Adam Greenwell

Guard Dog is a comprehensive security plugin designed to protect your WordPress site from unauthorized access and brute-force attacks. With features like custom login URLs, two-factor authentication, and multiple CAPTCHA providers, Guard Dog provides enterprise-level security for any WordPress site.
Key Features:
<ul>
<li>Custom Login URLs – Hide your wp-admin and wp-login.php from attackers</li>
<li>Two-Factor Authentication (2FA) – TOTP-based authentication with recovery codes</li>
<li>Multiple CAPTCHA Providers – Support for Google reCAPTCHA v2/v3, hCaptcha, and Cloudflare Turnstile</li>
<li>Login Attempt Limiting – Prevent brute-force attacks with intelligent lockout</li>
<li>Access Control – IP-based whitelist/blacklist protection</li>
<li>Activity Monitoring – Comprehensive logging of security events</li>
<li>Temporary User Access – Create temporary WordPress users with time-limited, secure access</li>
<li>User Management – Advanced user permission controls</li>
</ul>
Why Choose Guard Dog?
<ul>
<li>Privacy-Focused – Multiple CAPTCHA options including privacy-first providers</li>
<li>WordPress.org Compliant – Built following WordPress coding standards</li>
<li>Enterprise-Ready – Scalable features suitable for any site size</li>
<li>User-Friendly – Intuitive interface with helpful documentation</li>
<li>Regular Updates – Actively maintained and updated</li>
</ul>
Perfect For:
<ul>
<li>Business websites requiring enhanced security</li>
<li>WordPress sites handling sensitive data</li>
<li>Multi-user sites with complex access requirements</li>
<li>Anyone wanting comprehensive protection without complexity</li>
</ul>
<h3>Additional Information</h3>
Support: 
For support questions, please use the WordPress.org support forums.
Privacy: 
Guard Dog respects user privacy and offers multiple privacy-focused CAPTCHA options. No data is transmitted to third parties except for CAPTCHA verification when enabled.
Security: 
Guard Dog follows WordPress security best practices and undergoes regular security audits. All user input is sanitized and all output is escaped.
<h3>Third-Party Services</h3>
Guard Dog integrates with the following third-party services to provide CAPTCHA protection. These services are optional and only used when CAPTCHA features are enabled.
<h3>Google reCAPTCHA (v2 and v3)</h3>
What it is: Google’s CAPTCHA service that helps protect websites from spam and abuse.
What it’s used for: 
– Verifying that login, registration, and password reset attempts are made by humans 
– Preventing automated bot attacks on your WordPress forms
What data is sent and when: 
– User interaction data (mouse movements, time spent on page) when CAPTCHA is solved 
– IP address of the user 
– Site domain for verification 
– CAPTCHA response token
Privacy and Terms: 
– <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google reCAPTCHA Privacy Policy</a> 
– <a href="https://policies.google.com/terms" rel="nofollow ugc">Google reCAPTCHA Terms of Service</a> 
– <a href="https://developers.google.com/recaptcha/docs/v3#data_usage" rel="nofollow ugc">Google reCAPTCHA Data Usage</a>
<h3>Cloudflare Turnstile</h3>
What it is: Cloudflare’s privacy-first CAPTCHA alternative that doesn’t require user interaction.
What it’s used for: 
– Invisible verification of human users during login, registration, and password reset 
