harish282

<p>NiyiGuard hardens WordPress at the <strong>application layer</strong>: login abuse, accountability, file integrity, browser security headers, optional rate limits, and WooCommerce-specific threats. It <strong>complements</strong> your host firewall, CDN, or WAF — it does not replace them.</p>
<p>Source code and issue tracker: https://github.com/harish282/securepress</p>
<h4>Why install NiyiGuard?</h4>
<ul>
<li><strong>Self-hosted</strong> — security data stays on your server; no NiyiGuard account and no usage telemetry to the author.</li>
<li><strong>One dashboard</strong> — enable or disable modules (authentication, audit log, integrity, headers, rate limits, WooCommerce protection).</li>
<li><strong>For store owners</strong> — reduce fake checkouts, cart and coupon abuse, registration spam, and Store API abuse when WooCommerce is active.</li>
<li><strong>For developers</strong> — protect custom <code>admin-post</code> handlers, forms, and REST routes with the <strong>Security SDK</strong> (CSRF, rate limits, signed URLs, route guards).</li>
<li><strong>Fully free</strong> — no license key, beta trial, or paywalled module in 0.1.0.</li>
</ul>
<h4>What makes it different?</h4>
<p>Many security plugins offer two-factor auth, lockouts, headers, or malware scanning. NiyiGuard does not claim to be the only plugin with those features. It stands out in three ways:</p>
<ol>
<li><strong>Developer SDK</strong> — middleware-style helpers for <strong>your</strong> code paths, not only wp-admin toggles.</li>
<li><strong>WooCommerce abuse pipelines</strong> — checkout, cart, registration, and Store API protection in the same package as audit logging and login hardening.</li>
<li><strong>Privacy-first</strong> — no license server and no analytics to the author (see Privacy section below).</li>
</ol>
<p>Longer positioning notes and reusable marketing copy: <code>docs/WHY_NIYIGUARD.md</code>.</p>
<h4>Features included (0.1.0)</h4>
<ul>
<li><strong>Authentication hardening</strong> — login lockouts (IP and username), TOTP and email two-factor authentication, recovery codes, session tracking with remote revoke, and new-device suspicious-login email alerts.</li>
<li><strong>Security headers</strong> — HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options (each header can be toggled).</li>
<li><strong>Audit log</strong> — logins, plugin changes, role changes, selected option changes, file editor use, and WooCommerce-related actions. Admin list UI, detail view, retention, and scheduled pruning.</li>
<li><strong>File integrity monitoring</strong> — WordPress.org core checksum comparison, plugin manifest diff scans, suspicious PHP heuristics, and optional themes/uploads scopes (scheduled scans).</li>
<li><strong>Rate limiting</strong> — optional global throttling for front-end, AJAX, wp-login, and REST API traffic (wp-admin dashboard loads excluded by default).</li>
<li><strong>WooCommerce Protection</strong> — checkout, cart, registration, and Store API pipelines (velocity limits, honeypots, disposable-email checks, fraud scoring, coupon abuse). Requires WooCommerce.</li>
<li><strong>CSRF middleware and SDK</strong> — nonce verification for custom routes, forms, and REST handlers you register.</li>
<li><strong>Signed URLs</strong> — time-limited HMAC links for downloads, invites, and sensitive actions.</li>
<li><strong>Login URL disguise</strong> — optional custom login path instead of <code>wp-login.php</code> (off by default; test on staging first).</li>
<li><strong>Safe mode</strong> — emergency bypass via <code>NIYIGUARD_SAFE_MODE</code> in <code>wp-config.php</code> without changing saved settings.</li>
<li><strong>Health diagnostics</strong> — hooks, database tables, and module state on an admin screen.</li>
<li><strong>MU loader helper</strong> — optional must-use loader for earlier bootstrap in the request lifecycle.</li>
</ul>
<p>The <strong>NiyiGuard <span aria-hidden="true" class="wp-exclude-emoji">→</span> Dashboard</strong> includes optional links to leave a WordPress.org review or support development (Ko-fi). Neither is required.</p>
<h4>Developer APIs</h4>
<p>The <code>Security</code> facade provides route guards, CSRF fields, rate limiters, signed URLs, and related helpers. Documented in <code>docs/USAGE.md</code>. Middleware applies to <strong>routes you protect</strong> — it is not automatic site-wide protection for every WordPress hook. Before production, follow <code>docs/STAGING_TEST_PLAN.md</code>.</p>
<h4>Requirements</h4>
<ul>
<li>WordPress 6.4+</li>
<li>PHP 8.2+</li>
<li>MySQL 5.7+ or MariaDB 10.3+ (standard WordPress database)</li>
</ul>
<h3>Privacy</h3>
<p>NiyiGuard processes security-related data on your WordPress server (IP addresses, user agents, user IDs, audit events, session metadata, and similar fields when features are enabled). It does not sell personal data or include advertising trackers.</p>
<p><strong>Third-party service</strong></p>
<ul>
<li><strong>WordPress.org Core Checksums API</strong> (<code>https://api.wordpress.org/core/checksums/1.0/</code>) — used for core file integrity checks (WordPress version and locale only; responses may be cached about 12 hours).</li>
</ul>
<p><strong>Email</strong></p>
<p>Optional security emails (two-factor codes, suspicious-login alerts) use WordPress <code>wp_mail()</code> and your site’s mail configuration.</p>
<p><strong>Optional donations</strong></p>
<p>If you use the dashboard Ko-fi link, payment and any data you provide are handled by Ko-fi under their terms, not by NiyiGuard.</p>
<p>Full details: <code>docs/PRIVACY.md</code> in the plugin folder, and the Privacy section below.</p>


