Web Guy

<a href="https://github.com/webguyio/tiny-2fa/issues" rel="nofollow ugc">💬 Ask Question</a> | <a href="mailto:webguywork@gmail.com" rel="nofollow ugc">📧 Email Me</a>
This is probably the 2FA plugin you’re looking for.
Secure, private, and lightweight.
Integrates into WordPress like a native feature.
<h4>Proactive vs Reactive Security</h4>
Prevents attacks instead of reacting to them. The best breach is the one that never happens.
<h4>How it Works</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Go to Users > Profile > Two-Factor Authentication (near the bottom)</li>
<li>Check the box next to “Enable 2FA” and click “Update Profile”</li>
<li>2FA and Backup Codes are now enabled</li>
<li>Scan the QR code or manually enter the secret key into your auth app of choice (and be sure to rename the generic site name “2FA” to something more useful)</li>
<li>Once successful login with a 2FA code from your app has been confirmed, you should disable Backup Codes</li>
<li>Brute force protection is enabled by default and can be managed site-wide by admins in profile settings</li>
</ol>
Backup Codes have been rethought from the usual method you might be used to. Read more about that in the FAQ below.
<h4>Need Support?</h4>
Ask for help <a href="https://github.com/webguyio/tiny-2fa/issues" rel="nofollow ugc">here</a>.

Tiny 2FA + Brute Force Protection

A simple two-factor authentication plugin that just works.

Smart Cloud Solutions Inc.