– Privacy-focused protection without tracking or cookies
What data is sent and when: 
– Non-interactive browser signals when forms are submitted 
– IP address for verification 
– Site domain for validation
Privacy and Terms: 
– <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a> 
– <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Service</a> 
– <a href="https://developers.cloudflare.com/turnstile/" rel="nofollow ugc">Turnstile Documentation</a>
<h3>hCaptcha</h3>
What it is: A privacy-focused CAPTCHA service that doesn’t track users across websites.
What it’s used for: 
– Human verification during login, registration, and password reset forms 
– Privacy-conscious alternative to Google reCAPTCHA
What data is sent and when: 
– User interaction with CAPTCHA challenge 
– IP address for verification 
– Site domain for validation
Privacy and Terms: 
– <a href="https://www.hcaptcha.com/privacy" rel="nofollow ugc">hCaptcha Privacy Policy</a> 
– <a href="https://www.hcaptcha.com/terms" rel="nofollow ugc">hCaptcha Terms of Service</a> 
– <a href="https://www.hcaptcha.com/data-processing" rel="nofollow ugc">hCaptcha Data Processing</a>
<h3>TOTP (Time-based One-Time Password) Standard</h3>
What it is: An open standard (RFC 6238) for generating time-based one-time passwords used in two-factor authentication.
What it’s used for: 
– Generating secure, time-limited authentication codes for 2FA 
– Providing backup authentication when primary 2FA methods are unavailable 
– Enabling compatibility with popular authenticator apps (Google Authenticator, Authy, Microsoft Authenticator, etc.)
What data is sent and when: 
– No external data transmission – TOTP codes are generated locally using the TOTP algorithm 
– Secret key generation – A unique secret key is generated locally when 2FA is enabled for a user 
– QR code generation – QR codes are generated locally for easy setup with authenticator apps 
– Code verification – Generated codes are verified locally against the stored secret key
Privacy and Terms: 
– <a href="https://tools.ietf.org/html/rfc6238" rel="nofollow ugc">RFC 6238 – TOTP Standard</a> 
– <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google Authenticator Privacy Policy</a> (if using Google Authenticator app) 
– <a href="https://authy.com/privacy/" rel="nofollow ugc">Authy Privacy Policy</a> (if using Authy app) 
– <a href="https://privacy.microsoft.com/en-us/privacystatement" rel="nofollow ugc">Microsoft Authenticator Privacy Policy</a> (if using Microsoft Authenticator app)
<h3>Data Handling Summary</h3>
When CAPTCHA is disabled: No data is sent to any third-party services.
When CAPTCHA is enabled: Only the specific provider you choose receives verification data. Data is not shared between providers or stored by Guard Dog beyond the verification process.
When 2FA is disabled: No external data transmission occurs.
When 2FA is enabled: 
– All TOTP operations (code generation, verification) happen locally on your server 
– No data is transmitted to external services for 2FA functionality 
– Authenticator apps only receive the initial setup QR code or secret key 
– Recovery codes are generated locally and stored securely
User control: Users can choose which CAPTCHA provider to use, or disable CAPTCHA entirely. 2FA can be enabled/disabled per user, and users can choose their preferred authenticator app. All security features are optional and configurable.

