rathsh

<p><strong>Rat Two-Factor Authentication</strong> is a lightweight yet powerful security plugin that adds an extra layer of protection to your WordPress site through email-based One-Time Password (OTP) verification.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Email-based OTP verification</strong> – Secure 6-digit codes sent to user’s email</li>
<li><strong>Lightweight and fast</strong> – Minimal impact on site performance</li>
<li><strong>User-friendly interface</strong> – Clean, responsive design that works on all devices</li>
<li><strong>Flexible settings</strong> – Enable 2FA globally or per user</li>
<li><strong>Role-based requirements</strong> – Require 2FA for specific user roles</li>
<li><strong>Session management</strong> – Secure session handling with timeout protection</li>
<li><strong>AJAX-powered</strong> – Smooth user experience without page reloads</li>
<li><strong>Auto-submit functionality</strong> – Automatically submits form when 6 digits are entered</li>
<li><strong>Resend functionality</strong> – Users can request new codes with cooldown protection</li>
<li><strong>Mobile-friendly</strong> – Optimized for mobile login experiences</li>
<li><strong>Security-first</strong> – Nonce protection, input sanitization, and secure coding practices</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>User enters their username and password normally</li>
<li>If 2FA is enabled, they’re redirected to an OTP verification screen</li>
<li>A 6-digit code is sent to their registered email address</li>
<li>User enters the code to complete login</li>
<li>Code expires after 10 minutes for security</li>
</ol>
<h4>Perfect For</h4>
<ul>
<li><strong>Business websites</strong> requiring enhanced security</li>
<li><strong>E-commerce stores</strong> protecting customer accounts</li>
<li><strong>Membership sites</strong> with sensitive user data</li>
<li><strong>Multi-author blogs</strong> securing contributor access</li>
<li><strong>Any WordPress site</strong> wanting better login security</li>
</ul>
<h4>Admin Features</h4>
<ul>
<li><strong>Global 2FA setting</strong> – Enable for all users</li>
<li><strong>Force 2FA option</strong> – Make it mandatory for selected roles</li>
<li><strong>Role-based configuration</strong> – Choose which roles require 2FA</li>
<li><strong>User profile integration</strong> – Users can enable/disable 2FA individually</li>
<li><strong>Clean admin interface</strong> – Easy to configure and manage</li>
</ul>
<h4>Developer Friendly</h4>
<ul>
<li><strong>Well-documented code</strong> with inline comments</li>
<li><strong>WordPress coding standards</strong> compliant</li>
<li><strong>Hook system</strong> for customization</li>
<li><strong>Lightweight codebase</strong> for easy modification</li>
<li><strong>No external dependencies</strong> – Pure WordPress integration</li>
</ul>
<h4>Security Features</h4>
<ul>
<li><strong>Nonce verification</strong> for all AJAX requests</li>
<li><strong>Input sanitization</strong> and validation</li>
<li><strong>Secure OTP generation</strong> using WordPress built-in functions</li>
<li><strong>Session timeout</strong> protection (10 minutes)</li>
<li><strong>Rate limiting</strong> on resend requests</li>
<li><strong>No plain text storage</strong> of OTP codes</li>
</ul>
<h3>Configuration</h3>
<h4>Global Settings</h4>
<p>Navigate to <strong>Settings > Two-Factor Auth</strong> to configure:</p>
<ul>
<li><strong>Enable 2FA Globally</strong>: Turn on 2FA for all users</li>
<li><strong>Force 2FA for All Users</strong>: Make 2FA mandatory regardless of user preference</li>
<li><strong>Required User Roles</strong>: Select specific roles that must use 2FA</li>
</ul>
<h4>User Settings</h4>
<p>Each user can enable/disable 2FA in their profile:</p>
<ol>
<li>Go to <strong>Users > Profile</strong> (or <strong>Users > Your Profile</strong>)</li>
<li>Find the “Two-Factor Authentication” section</li>
<li>Check “Enable 2FA” to activate for that user</li>
<li>Save the profile</li>
</ol>
<h4>Email Configuration</h4>
<p>The plugin uses WordPress’s built-in <code>wp_mail()</code> function. Ensure your site can send emails properly. Consider using:</p>
<ul>
<li>SMTP plugins for reliable email delivery</li>
<li>Email services like SendGrid, Mailgun, or Amazon SES</li>
<li>Proper SPF/DKIM records for your domain</li>
</ul>
<h3>Support</h3>
<p>For support, feature requests, or bug reports:</p>
<ul>
<li><strong>Plugin Support</strong>: <a href="https://wordpress.org/support/plugin/rat-two-factor-authentication" rel="ugc">WordPress.org Support Forum</a></li>
<li><strong>Documentation</strong>: Available in the plugin’s admin area</li>
<li><strong>Bug Reports</strong>: Please provide detailed information about your setup</li>
</ul>
<h3>Contributing</h3>
<p>We welcome contributions! The plugin follows WordPress coding standards and best practices.</p>
<h3>Privacy Policy</h3>
<p>This plugin:<br />
* Stores minimal user data (2FA preference and temporary OTP hashes)<br />
* Does not send data to external services<br />
* Uses WordPress’s built-in email system<br />
* Follows WordPress privacy guidelines<br />
* Allows data export/erasure as per GDPR requirements</p>
<h3>Technical Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.6 or higher (or equivalent MariaDB)</li>
<li>Ability to send emails from WordPress</li>
<li>Modern web browser with JavaScript enabled</li>
</ul>
<h3>Credits</h3>
<p>Developed with ❤️ by the Rat Plugins team, focused on creating lightweight, powerful, and user-friendly WordPress plugins.</p>
<h3>License</h3>
<p>This plugin is licensed under the GPL v2 or later.</p>
<blockquote>
<p>This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.</p>
<p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.</p>
</blockquote>


