Super Duper Plugins

<p><strong>Super Duper Two-Factor Login</strong> adds robust two-factor authentication to your WordPress site. Unlike many alternatives, this plugin is completely free – no hidden costs, no premium tiers, no upsells. Every feature is included from the start.</p>
<p>🇨🇭🇩🇪🇦🇹 <em>Hinweis für DACH-Nutzer: Plugin und Support sind auf Deutsch (Schweiz/Deutschland/Österreich) verfügbar. Alle Texte und Einstellungen sind vollständig auf Deutsch übersetzt.</em></p>
<p><strong>Fully translated out of the box</strong> in German (Switzerland, Germany, Austria), English, French, Spanish, Italian and Dutch – no separate language pack required.</p>
<h4>PHP 8.2 or higher required (for security reasons)</h4>
<p>This plugin requires <strong>PHP 8.2 or higher</strong>. PHP 8.0 and 8.1 have both reached End of Life and no longer receive security updates – running a 2FA plugin on an unmaintained PHP version would defeat its purpose. PHP 8.2 lets us use modern security primitives (immutable configuration, type-safe method handling, strict return contracts) that make the plugin harder to attack.</p>
<p><strong>Don’t have PHP 8.2 yet?</strong> Most hosting providers let you switch the PHP version with a single click in the control panel (Plesk, cPanel, Hostpoint, all-inkl, Cyon, raidboxes, etc.). It usually takes less than a minute and does not require any downtime. If in doubt, ask your hoster’s support – they help with PHP upgrades for free.</p>
<h4>Two Verification Methods</h4>
<ul>
<li><strong>TOTP (Authenticator App)</strong> – Works with Google Authenticator, FreeOTP+, Authy, Microsoft Authenticator, and any TOTP-compatible app. Setup via QR code or manual key entry.</li>
<li><strong>Email</strong> – Receive a 6-digit code via email on every login. No smartphone required.</li>
</ul>
<h4>Comprehensive Fallback System</h4>
<ul>
<li><strong>10 Backup Codes</strong> – One-time emergency codes in case you lose your phone. Copy, download, print, or email them to yourself.</li>
<li><strong>Administrator Recovery Key</strong> – Each admin receives a personal 32-character key during setup. Works even when all backup codes are used up.</li>
<li><strong>FTP Emergency Recovery</strong> – As a last resort, create an empty file named <code>.sdtfa-recovery</code> in <code>wp-content/</code> via FTP. Temporarily disables 2FA for all administrators. Admins are notified hourly by email.</li>
</ul>
<h4>Enforcement & Trust</h4>
<ul>
<li><strong>Role-Based Enforcement</strong> – Require 2FA for administrators, editors, subscribers, or any role.</li>
<li><strong>Grace Period</strong> – Set a deadline so users have time to set up 2FA before enforcement kicks in.</li>
<li><strong>Hard Enforcement</strong> – Without a grace period, users must complete 2FA setup on the login page before gaining any access.</li>
<li><strong>Enforcement Areas</strong> – Choose where to enforce: admin area, WooCommerce account, checkout, or entire site.</li>
<li><strong>Trust This Device</strong> – Users can save their computer so the 2FA code isn’t required on every login. Configurable duration (1–365 days).</li>
</ul>
<h4>Integration</h4>
<ul>
<li><strong>WooCommerce</strong> – Adds a “Two-Factor Authentication” tab to the My Account page. Enforce 2FA for the account area and checkout.</li>
<li><strong>Shortcode</strong> – Display the user’s 2FA status anywhere with <code>[sdtfa_status]</code>.</li>
<li><strong>Setup Reminder</strong> – A dismissable admin notice with a “Set up now” button. No auto-popups; users open the setup flow only by clicking.</li>
</ul>
<h4>Security</h4>
<ul>
<li>AES-256-GCM encryption for TOTP secrets at rest</li>
<li>Secure HttpOnly cookies for trusted devices</li>
<li>Hashed token storage (never stored in plain text)</li>
<li>No external dependencies – everything runs locally in pure PHP</li>
<li>No external API calls, no tracking, no data collection</li>
</ul>
<h4>Privacy & Hardening (optional)</h4>
<ul>
<li>
<p><strong>Hide user data in REST API</strong> – Replace sensitive user fields (name, slug, link, avatar) with neutral values for unauthenticated requests. The REST endpoint stays reachable for SEO and import tools, but anonymous visitors no longer see real display names. Uses a strict whitelist that automatically drops any extra fields injected by SEO, page-builder or e-commerce plugins (Yoast, Rank Math, AIOSEO, Elementor, WooCommerce, …). Example response for an anonymous visitor on <code>/wp-json/wp/v2/users/1</code>:</p>
<p>{“id”:1,”name”:”Author”,”url”:””,”description”:””,”link”:”https:\/\/example.com\/”,”slug”:”author”,”avatar_urls”:{}}</p>
</li>
<li>
<p><strong>Block author archives</strong> – Redirect unauthenticated visitors away from <code>?author=N</code> and <code>/author/<slug>/</code> to prevent user enumeration.</p>
</li>
<li><strong>Disable password reset</strong> – Disable the “Lost your password?” function for administrators and/or selected roles. Useful when 2FA must be the only authentication path.</li>
<li><strong>Users list column</strong> – A clean “SDTFA” column on Users <span aria-hidden="true" class="wp-exclude-emoji">→</span> All Users that shows the real 2FA status (TOTP, Email, or off) and replaces duplicate columns added by host mu-plugins or other 2FA plugins.</li>
</ul>


Super Duper Two-Factor Login

Free 2FA plugin for WordPress: TOTP authenticator app, email codes, backup codes, WooCommerce, role enforcement. No upsells, no premium tier.

