Bhumi Patel

Configify

Configify 2FA adds Two-Factor Authentication to every important action on your WordPress site, all configurable from a single settings page.
Choose the method that fits your audience:
<ul>
<li>Google Authenticator (TOTP) — RFC 6238 compliant. Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and any TOTP app.</li>
<li>Math CAPTCHA — Server-side arithmetic challenge. No external dependencies. Works offline.</li>
<li>Google reCAPTCHA — v2 (checkbox) or v3 (invisible, score-based).</li>
</ul>
Protect any combination of:
<ul>
<li>Login (wp-login.php + WooCommerce)</li>
<li>Registration (WordPress + WooCommerce)</li>
<li>Forgot Password</li>
<li>Change / Reset Password</li>
<li>Comment Submission</li>
</ul>
<h4>What makes Configify 2FA different</h4>
Security Audit Dashboard — Every 2FA event (success, failure, lockout, setup, method change) is recorded with username, IP address, user agent, and timestamp. Filter, search, and export to CSV directly from your admin panel.
Trusted Device Memory — After verifying, users can choose to trust their current device for a set number of days. Subsequent logins from that device skip the 2FA step. Tokens are cryptographically random and bound to the user agent. Admins can revoke trusted devices per user from the profile screen.
Brute-Force Lockout — Repeated 2FA failures trigger a configurable lockout by user and IP address to stop automated attacks.
Email OTP Fallback — When TOTP is active but a user has not yet set up their authenticator app, a 6-digit one-time code is sent to their email address as a fallback.
Per-Role Enforcement — Require 2FA only for Administrators, Editors, or any custom role. Leave all unchecked to apply to every role.
WooCommerce Support — Hooks into WooCommerce login, registration, lost password, and account password change, not just the default WordPress forms.
<h4>Security Details</h4>
<ul>
<li>TOTP implementation is pure PHP with no third-party library dependency. Secrets are stored in WordPress user-meta and never exposed in plain text.</li>
<li>Math CAPTCHA answers are stored in server-side transients with a 10-minute TTL and consumed on first use.</li>
<li>Pending login sessions are stored in a custom database table, expire after 10 minutes, and are purged daily via WP-Cron.</li>
<li>Trusted device tokens are cryptographically random (48 characters), hashed with wp_hash() before storage, and bound to the user agent string.</li>
<li>All form submissions require a WordPress nonce in addition to the 2FA challenge.</li>
<li>TOTP verification includes a clock-skew tolerance of plus or minus two 30-second windows to account for imprecise device clocks.</li>
</ul>
<h3>External Services</h3>
This plugin connects to the following external services. No data is ever sent to Configify servers.
<h4>Google reCAPTCHA</h4>
This plugin can use Google reCAPTCHA to protect forms. It is only active when the admin selects reCAPTCHA as the 2FA method.
It sends the user’s IP address and a browser interaction token to Google’s servers each time a protected form is submitted.
This service is provided by Google LLC: <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a>, <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
<h4>goQR.me QR Code API</h4>
This plugin uses the goQR.me API (api.qrserver.com) to generate QR code images for Google Authenticator setup. It is only used when a user clicks “Generate QR Code” on the Settings page while TOTP is the active method.
It sends the TOTP URI — which contains the site name, the user’s email address, and the TOTP secret — to api.qrserver.com to generate the QR code image. The service does not store or log QR code contents. The generated image is cached for approximately 30 seconds and then deleted.
This service is provided by goQR.me: <a href="https://goqr.me/legal/tos-api.html" rel="nofollow ugc">Terms of Service</a>, <a href="https://goqr.me/privacy-safety-security/" rel="nofollow ugc">Privacy Policy</a>.
<h4>WooCommerce Compatibility</h4>
Configify 2FA integrates with WooCommerce out of the box with no additional configuration. It hooks into:
<ul>
<li>woocommerce_process_login_errors</li>
<li>woocommerce_process_registration_errors</li>
<li>woocommerce_lostpassword_form</li>
<li>woocommerce_edit_account_form</li>
<li>woocommerce_save_account_details_errors</li>
</ul>
<h4>Privacy</h4>
Configify 2FA stores the following data locally on your server:
<ul>
<li>A TOTP secret and confirmation flag in wp_usermeta.</li>
<li>Trusted device token hashes and expiry timestamps in wp_usermeta.</li>
<li>Pending session tokens in a custom table (wp_c2fa_sessions) — deleted automatically after 10 minutes.</li>
<li>Security audit log entries in a custom table (wp_c2fa_audit_log) — pruned automatically after the configured retention period (default 90 days).</li>
</ul>
All data is removed when the plugin is deleted (via uninstall.php).