Guard Dog

Comprehensive WordPress security plugin with custom login URLs, two-factor authentication, CAPTCHA protection, event and activity logging, as well as  …

miniOrange

twofactorauthentication

twofactor

Google Authenticator

Secure WordPress logins with Two-Factor Authentication (2FA). Use MFA, TOTP, OTP via SMS, Email, and WhatsApp 2FA for extra protection.
<h3>Secure your WordPress site with Two-Factor Authentication (2FA) plugin</h3>
The miniOrange <a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa" rel="nofollow ugc">Two-Factor Authentication (2FA)</a> plugin adds an extra layer of login protection to your WordPress website, defending against unauthorized access, brute-force attacks, and password theft.
Whether you’re a beginner or an expert, setting up this plugin is easy with our step-by-step wizard. Choose from Google Authenticator, Microsoft Authenticator, OTP login via email, SMS, WhatsApp 2FA, or Telegram, and <a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#2fa-methods" rel="nofollow ugc">more</a>. 
Have questions? Reach us at <a href="2fasupport@xecurify.com" rel="nofollow ugc">2fasupport@xecurify.com</a>
<a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#key-features" rel="nofollow ugc">Features</a> | <a href="https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication" rel="nofollow ugc">Setup Guide</a> | <a href="https://plugins.miniorange.com/wordpress-two-factor-authentication-setup-guides" rel="nofollow ugc">Documentation</a>
<h3>What is the 2FA Authenticator Plugin for WordPress?</h3>
The WP 2Factor Authenticator plugin for WordPress adds an extra verification step, such as an OTP, beyond just your password. Easy to install and configure, this OTP authentication plugin secures your site without disrupting the user experience.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/rE-awZZt13Q?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>WordPress 2FA Key Features (Free Version)</h3>
<ul>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step1" rel="nofollow ugc">User Role-Based Configuration:</a> Apply 2FA or MFA selectively based on user roles or configure it individually per user for more control over who needs additional verification.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step3" rel="nofollow ugc">Backup Access Support:</a> Let users generate and use backup codes or email verification links to log in when their primary 2FA method is unavailable.</li>
<li>Guided Setup Wizard: An intuitive step-by-step wizard makes it easy to configure and deploy 2FA—no technical skills required.</li>
<li>Multi-Language Support: The plugin is translation-ready and supports major languages, including French, Spanish, Italian, and German.</li>
<li>Free for 3 Users: Includes full access to 2FA features for up to three users—ideal for small teams or personal sites.</li>
<li>Customize Email Templates: Personalize OTP and 2FA emails to reflect your brand and improve user trust.</li>
<li>2FA Login Reports & IP Alerts: Track login activity and get email alerts for logins from new IP addresses.</li>
<li>Custom Post-Login Redirection: Redirect users to any page after 2FA, like a dashboard, homepage, or custom URL.</li>
<li>Custom Labels in Authenticator Apps: Customize the account name shown in Google Authenticator and other apps for clearer identification.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress#step1" rel="nofollow ugc">2FA for Popular Login Forms:</a> Enable 2FA on WooCommerce, Theme My Login, Elementor, and other login forms.</li>
</ul>
<h3>Which 2FA Authentication Methods Do We Support?</h3>
Get support for a wide range of 2FA authentication methods, including Google Authenticator, OTP over SMS/Email, WhatsApp 2FA, Microsoft Authenticator, and more.
<ol>
<li>
TOTP-Based Authentication: Our WP 2Factor plugin is compatible with popular authenticator apps, including:
<blockquote>
<ul>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Google Authenticator:</a> A widely trusted TOTP app that generates rotating login codes every 30 seconds—ideal for fast and offline verification.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Microsoft Authenticator:</a> Easily syncs with your Microsoft account and supports time-based one-time passcodes for secure WordPress login.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">LastPass Authenticator:</a> Combines password management with strong 2FA protection by generating time-based codes linked to your LastPass account.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Duo Authenticator:</a> Enterprise-ready authentication app offering secure TOTP codes and push notifications for streamlined two-factor login.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">Authy 2-Factor Authenticator:</a> Supports multi-device syncing and cloud backups while generating secure TOTP codes for your WordPress login.</li>
<li><a href="https://plugins.miniorange.com/setup-two-factor-authentication-using-authenticator-apps" rel="nofollow ugc">FreeOTP</a>, and other</li>
</ul>
</blockquote>
</li>
<li>
OTP Authentication:
<blockquote>
<ul>
