rathsh

Rat Two-Factor Authentication is a lightweight yet powerful security plugin that adds an extra layer of protection to your WordPress site through email-based One-Time Password (OTP) verification.
<h4>Key Features</h4>
<ul>
<li>Email-based OTP verification – Secure 6-digit codes sent to user’s email</li>
<li>Lightweight and fast – Minimal impact on site performance</li>
<li>User-friendly interface – Clean, responsive design that works on all devices</li>
<li>Flexible settings – Enable 2FA globally or per user</li>
<li>Role-based requirements – Require 2FA for specific user roles</li>
<li>Session management – Secure session handling with timeout protection</li>
<li>AJAX-powered – Smooth user experience without page reloads</li>
<li>Auto-submit functionality – Automatically submits form when 6 digits are entered</li>
<li>Resend functionality – Users can request new codes with cooldown protection</li>
<li>Mobile-friendly – Optimized for mobile login experiences</li>
<li>Security-first – Nonce protection, input sanitization, and secure coding practices</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>User enters their username and password normally</li>
<li>If 2FA is enabled, they’re redirected to an OTP verification screen</li>
<li>A 6-digit code is sent to their registered email address</li>
<li>User enters the code to complete login</li>
<li>Code expires after 10 minutes for security</li>
</ol>
<h4>Perfect For</h4>
<ul>
<li>Business websites requiring enhanced security</li>
<li>E-commerce stores protecting customer accounts</li>
<li>Membership sites with sensitive user data</li>
<li>Multi-author blogs securing contributor access</li>
<li>Any WordPress site wanting better login security</li>
</ul>
<h4>Admin Features</h4>
<ul>
<li>Global 2FA setting – Enable for all users</li>
<li>Force 2FA option – Make it mandatory for selected roles</li>
<li>Role-based configuration – Choose which roles require 2FA</li>
<li>User profile integration – Users can enable/disable 2FA individually</li>
<li>Clean admin interface – Easy to configure and manage</li>
</ul>
<h4>Developer Friendly</h4>
<ul>
<li>Well-documented code with inline comments</li>
<li>WordPress coding standards compliant</li>
<li>Hook system for customization</li>
<li>Lightweight codebase for easy modification</li>
<li>No external dependencies – Pure WordPress integration</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Nonce verification for all AJAX requests</li>
<li>Input sanitization and validation</li>
<li>Secure OTP generation using WordPress built-in functions</li>
<li>Session timeout protection (10 minutes)</li>
<li>Rate limiting on resend requests</li>
<li>No plain text storage of OTP codes</li>
</ul>
<h3>Configuration</h3>
<h4>Global Settings</h4>
Navigate to Settings > Two-Factor Auth to configure:
<ul>
<li>Enable 2FA Globally: Turn on 2FA for all users</li>
<li>Force 2FA for All Users: Make 2FA mandatory regardless of user preference</li>
<li>Required User Roles: Select specific roles that must use 2FA</li>
</ul>
<h4>User Settings</h4>
Each user can enable/disable 2FA in their profile:
<ol>
<li>Go to Users > Profile (or Users > Your Profile)</li>
<li>Find the “Two-Factor Authentication” section</li>
<li>Check “Enable 2FA” to activate for that user</li>
<li>Save the profile</li>
</ol>
<h4>Email Configuration</h4>
The plugin uses WordPress’s built-in <code>wp_mail()</code> function. Ensure your site can send emails properly. Consider using:
<ul>
<li>SMTP plugins for reliable email delivery</li>
<li>Email services like SendGrid, Mailgun, or Amazon SES</li>
<li>Proper SPF/DKIM records for your domain</li>
</ul>
<h3>Support</h3>
For support, feature requests, or bug reports:
<ul>
<li>Plugin Support: <a href="https://wordpress.org/support/plugin/rat-two-factor-authentication" rel="ugc">WordPress.org Support Forum</a></li>
<li>Documentation: Available in the plugin’s admin area</li>
<li>Bug Reports: Please provide detailed information about your setup</li>
</ul>
<h3>Contributing</h3>
We welcome contributions! The plugin follows WordPress coding standards and best practices.
<h3>Privacy Policy</h3>
This plugin: 
* Stores minimal user data (2FA preference and temporary OTP hashes) 
* Does not send data to external services 
* Uses WordPress’s built-in email system 
* Follows WordPress privacy guidelines 
* Allows data export/erasure as per GDPR requirements
<h3>Technical Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.6 or higher (or equivalent MariaDB)</li>
<li>Ability to send emails from WordPress</li>
<li>Modern web browser with JavaScript enabled</li>
</ul>
<h3>Credits</h3>
Developed with ❤️ by the Rat Plugins team, focused on creating lightweight, powerful, and user-friendly WordPress plugins.
<h3>License</h3>
This plugin is licensed under the GPL v2 or later.
<blockquote>
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
</blockquote>

Rat Two-Factor Authentication

Lightweight and powerful Two-Factor Authentication plugin for WordPress with email-based OTP verification.

