kuckovic

<p><strong>Flavor 2FA</strong> adds powerful two-factor authentication to your WordPress site without the complexity. No bloat, no confusing settings – just solid security that protects your site from unauthorized access.</p>
<h4>Why Flavor 2FA?</h4>
<ul>
<li><strong>Zero configuration needed</strong> – Works out of the box</li>
<li><strong>Native WordPress styling</strong> – Feels like part of WordPress</li>
<li><strong>Two verification methods</strong> – Authenticator apps (Google Authenticator, Authy, 1Password) or email codes</li>
<li><strong>User-friendly setup</strong> – Guided 3-step process with QR code scanning</li>
<li><strong>Complete admin control</strong> – Force 2FA, reset users, manage lockouts</li>
</ul>
<h4>Features</h4>
<p><strong>For Users:</strong><br />
* Choose between authenticator app or email verification<br />
* 10 recovery codes for emergency access<br />
* “Trust this device” option to skip 2FA on personal devices<br />
* Simple, clean verification screens</p>
<p><strong>For Admins:</strong><br />
* Require 2FA for specific user roles<br />
* Grace period for new users<br />
* Force immediate 2FA setup on next login<br />
* Lockout protection against brute force attacks<br />
* Reset 2FA or unlock accounts with one click<br />
* See 2FA status for all users at a glance</p>
<h4>Perfect For</h4>
<ul>
<li>Agencies managing client sites</li>
<li>WooCommerce stores handling sensitive data</li>
<li>Membership sites with user accounts</li>
<li>Any WordPress site that needs extra security</li>
</ul>
<h3>External services</h3>
<p>This plugin uses a third-party service to generate QR codes during the TOTP authenticator app setup process.</p>
<h4>QR Server API</h4>
<p>When a user chooses the “Authenticator App” method during 2FA setup, the plugin generates a QR code image via the QR Server API. This QR code contains the TOTP secret URI (which includes the site name, user email, and secret key) so the user can scan it with their authenticator app.</p>
<ul>
<li><strong>What data is sent:</strong> A TOTP provisioning URI containing the site name, user email address, and a generated secret key.</li>
<li><strong>When it is sent:</strong> Only once, when a user sets up TOTP-based two-factor authentication. No data is sent during normal login verification.</li>
<li><strong>Service provider:</strong> goQR.me / QR Server</li>
<li><strong>Service URL:</strong> <a href="https://goqr.me/api/" rel="nofollow ugc">https://goqr.me/api/</a></li>
<li><strong>Terms of service:</strong> <a href="https://goqr.me/api/doc/" rel="nofollow ugc">https://goqr.me/api/doc/</a></li>
<li><strong>Privacy policy:</strong> <a href="https://goqr.me/privacy-policy/" rel="nofollow ugc">https://goqr.me/privacy-policy/</a></li>
</ul>


Flavor 2FA

Lightweight two-factor authentication that just works. Protect your WordPress site with authenticator apps or email codes in under 2 minutes.

Michael Finkenberger

<p><strong>WP Access Control Center</strong> is a powerful security control center for WordPress administrators who want full control over authentication, sessions, and password policies.</p>
<p>Take control of your site’s access layer with real-time session monitoring, flexible two-factor authentication, and powerful emergency tools — all in one place.</p>
<h3>🔐 Two-Factor Protection</h3>
<ul>
<li>Email-based verification codes</li>
<li>TOTP support (Google Authenticator, Microsoft Authenticator, Authy, etc.)</li>
<li>Role-based enforcement</li>
<li>Grace periods for smooth rollout</li>
<li>Backup codes for account recovery</li>
<li>Trusted devices to reduce login friction</li>
</ul>
<h3>👁️ Live Session Control</h3>
<ul>
<li>Real-time overview of all active sessions (AJAX-powered)</li>
<li>Inspect session details and parameters</li>
<li>Instantly terminate individual or all sessions</li>
<li>Monitor user activity as it happens</li>
</ul>
<h3>🔑 Password Policies</h3>
<ul>
<li>Enforce password strength requirements</li>
<li>Prevent password reuse</li>
<li>Define role-based password expiration</li>
<li>Real-time feedback during password creation</li>
</ul>
<h3>⚡ Bulk Password Reset</h3>
<ul>
<li>Reset passwords for roles or selected users</li>
<li>Optionally terminate related sessions</li>
<li>Automatic email notifications (fully customizable)</li>
</ul>
<h3>🔄 Security Key Rotation</h3>
<ul>
<li>One-click regeneration of WordPress KEYs & SALTs</li>
<li>Immediately invalidates all active sessions</li>
<li>Essential for incident response</li>
</ul>
<h3>⏱️ Advanced Session Control</h3>
<ul>
<li>Configure session lifetime per role</li>
<li>Separate rules for “Remember Me”</li>
<li>Automatic cleanup of expired sessions</li>
</ul>
<h3>🎨 Login Experience Designer</h3>
<ul>
<li>Customize the 2FA login page</li>
<li>Background images (outer & inner)</li>
<li>Flexible CSS customization</li>
<li>Safe defaults – no changes unless configured</li>
</ul>
<p><strong>No external services required.</strong> Everything runs locally within your WordPress installation.</p>


WP Access Control Center

Take full control over authentication, sessions, and password security in WordPress – including real-time session monitoring, 2FA, and emergency tools

Flavor 2FA vs WP Access Control Center