Marcus Downing

Dani Llewellyn

Whenever a site is under development, or its content should remain private, you want to prevent to general public 
from reading it – whether deliberately or by accident.
A comman way to do this is with <a href="http://httpd.apache.org/docs/2.4/howto/auth.html" rel="nofollow ugc">HTTP authorisation</a>, 
but this has some problems:
<ul>
<li>Each user of your site has two different sets of username and password, one for the authorisation and one for 
WordPress login. It’s not uncommon for some users to find this confusing.</li>
<li>To set up authorisation you need access to your web server’s configuration (at least using the <code>.htaccess</code> file), 
which may not be available depending on your hosting supplier. 
You also need to learn how to configure the authorisation correctly, and risk breaking the site if you get it wrong.</li>
<li>When the time comes to remove the authorisation, you need to edit the configuration again.</li>
<li>In certain circumstances, combining authorisation with WordPress login can get a visitor into a circular redirect 
loop, where the result of logging in is to redirect to the login page.</li>
</ul>
Site PIN solves these problems by replacing authorisation with a simple PIN. This has the following advantages:
<ul>
<li>Everybody knows what a PIN is, and it’s clearly not the same as a password.</li>
<li>Logging into WordPress bypasses the PIN, so you can’t lock yourself out</li>
<li>It’s just a WordPress plugin, so no server configuration is necessary.</li>
<li>You can change or remove the PIN from WordPress admin.</li>
</ul>

Site PIN

Prevent careless visitors by locking your site down with a PIN

oskarhane

Secure WordPress login with this two factor auth. Users will have to enter an One Time Password when they log in.
<h4>Why You Need This</h4>
Users can have common or weak passwords that lets hackers/bots brute-force your WordPress site and gain access to your files and place malware there. 
Just like happend not that long ago: <a href="http://techcrunch.com/2013/04/12/hackers-point-large-botnet-at-wordpress-sites-to-steal-admin-passwords-and-gain-server-access/" rel="nofollow ugc">Article on TechCrunch</a>
If all sites would have used this plugin, this would never happend. 
It doesn’t matter how weak your users passwords are, no one can gain access to your WordPress site 
without already having access to the users mobile phone or email inbox (depending on how the user gets his OTP).
<h4>How Does It Work?</h4>
This plugin uses the industry standard algorithm <a href="http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm" rel="nofollow ugc">TOTP</a> or <a href="http://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm" rel="nofollow ugc">HOTP</a> for creating One Time Passwords. 
A OTP is valid for a certain time and after that a new code has to be entered.
You can now choose to use third party apps like <a href="http://code.google.com/p/google-authenticator/" rel="nofollow ugc">Google Authenticator</a> which is available for most mobile platforms. You can really use any 
third party app that supports TOTP/HOTP that generates 6 digits OTP’s. 
Or, as before, you can choose to get your One Time Passwords by email.
Since you have to enter a secret code to third party apps, email is the default way of delivering One Time Passwords. Your 
users will have to activate delivery by third party apps themselves.
<h4>Easy To Use</h4>
Just install this plugin and you’re all set. There’s really nothing more to it. 
If you want to use a third party app, goto Two Factor Auth in the admin menu and activate it and set up your app. 
General settings can be found uner Settings -> Two Factor Auth in admin menu. Settings for each individual user 
can be found at the root level of the admin menu, in Two Factor Auth. 
A bit more work to get logged in, but a whole lot more secure!
If you use WooCommerce or other plugins that make custom login forms, you will not be able to login through those anymore. 
I will be adding a plugin that puts a One Time Password field to WooCommerce. If you use some other plugin that needs 
support for this, let me know in the support forum.
<h4>TOTP or HOTP</h4>
Which algorithm you and your users choose doesn’t really matter. The time based TOTP is a bit more secure since a One Time 
Password is valid only for a certain amount of time. But this requires the server time to be in sync the clients time (if 
the OTP isn’t delivered by email). This is often hard to do with embedded clients and the event based HOTP is then a better choice. 
If you have a somewhat slow email server and have chosen email delivery, you might not get the TOTP in time.
Conslusion: Choose which ever you want. TOTP is a little bit safer since OTP:s only are valid for a short period.
Note that email delivery users always uses the site default algorithm, which you can set on the settings page. Third party 
apps users can choose which one they want.
<h4>Is this really Two Factor Auth?</h4>
Before version 3.0 this plugin had ‘kind of’ two factor auth where the OTP was delivered to an email address. 
Since version 3.0 you can have real two factor auth if you activate the Third Party Apps delivery type.
Read more about <a href="http://oskarhane.com/two-factor-auth-explained/" rel="nofollow ugc">what two factor auth means >></a>.
See http://oskarhane.com/plugin-two-factor-auth-for-wordpress/ for more info.

Two Factor Auth

Secure WordPress login with Two Factor Auth. Users will have to enter an One Time Password when they log in.

Site PIN vs Two Factor Auth