Configify 2FA

Flexible Two-Factor Authentication for WordPress. Choose Google Authenticator (TOTP), Math CAPTCHA, or Google reCAPTCHA — with a security audit log.

Fortytwo

<h4>What is Two-factor Authentication?</h4>
Authentication – the process of verifying your identity – boils down to one of three simple elements:
<ul>
<li>Something the user knows (PIN, password)</li>
<li>Something the user owns (mobile phone, device)</li>
<li>Something the user is (biometric, retina, fingerprint)</li>
</ul>
<a href="https://www.fortytwo.com/solutions/two-factor-authentication/" rel="nofollow ugc">Two-factor Authentication</a> (2FA) is a combination of any two of these unique identifiers.
<h4>How does our 2FA plugin work?</h4>
With <a href="https://www.fortytwo.com" rel="nofollow ugc">Fortytwo</a>’s 2FA WordPress plugin, the user only requires the username and password to login to their site (as per any standard login sequence) and a mobile phone to receive the one-time authentication code via SMS.
Our plugin is fully customisable and can be adapted to meet your specific needs, for example, you can assign 2FA to certain users depending on their specific administrative roles in WordPress and disable 2FA for users when they are using a known or ‘trusted’ device for a specific period of time. Fortytwo’s WordPress 2FA plugin offers the unique advantage of providing a highly customisable authentication process for users and provides an additional level of security when and as required.
<h4>What features does it include?</h4>
Fortytwo’s WordPress plugin comes with a myriad of features including the option to:
<ul>
<li>activate or disable 2FA for registration and/or login allowing the user to login using a username, password and 2FA or just a username and password</li>
<li>activate 2FA for login according to the user’s role in WordPress, for example, you can disable 2FA for certain users such as subscribers while maintaining 2FA for users with critical roles</li>
<li>Activate 2FA as optional or mandatory option for users, so you can give to your user the option to activate 2FA or force the option by default.</li>
<li>assign ‘trusted’ devices to specific users allowing the user – after their initial 2FA login – to validate their devices as ‘trusted’ for a specific time period, assigned by them in the settings. This option ensures that users aren’t required to enter an authentication code repeatedly with an assigned trusted device, after the initial 2FA login</li>
<li>resend the authentication code after registration if the SMS was not received – this allows the user to request the authentication code after 60 seconds and/or change his phone number in the event that an incorrect phone number was submitted</li>
<li>resend the authentication code after login if the SMS was not received – this allows the user to request the authentication code again after 60 seconds – this re-send option can also be disabled in the settings</li>
<li>to customize the behavior of the 2FA as <a href="https://www.fortytwo.com/apis/two-factor-authentication/" rel="nofollow ugc">documented on the API</a> including changes to the authentication code length and type (numeric, alpha or alphanumeric), case sensitive validation, options to log a response via a callback URL and customise sender ID ‘s visible to the users</li>
</ul>
Fortytwo’s 2FA WordPress plugin supports 2FA for all Smart phones (iPhone, Android, BlackBerry), as well as basic phones.
<h4>Why use Fortytwo’s WordPress plugin?</h4>
<ul>
<li>Security Incorporating 2FA in to the user login process, creates a level of protection and security for your WordPress site that complex passwords can no longer guarantee</li>