NiyiGuard

Self-hosted WordPress security: 2FA, lockouts, audit log, integrity, headers, rate limits, WooCommerce protection, and SDK. Free.

miniOrange

twofactorauthentication

twofactor

Google Authenticator

<h3>Two Factor Authentication (2FA) for WordPress</h3>
<p>Secure your WordPress login with powerful <strong>Two Factor Authentication (2FA)</strong>.</p>
<p>miniOrange 2FA plugin protects your website from brute-force attacks, password leaks, and unauthorized access using OTP, SMS, Email, and Authenticator apps like Google Authenticator.</p>
<p>Improve your <strong>WordPress login security</strong> with <strong>multi-factor authentication (MFA)</strong> by adding a second verification step after password login. The <strong>free</strong> plan allows <strong>up to 5 users</strong> to complete 2FA setup on your site; <strong>premium</strong> removes that cap and adds advanced enforcement (trusted devices, multisite, branding, and more).</p>
<p>Set up <strong>2FA for WordPress</strong> in minutes for admins, editors, and customers where you enable it.</p>
<p>Enable <strong>2FA</strong> on standard <strong>wp-login</strong>, <strong>WooCommerce</strong> login, and <strong>custom login forms</strong>—each login can require a second factor for users who have completed setup (subject to your role and user limits on free).</p>
<ul>
<li>Easy setup wizard</li>
<li>Multiple 2FA methods including OTP, SMS, Email, and authenticator apps</li>
<li>Works with WordPress login, WooCommerce login, and many custom login forms</li>
<li>Suitable for blogs, business sites, WooCommerce stores, and enterprise sites</li>
</ul>
<p>Quick Links:<br />
<a href="https://plugins.miniorange.com/step-by-step-guide-for-wordpress-2-factor-authentication" rel="nofollow ugc">Setup Guide</a> |<br />
<a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa" rel="nofollow ugc">Features</a> |<br />
<a href="https://faq.miniorange.com/" rel="nofollow ugc">Support</a></p>
<h3>WordPress 2FA Login Security</h3>
<p>Widely used on WordPress sites to strengthen login authentication and help prevent unauthorized access.</p>
<h3>Why Use Two Factor Authentication (2FA)?</h3>
<p>Passwords alone are not secure anymore.</p>
<p>Adding <strong>2FA to WordPress login</strong>:<br />
– Prevents brute-force attacks<br />
– Protects against password leaks<br />
– Secures admin & user accounts<br />
– Adds an extra verification layer<br />
– Strengthens overall WordPress login security</p>
<h3>Key Features of miniOrange WordPress 2FA Plugin</h3>
<ul>
<li><strong>Free 2FA for up to 5 users</strong> (complete setup per user; premium for unlimited)</li>
<li><strong>Multiple 2FA methods</strong> – OTP, SMS, Email, Authenticator Apps  </li>
<li><strong>Google Authenticator & TOTP support</strong></li>
<li><strong>Backup login methods (backup codes, email links)</strong></li>
<li><strong>Role-based 2FA enforcement</strong></li>
<li><strong>Step-by-step setup wizard</strong></li>
<li><strong>Custom login form support</strong></li>
<li><strong>WooCommerce & popular plugin compatibility</strong></li>
<li><strong>Login reports & IP alerts</strong></li>
<li><strong>Custom redirects after login</strong></li>
<li><strong>Passwordless login support (OTP login without password)</strong></li>
</ul>
<h3>Supported 2FA Authentication Methods</h3>
<h4>Authenticator Apps (TOTP-based 2FA)</h4>
<ul>
<li>Google Authenticator  </li>
<li>Microsoft Authenticator  </li>
