Helmi

SecureAuth Authenticator 2FA enhances your WordPress login security by requiring a time-based one-time password (TOTP) in addition to the regular username and password. The TOTP code is generated by an authenticator app on your mobile device, adding an extra layer of protection even if your password is compromised.
This plugin is lightweight, secure, and easy to use. It integrates directly into the user profile page to allow users to set up and manage their two-factor authentication with ease.
Features:
<ul>
<li>Adds a TOTP (Time-Based One-Time Password) field to the login form.</li>
<li>User-friendly 2FA setup available on each user’s profile page.</li>
<li>Generates secret keys and displays QR codes for scanning with mobile apps.</li>
<li>Compatible with apps like Google Authenticator, Microsoft Authenticator, and Authy.</li>
<li>Secure handling with nonce verification and input sanitization.</li>
<li>No external libraries required (except Google Chart API for QR code).</li>
</ul>

SecureAuth Authenticator 2FA

Adds TOTP-based two-factor authentication (2FA) via SecureAuth Authenticator to your WordPress login page.

oosoft

OOSOFT

OOSOFT 2FA Security adds robust two-factor authentication to your WordPress site. Protect every login with a second verification step using a TOTP authenticator app (Google Authenticator, Authy, etc.) or a one-time code sent to your email address.
Key Features:
<ul>
<li>TOTP Authenticator App — compatible with Google Authenticator, Authy, Microsoft Authenticator, and any RFC 6238-compliant app.</li>
<li>Email OTP — sends a time-limited one-time code to the user’s registered email address.</li>
<li>Backup Codes — generate single-use recovery codes so users are never locked out.</li>
<li>Role-Based Enforcement — require 2FA for specific roles (e.g. administrators) while leaving it optional for others.</li>
<li>Rate Limiting — brute-force protection with configurable attempt limits and lockout periods.</li>
<li>Security Logs — detailed event logging with filterable admin view and automatic pruning.</li>
<li>Encrypted Secret Storage — TOTP secrets are encrypted at rest using libsodium (preferred) or AES-256-GCM/CBC via OpenSSL.</li>
<li>HKDF Key Derivation — encryption keys are derived from your WordPress secret keys; no raw key material is stored.</li>
</ul>

OOSOFT 2FA Security

Enterprise-grade Two-Factor Authentication for WordPress with TOTP, Email OTP, backup codes, and role-based enforcement.

SecureAuth Authenticator 2FA vs OOSOFT 2FA Security