BaseCloud

BaseCloud Shield is a lightweight yet powerful security plugin that enforces Two-Factor Authentication (2FA) on your WordPress login page. Unlike other bloat-heavy plugins, BaseCloud Shield focuses on reliability and flexibility in OTP delivery.
Key Features:
<ul>
<li>Plug & Play: Works immediately using standard WordPress email delivery.</li>
<li>Multi-Recipient System: Send OTPs to the logging-in user, a manager email, or selected users.</li>
<li>Multi-Channel Delivery: Choose multiple delivery methods simultaneously (Email, SendGrid, WhatsApp, SMS, Webhook).</li>
<li>WhatsApp Integration: Send OTPs directly via WhatsApp using Twilio API.</li>
<li>SMS Integration: Deliver OTPs via SMS using Twilio API.</li>
<li>SendGrid API V3: Native integration for high-deliverability emails.</li>
<li>Webhook Support: Connect to custom webhooks for advanced automation flows.</li>
<li>Secure OTPs: 6-digit one-time passwords that expire automatically.</li>
<li>Browser Trust: “Remember this device” functionality to reduce friction for authorized users.</li>
<li>Advanced Attack Protection (v1.4.2): Credential stuffing detection, progressive delays, username enumeration protection.</li>
</ul>
<h3>External Services</h3>
This plugin may connect to external third-party services depending on your configuration. Below is a detailed explanation of what services are used, what data is sent, and when:
SendGrid Email API (Optional)
If you select “SendGrid API” as your delivery method in the plugin settings, this plugin will send data to SendGrid’s email service to deliver one-time password (OTP) codes.
<ul>
<li>Service: SendGrid by Twilio</li>
<li>What it’s used for: Sending two-factor authentication codes via email with improved deliverability</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled</li>
<li>Data sent:
<ul>
<li>Recipient email address (user’s email or manager email if configured)</li>
<li>Sender email address (configured in plugin settings)</li>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>6-digit one-time password code</li>
<li>Email subject and HTML body</li>
</ul>
</li>
<li>API Endpoint: https://api.sendgrid.com/v3/mail/send</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/legal/privacy</li>
</ul>
Important: You must have a SendGrid account and API key to use this feature. You are responsible for complying with SendGrid’s terms of service and ensuring proper data handling practices.
Twilio API for WhatsApp & SMS (Optional)
If you select “WhatsApp” or “SMS” as delivery methods, the plugin will send data to Twilio’s API to deliver one-time password codes.
<ul>
<li>Service: Twilio</li>
<li>What it’s used for: Sending two-factor authentication codes via WhatsApp and/or SMS</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled with WhatsApp/SMS selected</li>
<li>Data sent:
<ul>
<li>Recipient phone number (from user meta field ‘billing_phone’)</li>
<li>Sender phone number (WhatsApp number or SMS number configured in settings)</li>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>6-digit one-time password code</li>
<li>Message body</li>
</ul>
</li>
<li>API Endpoint: https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/legal/privacy</li>
</ul>
Important: You must have a Twilio account with WhatsApp and/or SMS capabilities enabled. Phone numbers must be stored in user meta (field: ‘billing_phone’). You are responsible for complying with Twilio’s terms of service.
Custom Webhook (Optional)
If you select “Webhook” as a delivery method, the plugin will send login notification data to a webhook URL you configure.
<ul>
<li>Service: Custom webhook endpoint (configured by you)</li>
<li>What it’s used for: Sending login notifications to external systems for custom processing</li>
<li>When data is sent: Every time a user attempts to log in and 2FA is enabled</li>
<li>Data sent:
<ul>
<li>Site name</li>
<li>Username attempting to log in</li>
<li>User email address</li>
<li>6-digit one-time password code</li>
<li>Recipient information array</li>
<li>Timestamp of login attempt</li>
</ul>
</li>
<li>Endpoint: User-configured webhook URL</li>
</ul>
Important: When using the webhook option, you are responsible for the security and privacy compliance of the endpoint you configure. Ensure your webhook endpoint uses HTTPS and follows proper data protection practices.
Standard WordPress Email (Default)
By default, this plugin uses WordPress’s built-in <code>wp_mail()</code> function, which does not involve any external services unless your WordPress installation is configured to use a third-party SMTP service.

BaseCloud Shield

Enterprise-grade Two-Factor Authentication (2FA) with support for Email, SendGrid API, Webhooks, WhatsApp, and SMS delivery.

Rat Two-Factor Authentication vs BaseCloud Shield