BeycanPress LLC

<h3>Chainium – Blockchain Integrations & Web3 Crypto Wallet Authenticator</h3>
<p>Chainium is a Web3 crypto wallet login (authenticator) plugin for WordPress. Chainium allows users to authenticate with their Web3 wallets like MetaMask, Trust Wallet, etc. Chainium is a new way to authenticate users on websites. Instead of using traditional username and password, users can authenticate with their Web3 wallets. Chainium supports Ethereum ecosystem for now and will support more blockchains in the future.</p>
<p>Our goal with Chainium is after the completely commission-free and peer-to-peer crypto payments that we do at CryptoPay. To create a full Web3 and Blockchain connector and integrator for WordPress. At the moment, we have only added WordPress login and registration processes with Web3 wallets like MetaMask on the Ethereum ecosystem, but you can see our plans for Chainium going forward in the features list below.</p>
<h3>Features</h3>
<ul>
<li>Web3 Crypto Wallet Authenticator</li>
</ul>
<p>Web3 Wallet Authenticator only supports Ethereum and other EVM compatible blockchains for now. You can authenticate users with their Web3 wallets like MetaMask, Trust Wallet, etc. Also supports mobile wallets by Reown AppKit (formerly WalletConnect).</p>
<h3>Upcoming Features</h3>
<ul>
<li>NFT Marketplace</li>
<li>Blockchain Explorers</li>
<li>Blockchain User Wallets</li>
<li>Blockchain User Profiles</li>
<li>Solana, Tron, Bitcoin Integration</li>
</ul>
<h3>What is Web3 Wallet Authenticator?</h3>
<p>Web3 Wallet Authenticator is a new way to authenticate users on websites. Instead of using traditional username and password, users can authenticate with their Web3 wallets like MetaMask, Trust Wallet, etc. This way, users can sign in to websites without creating an account and without sharing their personal information.</p>
<h3>How does it work?</h3>
<p>When a user tries to sign in to your website, Chainium will ask the user to connect their Web3 wallet. The user will sign a message with their wallet and Chainium will verify the signature. If the signature is valid, the user will be authenticated and signed in to your website.</p>
<h3>Why use Web3 Wallet Authenticator?</h3>
<p>We currently have two shortcodes for you to use Chainium. The first shortcode is [beycanpress-chainium-init] and the second shortcode is [beycanpress-chainium-matching]. You can use the first shortcode to show the login button and the second shortcode to show the address matching form.</p>
<p>You can add the relevant shortcodes wherever you want on your site. There are also options to enable Chainium for the WordPress Login page and WooCommerce My Account Login page directly from the settings.</p>
<p>You can also write custom CSS to customize the shortcodes comes with standard styling.</p>
<h3>How to enable registration?</h3>
<p>By default Chainium only supports login and address matching. If you want to enable users to register directly with their wallet, you need to enable the “Anyone can register” option in the WordPress general settings.</p>
<h4>Privacy notices</h4>
<p>With the default configuration, this plugin, in itself, does not:</p>
<ul>
<li>use cookies;</li>
<li>track users by stealth;</li>
<li>It only sends active plugin count and active feedback;</li>
</ul>
<h4>3rd Party Libraries & API’s</h4>
<ul>
<li>BeycanPress/csf
<ul>
<li>License: MIT</li>
<li>Source code: https://github.com/BeycanPress/csf</li>
<li>What is this library for?: This library is used for the options panel and not sending data to external servers.</li>
</ul>
</li>
<li>https://sweetalert2.github.io/
<ul>
<li>License: MIT</li>
<li>Source code: https://github.com/sweetalert2/sweetalert2/</li>
<li>What is this library for?: This library is used to show alerts to the user.</li>
</ul>
</li>
<li>https://beycanpress.com/, https://services.beycanpress.com/
<ul>
<li>Privacy policy: https://beycanpress.com/privacy-policy/</li>
<li>This is our website. We use it to provide support and sell premium plugins.</li>
</ul>
</li>
<li>https://reown.com/appkit
<ul>
<li>Privacy policy: https://reown.com/privacy-policy/</li>
<li>This is the wallet connector for blockchain dapps as a open source project.</li>
</ul>
</li>
</ul>
<h4>Translations</h4>
<p>You can easily translate with Loco translate.</p>


Chainium – Blockchain Integrations & Web3 Crypto Wallet Authenticator

Blockchain Integrations, Web3, Crypto, Wallet, Authenticator, Login, NFT Marketplace, Explorer, MetaMask, Trust Wallet, Ethereum, Solana, Tron

Super Duper Two-Factor Login vs Chainium – Blockchain Integrations & Web3 Crypto Wallet Authenticator