<li><a href="https://plugins.miniorange.com/otp-over-email-for-wordpress-two-factor-authentication-2fa-mfa" rel="nofollow ugc">OTP via Email:</a> Send one-time passcodes to users directly via email for secure and convenient login verification with OTP Over Email support.</li>
<li><a href="https://plugins.miniorange.com/otp-over-sms-for-wordpress-two-factor-authentication-2fa-mfa" rel="nofollow ugc">OTP via SMS:</a> Get login codes to users through SMS for fast two-step OTP login verification on mobile devices.</li>
<li><a href="https://plugins.miniorange.com/login-with-telegram-as-a-two-factor-method-for-wordpress" rel="nofollow ugc">OTP over Telegram:</a> Use Telegram for OTP authentication if you prefer messaging-based login verification.</li>
<li><a href="https://plugins.miniorange.com/whatsapp-two-factor-authentication-setup-for-wordpress-2fa-plugin" rel="nofollow ugc">OTP over WhatsApp(Premium):</a> Use WhatsApp 2FA to send login passcodes directly to the user’s WhatsApp account for a faster and familiar authentication experience.</li>
</ul>
</blockquote>
</li>
<li>
<a href="https://plugins.miniorange.com/how-to-setup-email-verification-for-2-factor-authentication-wordpress-2fa" rel="nofollow ugc">Email Verification via Link:</a> Let users verify their login using a secure one-click email verification link—no passcode entry needed.
</li>
<li>
<a href="https://plugins.miniorange.com/setup-security-questions-for-two-factor-authentication-wordpress-2fa" rel="nofollow ugc">Security Questions:</a> Add a personal security layer by asking predefined questions during login, ideal as a backup or secondary method.
</li>
</ol>
<h3>Upgrade to miniOrange 2FA Premium for Advanced Security</h3>
The premium plan of miniOrange WordPress 2FA gives you complete control over how users authenticate, helping you enforce policies across all roles, customize the login experience, and secure even the most complex WordPress setups. 
With the premium Two Factor Authentication plugin, you gain access to more verification methods like unlimited OTP login via email/SMS, WhatsApp 2FA, trusted device support, multisite compatibility, and full branding capabilities—perfect for growing businesses, eCommerce platforms, and enterprise teams.
<h4>Premium Features List</h4>
<blockquote>
<ul>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step1" rel="nofollow ugc">2FA for All Users & Roles:</a> Enforce 2FA across your entire website or apply it selectively to specific user roles or individual users.</li>
<li>Unlimited Email OTP Transactions: Send unlimited email-based one-time passcodes—ideal for large-scale user bases and frequent login environments.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress?select-2fa=2fa-for-specific-role#step2" rel="nofollow ugc">Role-Based 2FA Policies:</a> Create different 2FA rules for each user role—require stronger authentication for admins while offering simpler methods for customers.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step2" rel="nofollow ugc">User-Specific 2FA Management:</a> Enable or disable 2FA for individual users directly from their profile or admin settings.</li>
<li><a href="https://plugins.miniorange.com/enable-2fa-on-specific-pages-wordpress" rel="nofollow ugc">Page-Protection with 2FA:</a> Add two-factor authentication (2FA) protection to selected pages for enhanced security. </li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-quick-setup-tab-wordpress#step3" rel="nofollow ugc">Backup Login Options:</a> Allow users to log in using alternate methods like security questions, email-based OTP, or backup codes when the default method is inaccessible.</li>
<li>Custom Redirect After 2FA: Send users to a specific page (dashboard, custom welcome, etc.) after completing 2FA authentication.</li>
<li><a href="https://plugins.miniorange.com/how-to-setup-custom-security-questions-kba-from-wordpress-wp-2fa" rel="nofollow ugc">Custom Security Questions:</a> Set your own challenge questions to match your organization’s security policies.</li>
<li>Force 2FA Setup on Login: Automatically prompt users to configure 2FA on their next login and restrict access until it’s enabled.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-remember-device-with-two-factor-authentication-2fa" rel="nofollow ugc">Trusted Devices Feature:</a> Let users remember their device or browser to bypass 2FA on trusted systems for future logins.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-login-popup-tab-wordpress#step2" rel="nofollow ugc">Customizable Login UI:</a> Easily style 2FA prompts and popups to match your theme and brand—no coding needed.</li>
<li>Multisite Compatibility: Support for WordPress multisite networks, with 2FA settings across up to 3 subsites included.</li>
<li><a href="https://plugins.miniorange.com/configure-2fa-settings-login-popup-tab-wordpress#step1" rel="nofollow ugc">White Labeling & Branding:</a> Fully rebrand the login or registration forms with your logo, colors, and email templates to offer a seamless branded experience.</li>
<li>Shortcodes for User Profile Controls: Add 2FA management shortcodes to user account pages so users can enable, disable, or reconfigure their 2FA settings.</li>
