code>assets/js/bs2fa-qr.js</code> as readable source code.</li>
<li>No non-GPL runtime libraries are required for normal plugin operation.</li>
</ul>


Brightery Secure 2FA

Production-focused two-factor authentication for WordPress with authenticator apps, passkeys, forced enrollment, and advanced session hardening.

Yordan Soares

dueclic

<p><strong>AuthPress</strong> is a comprehensive two-factor authentication plugin for WordPress that evolved from Telegram-only support into a flexible multi-provider 2FA solution. Secure your WordPress site with multiple authentication methods and an extensible provider system.</p>
<h4>🚀 Key Features</h4>
<ul>
<li><strong>Multiple Authentication Providers</strong>: Telegram, Email, Authenticator Apps (TOTP), Recovery Codes</li>
<li><strong>Extensible System</strong>: Developers can create custom providers (SMS, Passkey, etc.)</li>
<li><strong>Easy Configuration</strong>: Setup multiple 2FA methods in minutes</li>
<li><strong>Enhanced Security</strong>: Advanced logging, rate limiting, and secure code storage</li>
<li><strong>User Flexibility</strong>: Users can enable multiple providers for redundancy</li>
<li><strong>Admin Control</strong>: Centralized provider management and monitoring</li>
<li><strong>Professional Logging</strong>: WP_List_Table implementation with pagination and filtering</li>
</ul>
<h4>📱 Telegram Provider (Original)</h4>
<ul>
<li>Instant authentication code delivery via Telegram bot</li>
<li>Failed login attempt notifications for administrators</li>
<li>Works on any device with Telegram installed</li>
<li>Simple setup with Bot Token from @BotFather</li>
<li>Admin security alerts and monitoring</li>
</ul>
<h4>📧 Email Provider</h4>
<ul>
<li>Send verification codes via email</li>
<li>Configurable token duration (default: 20 minutes)</li>
<li>HTML formatted emails with security information</li>
<li>Works with all email providers</li>
<li>Perfect fallback when other methods unavailable</li>
</ul>
<h4>🔐 Authenticator Apps (TOTP)</h4>
<ul>
<li>Standard TOTP (Time-based One-Time Password) support</li>
<li>Compatible with Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden</li>
<li>Works completely offline – no internet connection required</li>
<li>Easy setup with QR codes or manual secret entry</li>
<li>6-digit codes that refresh every 30 seconds</li>
</ul>
<h4>🔧 Extensible & Developer-Friendly</h4>
<ul>
<li><strong>Custom Providers</strong>: Simple API for creating custom 2FA methods</li>
<li><strong>SMS Support</strong>: Ready-to-use SMS providers available as extensions</li>
<li><strong>Passkey Support</strong>: Modern WebAuthn implementation available</li>
<li><strong>Plugin Architecture</strong>: Each provider can be a separate plugin</li>
<li><strong>Seamless Integration</strong>: All providers work together in unified interface</li>
</ul>


AuthPress

If you use Telegram and want to increase the security of your WordPress site, this plugin is essential to do it. 

It's lightweight, easy to setup and well done documented to avoid stuck in the process.

If you use Telegram, this plugin is essential for your site

Advanced WordPress 2FA plugin with multiple authentication providers: Telegram, Email, Authenticator Apps, and extensible custom providers.

Brightery Secure 2FA vs AuthPress