<li>Authy Authenticator  </li>
<li>Duo Authenticator  </li>
<li>LastPass Authenticator  </li>
</ul>
<h4>OTP-Based Authentication</h4>
<ul>
<li>OTP via Email  </li>
<li>OTP via SMS  </li>
<li>OTP via WhatsApp <em>(Premium)</em>  </li>
<li>OTP via Telegram  </li>
<li>Email verification link  </li>
<li>Security questions  </li>
</ul>
<h3>2FA for WordPress Websites</h3>
<p>Ideal for:</p>
<ul>
<li>WordPress admins securing wp-login  </li>
<li>WooCommerce stores protecting customer accounts  </li>
<li>Membership websites  </li>
<li>LMS / eLearning platforms  </li>
<li>Agencies managing client websites  </li>
<li>Corporate & enterprise WordPress security  </li>
</ul>
<h3>Advanced 2FA Features (Premium)</h3>
<ul>
<li>Enforce 2FA for all users  </li>
<li>Trusted devices (remember user devices)  </li>
<li>Passwordless login (OTP login)  </li>
<li>Role-based policies  </li>
<li>Custom branding & white labeling  </li>
<li>Multisite support  </li>
<li>Custom SMS gateway integration  </li>
<li>Session & access control  </li>
<li>Force 2FA setup on login  </li>
</ul>
<h3>Easy 2FA Setup</h3>
<ol>
<li>Install & activate plugin  </li>
<li>Choose users/roles for 2FA  </li>
<li>Select authentication method  </li>
<li>Done! Your WordPress login is secured  </li>
</ol>
<h3>Works with Popular WordPress Plugins</h3>
<p>Compatible with:<br />
– WooCommerce<br />
– Elementor<br />
– Ultimate Member<br />
– BuddyPress<br />
– Theme My Login<br />
– LoginPress<br />
– Custom login forms</p>
<h3>Why Choose miniOrange 2FA</h3>
<p>miniOrange 2FA provides several authentication methods in one plugin, including OTP, authenticator apps, email verification, SMS, WhatsApp, and Telegram options. It also supports WooCommerce and many custom login forms, helping site owners add 2FA login security across common WordPress login flows.</p>
<h3>External Services</h3>
<p>Some 2FA methods require communication with miniOrange services to send or verify OTP, SMS, email, push, or account-related requests. These services are used only when you configure or use the related 2FA method.</p>
<p>Service links:<br />
<a href="https://www.miniorange.com/usecases/miniOrange_User_Agreement.pdf" rel="nofollow ugc">miniOrange Terms</a> |<br />
<a href="https://www.miniorange.com/privacypolicy" rel="nofollow ugc">miniOrange Privacy Policy</a></p>
<h3>Video Guide</h3>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/rE-awZZt13Q?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>


miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)

Piyush provided the assistance I needed. the great support team for the free version is also... Very much appreciated!  5 stars are well deserved.

Great plugin with great support

Easy to use and Aswesome support


It's indeed a great plugin, with lot of options for many scenarios. 



One thing that it lacks is customization of the page of OTP, but you can modify /wp-content/plugins/miniorange-2-factor-authentication/controllers/twofa/mo2fa-common-login.php if you know what you're doing (it's just HTML to edit, nothing more).



The plugin have a good documentation and video tutorials, and, a nice thing, a support box right inside the plugin's page to contact support if you need anything.


Great plugin with nice funtionality

Add 2FA to WordPress login with OTP, SMS, Email, and authenticator apps. Free plan supports setup for up to 5 users.

NiyiGuard vs miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)