rathsh

<p><strong>Rat Two-Factor Authentication</strong> is a lightweight yet powerful security plugin that adds an extra layer of protection to your WordPress site through email-based One-Time Password (OTP) verification.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Email-based OTP verification</strong> – Secure 6-digit codes sent to user’s email</li>
<li><strong>Lightweight and fast</strong> – Minimal impact on site performance</li>
<li><strong>User-friendly interface</strong> – Clean, responsive design that works on all devices</li>
<li><strong>Flexible settings</strong> – Enable 2FA globally or per user</li>
<li><strong>Role-based requirements</strong> – Require 2FA for specific user roles</li>
<li><strong>Session management</strong> – Secure session handling with timeout protection</li>
<li><strong>AJAX-powered</strong> – Smooth user experience without page reloads</li>
<li><strong>Auto-submit functionality</strong> – Automatically submits form when 6 digits are entered</li>
<li><strong>Resend functionality</strong> – Users can request new codes with cooldown protection</li>
<li><strong>Mobile-friendly</strong> – Optimized for mobile login experiences</li>
<li><strong>Security-first</strong> – Nonce protection, input sanitization, and secure coding practices</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>User enters their username and password normally</li>
<li>If 2FA is enabled, they’re redirected to an OTP verification screen</li>
<li>A 6-digit code is sent to their registered email address</li>
<li>User enters the code to complete login</li>
<li>Code expires after 10 minutes for security</li>
</ol>
<h4>Perfect For</h4>
<ul>
<li><strong>Business websites</strong> requiring enhanced security</li>
<li><strong>E-commerce stores</strong> protecting customer accounts</li>
<li><strong>Membership sites</strong> with sensitive user data</li>
<li><strong>Multi-author blogs</strong> securing contributor access</li>
<li><strong>Any WordPress site</strong> wanting better login security</li>
</ul>
<h4>Admin Features</h4>
<ul>
<li><strong>Global 2FA setting</strong> – Enable for all users</li>
<li><strong>Force 2FA option</strong> – Make it mandatory for selected roles</li>
<li><strong>Role-based configuration</strong> – Choose which roles require 2FA</li>
<li><strong>User profile integration</strong> – Users can enable/disable 2FA individually</li>
<li><strong>Clean admin interface</strong> – Easy to configure and manage</li>
</ul>
<h4>Developer Friendly</h4>
<ul>
<li><strong>Well-documented code</strong> with inline comments</li>
<li><strong>WordPress coding standards</strong> compliant</li>
<li><strong>Hook system</strong> for customization</li>
<li><strong>Lightweight codebase</strong> for easy modification</li>
<li><strong>No external dependencies</strong> – Pure WordPress integration</li>
</ul>
<h4>Security Features</h4>
<ul>
<li><strong>Nonce verification</strong> for all AJAX requests</li>
<li><strong>Input sanitization</strong> and validation</li>
<li><strong>Secure OTP generation</strong> using WordPress built-in functions</li>
<li><strong>Session timeout</strong> protection (10 minutes)</li>
<li><strong>Rate limiting</strong> on resend requests</li>
<li><strong>No plain text storage</strong> of OTP codes</li>
</ul>
<h3>Configuration</h3>
<h4>Global Settings</h4>
<p>Navigate to <strong>Settings > Two-Factor Auth</strong> to configure:</p>
<ul>
<li><strong>Enable 2FA Globally</strong>: Turn on 2FA for all users</li>
<li><strong>Force 2FA for All Users</strong>: Make 2FA mandatory regardless of user preference</li>
<li><strong>Required User Roles</strong>: Select specific roles that must use 2FA</li>
</ul>
<h4>User Settings</h4>
<p>Each user can enable/disable 2FA in their profile:</p>
<ol>
<li>Go to <strong>Users > Profile</strong> (or <strong>Users > Your Profile</strong>)</li>
<li>Find the “Two-Factor Authentication” section</li>
<li>Check “Enable 2FA” to activate for that user</li>
<li>Save the profile</li>
</ol>
<h4>Email Configuration</h4>
<p>The plugin uses WordPress’s built-in <code>wp_mail()</code> function. Ensure your site can send emails properly. Consider using:</p>
<ul>
<li>SMTP plugins for reliable email delivery</li>
<li>Email services like SendGrid, Mailgun, or Amazon SES</li>
<li>Proper SPF/DKIM records for your domain</li>
</ul>
<h3>Support</h3>
<p>For support, feature requests, or bug reports:</p>
<ul>
<li><strong>Plugin Support</strong>: <a href="https://wordpress.org/support/plugin/rat-two-factor-authentication" rel="ugc">WordPress.org Support Forum</a></li>
<li><strong>Documentation</strong>: Available in the plugin’s admin area</li>
<li><strong>Bug Reports</strong>: Please provide detailed information about your setup</li>
</ul>
<h3>Contributing</h3>
<p>We welcome contributions! The plugin follows WordPress coding standards and best practices.</p>
<h3>Privacy Policy</h3>
<p>This plugin:<br />
* Stores minimal user data (2FA preference and temporary OTP hashes)<br />
* Does not send data to external services<br />
* Uses WordPress’s built-in email system<br />
* Follows WordPress privacy guidelines<br />
* Allows data export/erasure as per GDPR requirements</p>
<h3>Technical Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.6 or higher (or equivalent MariaDB)</li>
<li>Ability to send emails from WordPress</li>
<li>Modern web browser with JavaScript enabled</li>
</ul>
<h3>Credits</h3>
<p>Developed with ❤️ by the Rat Plugins team, focused on creating lightweight, powerful, and user-friendly WordPress plugins.</p>
<h3>License</h3>
<p>This plugin is licensed under the GPL v2 or later.</p>
<blockquote>
<p>This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.</p>
<p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.</p>
</blockquote>


Rat Two-Factor Authentication

Lightweight and powerful Two-Factor Authentication plugin for WordPress with email-based OTP verification.

Rat Two-Factor Authentication vs Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)