<li>Customised functionality This is our first version of the plugin and we’re keenly interested in your feedback.</li>
</ul>
If there is additional functionality that you would you like to see, please let us know – we are happy to work on developing features to meet your specific requirements and endeavor to implement this in as short a time-frame as possible.
<h3>Configuration</h3>
Once the plugin is activated you have to configure the plugin before use:
<ol>
<li>In the admin panel go to Settings > Two Factor Authentication</li>
<li>Enter the token you have from the <a href="https://controlpanel.fortytwo.com/" rel="nofollow ugc">fortytwo control panel</a></li>
<li>Configure the other options accordingly to your needs</li>
<li>push the save button</li>
</ol>
Note: The Two factor authentication works only for the users who have the 2FA phone number on their profile.
<h3>Version 1.1.1</h3>
2016-12-22 
* [IMPROVEMENT] Support for WordPress 4.6.X. 
* [IMPROVEMENT] Don’t call login_header if the function was disabled.
<h3>Version 1.1.0</h3>
2016-10-04 
* [IMPROVEMENT] Support for WordPress 4.6.X. 
* [IMPROVEMENT] Update SDK dependencies. 
* [IMPROVEMENT] Phone field rendering updated. 
* [IMPROVEMENT] New API Paremeter : Message template to personalize the message sent with the 2FA Code. 
* [IMPROVEMENT] New Mandatory option allowing to have 2FA option as optional or mandatory on login and/or on register.
<h3>Version 1.0.8</h3>
2016-05-02 
* [DOCUMENTATION] Fix typo in the readme file.
<ul>
<li>[DOCUMENTATION] Fix typo in the readme file.</li>
</ul>
<h4>Version 1.0.7</h4>
2016-05-02 
* [BUG] Update publish script to properly track/add new files and directory and untrack/delete deleted files. 
* [BUG] Clean the SVN tree.
<ul>
<li>[BUG] Update publish script to properly track/add new files and directory and untrack/delete deleted files.</li>
<li>[BUG] Clean the SVN tree.</li>
</ul>
<h4>Version 1.0.6</h4>
2016-04-28 
* [BUG] Settings – Update “API Sensitive case” field ID. 
* [DOCUMENTATION] Change “why” items to list.
<ul>
<li>[BUG] Settings – Update “API Sensitive case” field ID.</li>
<li>[DOCUMENTATION] Change “why” items to list.</li>
</ul>
<h4>Version 1.0.5</h4>
2016-04-26 
* [IMPROVEMENT] Update contributor id
<ul>
<li>[IMPROVEMENT] Update contributor id</li>
</ul>
<h4>Version 1.0.4</h4>
2016-04-25 
* [IMPROVEMENT] Support for WordPress 4.5
<ul>
<li>[IMPROVEMENT] Support for WordPress 4.5</li>
</ul>
<h4>Version 1.0.3</h4>
2016-04-25 
* [DOCUMENTATION] Add some tags on the presentation of the plugin. 
* [DOCUMENTATION] Update the screenshots. 
* [DOCUMENTATION] Update readme.txt description.
<ul>
<li>[DOCUMENTATION] Add some tags on the presentation of the plugin.</li>
<li>[DOCUMENTATION] Update the screenshots.</li>
<li>[DOCUMENTATION] Update readme.txt description.</li>
</ul>
<h4>Version 1.0.2</h4>
2016-04-20 
* [DOCUMENTATION] Fix header description to feet in 150 characters
<ul>
<li>[DOCUMENTATION] Fix header description to feet in 150 characters</li>
</ul>
<h4>Version 1.0.1</h4>
2016-04-20 
* [DOCUMENTATION] Update the readme.txt
<ul>
<li>[DOCUMENTATION] Update the readme.txt</li>
</ul>
<h4>Version 1.0.0</h4>
2016-04-19 
* First stable version.
<ul>
<li>First stable version.</li>
</ul>
<h4>Version 1.0.0-RC11</h4>
2016-04-19 
* [BUG] Fix error message when invalid token used. 
* [BUG] Fix a typo. 
* [IMPROVEMENT] Update readme.txt
<ul>
<li>[BUG] Fix error message when invalid token used.</li>
<li>[BUG] Fix a typo.</li>
<li>[IMPROVEMENT] Update readme.txt</li>
</ul>
<h4>Version 1.0.0-RC10</h4>
2016-04-18 
* [BUG] Fix phone number validation on register. 
* [BUG] Fix various typos. 