Gatey provides a seamless integration with Amazon Cognito for secure, scalable authentication in WordPress. This plugin supports both dynamic WordPress sites and statically generated WordPress frontends.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/xFjEg-LbgHA?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
Key features include: 
 – Amazon Cognito user pool login and registration 
 – Fully translatable Authenticator screens — 22 built-in languages plus a custom-JSON option for overriding any string or adding new languages 
 – Single Sign-On (SSO) integration with Social login, SAML, and OIDC providers 
 – Gutenberg block, Elementor widget, and shortcode support 
 – Multi-factor authentication (MFA) 
 – Profile editing and password reset features 
 – Secure API access with JWT or AWS IAM Signature authorization 
 – Role-based access control
You can find the plugin’s continuously expanding, detailed documentation at:
<a href="https://wpsuite.io/docs/" rel="nofollow ugc">WP Suite – Docs</a>
What’s on the site? 
 – Get Started guide — quick start, installation, first‑time setup. 
 – CSS/JS references — components, API, usage examples. 
 – Creating User Pools — step‑by‑step instructions with AWS CloudFormation / CDK scripts. 
 – Protecting static sites — full tutorial with point‑by‑point walkthroughs and AWS scripts.
This plugin is not affiliated with or endorsed by Amazon Web Services or the WordPress Foundation. All trademarks are property of their respective owners.
<h3>Free and Premium Usage Notice</h3>
Gatey works entirely offline and provides full login and registration functionality via your WordPress installation without requiring any registration or subscription.
Optional premium features (like advanced customization or frontend integrations) are only available after connecting your WordPress instance via a secure frontend-only JavaScript authenticator to our Gatey service. Registration and subscription are not required to use the core plugin functionality. All premium interactions happen client-side using standard AWS Amplify and Stripe components – no external PHP code is loaded or executed.
<h3>Machine-readable resources</h3>
<ul>
<li>AI plugin manifest: https://wpsuite.io/.well-known/ai-plugin.json</li>
<li>OpenAPI spec: https://wpsuite.io/.well-known/openapi.yaml</li>
</ul>
<h3>External Services</h3>
This plugin integrates with the following third-party services:
<ol>
<li>
Amazon Cognito
<ul>
<li>What it is & what it’s used for: 
A managed user-identity and authentication service from Amazon Web Services (AWS). We use Cognito User Pools to handle user registration, login, multi-factor authentication (MFA), password resets, and JWT issuance. </li>
<li>What data is sent & when:
<ul>
<li>Registration / Sign-up: username, email, and any required attributes are sent to Cognito for account creation. </li>
<li>Sign-in / Authentication: username and password (and MFA code if enabled) are sent to Cognito for verification. </li>
<li>Token exchange: on successful login, Cognito returns ID, access, and refresh tokens which are stored client-side for session management. </li>
<li>Password reset & profile updates: relevant identifiers and new credentials or attributes are sent when users trigger those flows. </li>
</ul>
</li>
<li>Endpoints called:
<ul>
<li><code>https://cognito-idp.{region}.amazonaws.com/{userPoolId}</code> </li>
<li>Other AWS API endpoints under the <code>amazonaws.com</code> domain. </li>
</ul>
</li>
<li>Links:
<ul>
<li>Terms of Service: https://aws.amazon.com/service-terms/ </li>
<li>Privacy Policy: https://aws.amazon.com/privacy/</li>
</ul>
</li>
</ul>
</li>
<li>
Google reCAPTCHA v3
<ul>
<li>What it is & what it’s used for: 
A client-side bot-detection widget from Google that provides a score for interactions. We integrate reCAPTCHA v3 into the Authenticator block’s sign-up form by fetching a token in the browser. </li>
<li>What data is sent & when:
<ul>
<li>Client-side only: the plugin’s JS calls <code>grecaptcha.execute()</code> to retrieve a reCAPTCHA token and then includes that token in the sign-up request sent to Amazon Cognito. </li>
<li>Server-side verification: only happens if you configure a Pre-SignUp Lambda in your Cognito user pool that calls Google’s <code>siteverify</code> API with your secret key. That Lambda is wholly under your control—Gatey does not handle or store your secret. </li>
</ul>
</li>
<li>Configuration in WordPress:
<ul>
<li>Enter your reCAPTCHA v3 Site Key in Settings → General → reCAPTCHA v3 Public Key. </li>
<li>No Secret Key is required by the plugin. </li>
</ul>
</li>
<li>Links:
<ul>
<li>About reCAPTCHA v3: https://www.google.com/recaptcha/about/ </li>
<li>Google Terms of Service: https://policies.google.com/terms </li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
</ul>
</li>
</ul>
</li>
<li>
WPSuite platform connection (optional; site/workspace linking & shared features)
<ul>
<li>When it applies: 
When you use WP Admin → SmartCloud → Connect your Site to WPSuite to link this WordPress site to a WPSuite workspace, or to switch/disconnect later.</li>
<li>What it’s used for: 
Storing and retrieving Pro feature configuration (e.g., API/chatbot/feature settings) and enabling an admin-side preview experience so you can try Pro features in WP Admin before enabling them on the live site.</li>
<li>What data may be sent: 
Minimal account/session data required for authentication, and minimal site/workspace linking data required to associate a WordPress site with a workspace (e.g., site/workspace identifiers and the site’s URL/domain).</li>
<li>Where it goes / how it’s called: 
Secure HTTPS requests from the browser to WPSuite.io services (e.g. wpsuite.io and api.wpsuite.io).</li>
<li>Links:
<ul>
<li>WPSuite.io Privacy Policy: https://wpsuite.io/privacy-policy</li>
<li>WPSuite.io Terms of Use: https://wpsuite.io/terms-of-use</li>
</ul>
</li>
</ul>
</li>
<li>
Stripe (optional; subscription/purchase flow)
<ul>
<li>When it applies: Only when the user opens the optional WPSuite subscription / purchase flow in the shared admin component.</li>
<li>What it’s used for: Displaying hosted pricing/subscription UI for optional paid features.</li>
<li>What data may be sent: Browser/session data required by Stripe to render the hosted purchase UI and process the purchase flow.</li>
<li>Links:
<ul>
<li>Terms: https://stripe.com/legal/consumer</li>
<li>Privacy: https://stripe.com/privacy</li>
</ul>
</li>
</ul>
</li>
</ol>
<h3>Client-Side Libraries</h3>
<ol>
<li>AWS Amplify Authenticator
<ul>
<li>What it is & why we use it: 
A React UI component library from the Amplify Framework. We embed its <code><Authenticator></code> component inside our Gutenberg block to render and manage the login/signup flows. </li>
<li>What it does:
<ul>
<li>Renders sign-in, sign-up, MFA, and password-reset forms. </li>
<li>Under the hood it calls the Amazon Cognito APIs (see External Services entry), but does not itself authenticate or store secrets. </li>
</ul>
</li>
<li>Docs & source:
<ul>
<li>GitHub repo: https://github.com/aws-amplify/amplify-ui </li>
<li>Docs: https://ui.docs.amplify.aws/react/connected-components/authenticator</li>
</ul>
</li>
</ul>
</li>
</ol>
<h3>Trademark Notice</h3>
Amazon Web Services, AWS, and Amazon Cognito are trademarks of Amazon.com, Inc. or its affiliates.
Gatey is an independent open-source project and is not affiliated with, sponsored by, or endorsed by Amazon Web Services.
All references to “Amazon Cognito” are made purely to describe this plugin’s interoperability.
<h3>Source & Build</h3>
Public (free) source code: 
All of the code that ships in this public ZIP (the “free” version) is published here: https://github.com/smartcloudsol/gatey
WPSuite Admin source code: 
The <code>wpsuite-admin/</code> directory contains modules originating from the Hub for WPSuite.io project: https://github.com/smartcloudsol/hub-for-wpsuiteio 
This shared component handles WPSuite workspace linking, licence validation, and subscription management, and will be included in all upcoming WPSuite plugins.
Premium-only features: 
We maintain a fork of the AWS Amplify Authenticator (with Edit Account, Setup TOTP, etc.) and any additional paid-only screens and services in a private repository. Those files are not part of this public source.

Gatey – Login & SSO with Amazon Cognito

Drag-and-drop Amazon Cognito integration: 22-language screens, Single Sign-on, Multi-Factor Authentication, secure JWT tokens, and more.

Tiny 2FA + Brute Force Protection vs Gatey – Login & SSO with Amazon Cognito