<li><a href="https://plugins.miniorange.com/prevent-account-sharing-restrict-concurrent-sessions-wordpress-session-restriction" rel="nofollow ugc">Session Management Controls:</a> Restrict users from logging in on multiple devices simultaneously to prevent unauthorized access or credential sharing.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-passwordless-login-as-a-login-screen-options-wordpress-2fa" rel="nofollow ugc">Passwordless Login:</a> Let users log in using a one-time passcode—no password required—while maintaining strong account security.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress" rel="nofollow ugc">Support for Custom & Third-Party Login Forms:</a> Works seamlessly with plugins like UserPro, Login with Ajax, Theme My Login, and more.</li>
<li>Custom SMS Gateway Support: Integrate your own SMS gateway to send OTPs, giving you full control over delivery, cost, and sender branding.</li>
<li><a href="https://plugins.miniorange.com/setup-remember-whitelist-ip-2fa-wordpress" rel="nofollow ugc">Remember IP to Bypass 2FA:</a> Mark trusted IP addresses to skip 2FA prompts and streamline login for internal users or safe environments.</li>
<li>Prevent Credential Sharing: Restrict multiple logins from different IPs or devices, helping you enforce strict account access policies and stop sharing.</li>
<li><a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress#step2" rel="nofollow ugc">Custom Form Integration:</a> Add 2FA to any custom login form—even those not on the supported list—through flexible integration and custom support.</li>
</ul>
</blockquote>
<h3>Which 2FA Authentication Methods Do We Support?</h3>
<h4>Step 1. Install and Activate</h4>
<blockquote>
<blockquote>
Search for the miniOrange Two-Factor Authentication plugin on the WordPress marketplace, then install and activate it from your dashboard.
</blockquote>
</blockquote>
<h4>Step 2. Enable 2FA from the Quick Setup Tab</h4>
<blockquote>
<blockquote>
Enable 2FA from the quick setup tab, choose user roles, and save your settings.
</blockquote>
</blockquote>
<h4>Configure 2FA Method of Your Choice</h4>
<blockquote>
<blockquote>
Select and set up your preferred <a href="https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication#step3" rel="nofollow ugc">2FA authentication method</a>, such as Google Authenticator, OTP over SMS, or WhatsApp 2FA, from the available options while logging into the form for the first time.
</blockquote>
</blockquote>
<h3>Built to Integrate Seamlessly</h3>
Two Factor Authentication – WordPress 2FA/MFA plugin is compatible with <a href="https://plugins.miniorange.com/how-to-set-up-2fa-on-custom-login-form-wordpress" rel="nofollow ugc">popular plugins</a> such as:-
<ul>
<li>WooCommerce </li>
<li>Ultimate ember</li>
<li>Buddy Press</li>
<li>Elementor Pro</li>
<li>Login With Ajax</li>
<li>User Registration</li>
<li>Restrict Content Pro</li>
<li>Login Press</li>
<li>Registration Magic</li>
<li>Admin Custom Login</li>
<li>Theme My Login</li>
<li>Profile Builder and many more.</li>
</ul>
Have a form not listed here? We offer custom integration support—just reach out.
<h3>Third-Party Custom SMS Gateway for OTP via SMS</h3>
The premium version of the miniOrange Two-Factor Authentication plugin supports any third-party SMS gateway for OTP-based login via SMS. 
Whether you already use a custom SMS provider or need to integrate with a local/regional provider, you can easily configure it within the plugin 
 <a href="https://plugins.miniorange.com/sms-email-gateways-supported-by-2fa-plugin" rel="nofollow ugc">Famous SMS gateways supported by Two Factor Authentication – WordPress 2FA plugin</a>.
<h3>Why You Need to Register with miniOrange?</h3>
Some features of the plugin, such as OTP via SMS or Email in the Free plugin, require secure transactions needed to be credited to your account to use this method through the miniOrange Gateway. 
However, most features work even without registration, including TOTP apps like Google Authenticator, Microsoft Authenticator, security-based questions, and backup codes.
Customized solutions and active support for the miniOrange Google Authenticator or Two Factor Authentication(2FA) plugin are available. Email us at info@xecurify.com/2fasupport@xecurify.com or call us at +1 9786589387.

miniOrange 2-factor Authentication (2FA with SMS, Email, Google Authenticator)

Piyush provided the assistance I needed. the great support team for the free version is also... Very much appreciated!  5 stars are well deserved.

Great plugin with great support

Easy to use and Aswesome support


It's indeed a great plugin, with lot of options for many scenarios. 



One thing that it lacks is customization of the page of OTP, but you can modify /wp-content/plugins/miniorange-2-factor-authentication/controllers/twofa/mo2fa-common-login.php if you know what you're doing (it's just HTML to edit, nothing more).



The plugin have a good documentation and video tutorials, and, a nice thing, a support box right inside the plugin's page to contact support if you need anything.


Great plugin with nice funtionality

Secure WordPress logins with Two-Factor Authentication (2FA). Use MFA, TOTP, OTP via SMS, Email, and WhatsApp 2FA for extra protection.

Guard Dog vs miniOrange 2-factor Authentication (2FA with SMS, Email, Google Authenticator)