* [BUG] Fix code validation on register/login 
* [BUG] Fix bug when we validate code after a fail on register. 
* [BUG] Fix inconsistency on naming of authentication code.
<ul>
<li>[BUG] Fix phone number validation on register.</li>
<li>[BUG] Fix various typos.</li>
<li>[BUG] Fix code validation on register/login</li>
<li>[BUG] Fix bug when we validate code after a fail on register.</li>
<li>[BUG] Fix inconsistency on naming of authentication code.</li>
</ul>
<h4>Version 1.0.0-RC9</h4>
2016-04-14 
* [BUG] Device was always setup as trusted. 
* [BUG] Fix missing phone helper on edit user. 
* [BUG] Fix nullable callbackurl. 
* [BUG] Fix validation code after one fail. 
* [BUG] Fix resend option on login.
<ul>
<li>[BUG] Device was always setup as trusted.</li>
<li>[BUG] Fix missing phone helper on edit user.</li>
<li>[BUG] Fix nullable callbackurl.</li>
<li>[BUG] Fix validation code after one fail.</li>
<li>[BUG] Fix resend option on login.</li>
</ul>
<h4>Version 1.0.0-RC8</h4>
2016-04-12 
* [BUG] Add missing jquery dependency on login 
* [BUG] Fix Trusted device Activate/Disabled option 
* [BUG] Fix naming convention for Authentication code 
* [IMPROVEMENT] Update in code documentation 
* [IMPROVEMENT] Adding field validation in the settings 
* [BUG] Fix missing dependency * Jquery 
* [BUG] Fix a typo on setting panel. 
* [BUG] Fix a bug with the cookie path.
<ul>
<li>[BUG] Add missing jquery dependency on login</li>
<li>[BUG] Fix Trusted device Activate/Disabled option</li>
<li>[BUG] Fix naming convention for Authentication code</li>
<li>[IMPROVEMENT] Update in code documentation</li>
<li>[IMPROVEMENT] Adding field validation in the settings</li>
<li>[BUG] Fix missing dependency – Jquery</li>
<li>[BUG] Fix a typo on setting panel.</li>
<li>[BUG] Fix a bug with the cookie path.</li>
</ul>
<h4>Version 1.0.0-RC7</h4>
2016-04-06 
* [BUG] Resend SMS no showing on login. 
* [BUG] Disable 2FA on register not working properly.
<ul>
<li>[BUG] Resend SMS no showing on login.</li>
<li>[BUG] Disable 2FA on register not working properly.</li>
</ul>
<h4>Version 1.0.0-RC6</h4>
2016-04-06 
* [IMPROVEMENTS] Updating versions numbers
<ul>
<li>[IMPROVEMENTS] Updating versions numbers</li>
</ul>
<h4>Version 1.0.0-RC5</h4>
2016-04-04 
* [IMPROVEMENTS] Small fixes
<ul>
<li>[IMPROVEMENTS] Small fixes</li>
</ul>
<h4>Version 1.0.0-RC4</h4>
2016-04-04 
* [IMPROVEMENTS] Fixing various bugs 
* [IMPROVEMENTS] Adding screenshots for the wordpress plugin website
<ul>
<li>[IMPROVEMENTS] Fixing various bugs</li>
<li>[IMPROVEMENTS] Adding screenshots for the wordpress plugin website</li>
</ul>
<h4>Version 1.0.0-RC3</h4>
2016-04-01 
* [IMPROVEMENTS] Adding assets : banner and icons.
<ul>
<li>[IMPROVEMENTS] Adding assets : banner and icons.</li>
</ul>
<h4>Version 1.0.0-RC2</h4>
2016-03-30 
* [IMPROVEMENTS] Update assets for WordPress publication 
* [IMPROVEMENTS] Add publish.sh file for publishing version on the SVN repo.
<ul>
<li>[IMPROVEMENTS] Update assets for WordPress publication</li>
<li>[IMPROVEMENTS] Add publish.sh file for publishing version on the SVN repo.</li>
</ul>
<h4>Version 1.0.0-RC1</h4>
2016-03-24 
* [IMPROVEMENTS] : Add Readme.txt for wordpress repo and the icon image. 
* [IMPROVEMENTS] : Updating documentation. 
* [FEATURES] : Initial features.
<ul>
<li>[IMPROVEMENTS] : Add Readme.txt for wordpress repo and the icon image.</li>
<li>[IMPROVEMENTS] : Updating documentation.</li>
<li>[FEATURES] : Initial features.</li>
</ul>

Fortytwo – Two-Factor Authentication

Fortytwo’s 2FA plugin controls access to your site by sending an authentication code via SMS to your mobile phone when you register or login.

Configify 2FA vs Fortytwo – Two-Factor Authentication