Rat Two-Factor Authentication

Lightweight and powerful Two-Factor Authentication plugin for WordPress with email-based OTP verification.

ishitaka

<p>XO Security is a plugin to enhance login related security.<br />
This plugin does not write to .htaccess file. Besides Apache, LiteSpeed, Nginx and IIS also work.</p>
<h4>Functions</h4>
<ul>
<li>Record login log.</li>
<li>Limit login attempts.</li>
<li>Add Captcha to the login form and comment form.</li>
<li>Change the URL of the login page.</li>
<li>Enable two-factor authentication (2FA) for login.</li>
<li>Login Alert.</li>
<li>Disable login by mail address.</li>
<li>Disable login by user name.</li>
<li>Change login error message.</li>
<li>Disable XML-RPC and XML-RPC Pingback.</li>
<li>Disable REST API.</li>
<li>Disable author archive page.</li>
<li>Remove comment author class of comments list.</li>
<li>Remove the username from the oEmbed response data.</li>
<li>WooCommerce login page protection.</li>
<li>Anti-spam comment.</li>
<li>Hide WordPress version information.</li>
<li>Edit the author slug.</li>
<li>Disable RSS and Atom feeds.</li>
<li>Activate maintenance mode.</li>
<li>Delete the readme.html file.</li>
</ul>
<h4>WordPress multisite considerations</h4>
<p>If you set the login page separately for the main site and the subsite, you will not be able to use the password loss function of the subsite. We recommend that you set the login page to be common to all sites.</p>


XO Security

This is awesome plugin!
It has all the features I need and is very easy to use.

Awesome!

長年、SiteGuardを使っていましたが、たまにログインできなくなってプラグインをサーバーから削除とかしたりだったので、こちらのプラグインを使い始めました。
設定画面もわかりやすく、作動も安定していて、ログイン試行履歴とかも見れます（結構不正ログインされようとしているのがわかって楽しい）、随時他のサイトのセキュリティプラグインもこちらに切り替えていこうと思っています。感謝感謝

とても良い


This one plugin completes my security measures. Thanks !!


This one is all you need !

XO Security is a plugin to enhance login related security.

Rat Two-Factor Authentication vs XO Security