Web Guy

<p><a href="https://github.com/webguyio/tiny-2fa/issues" rel="nofollow ugc">💬 Ask Question</a> | <a href="mailto:webguywork@gmail.com" rel="nofollow ugc">📧 Email Me</a></p>
<p>This is probably the 2FA plugin you’re looking for.</p>
<p>Secure, private, and <em>lightweight</em>.</p>
<p>Integrates into WordPress like a native feature.</p>
<h4>Proactive vs Reactive Security</h4>
<p>Prevents attacks instead of reacting to them. The best breach is the one that never happens.</p>
<h4>How it Works</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Go to <em>Users > Profile > Two-Factor Authentication</em> (near the bottom)</li>
<li>Check the box next to “Enable 2FA” and click “Update Profile”</li>
<li>2FA and Backup Codes are now enabled</li>
<li>Scan the QR code or manually enter the secret key into your auth app of choice (and be sure to rename the generic site name “2FA” to something more useful)</li>
<li>Once successful login with a 2FA code from your app has been confirmed, you should disable Backup Codes</li>
<li>Brute force protection is enabled by default and can be managed site-wide by admins in profile settings</li>
</ol>
<p>Backup Codes have been rethought from the usual method you might be used to. Read more about that in the FAQ below.</p>
<h4>Need Support?</h4>
<p>Ask for help <a href="https://github.com/webguyio/tiny-2fa/issues" rel="nofollow ugc">here</a>.</p>


Tiny 2FA + Brute Force Protection

A simple two-factor authentication plugin that just works.

Kieran O'Shea

Henrik Schack

<p>This plugin dramatically enhances the security of your WordPress website by adding Multi Factor Authentication (MFA) in the form of One Time Passwords (OTP)<br />
using <a href="https://www.yubico.com/" rel="nofollow ugc">Yubikey USB Tokens</a>. In addition to providing your username and password to login, this plugin requests an OTP code<br />
generated by a Yubikey, validates this via an API and only grants access if this check passes. The requirement to use an OTP can be set on a user by user<br />
basis and there is also a feature to require users above a certain privilege level to always use OTP.</p>
<h3>External services</h3>
<p>This plugin connects to an API to validate the OTP tokens generated by your security key. This is required because storing the private keys<br />
on the same web server as the site you wish to protect would be a security risk.</p>
<p>By default Yubico’s own validation server is employed, although you may setup your own server and use this instead</p>
<p>The default Yubico API only collects the one time password (OTP) data as provided by your security key when you login. The service validates this<br />
and then stores this token as “used” so it may not be replayed as part of an attack. It does not collect any other data (such as what URL is being<br />
authenticated using the key etc.)</p>
<p>This service is provided by “Yubico AB”: <a href="https://www.yubico.com/support/terms-conditions/privacy-notice/" rel="nofollow ugc">Privacy Policy</a>, <a href="https://www.yubico.com/support/terms-conditions/yubico-website-terms-conditions/" rel="nofollow ugc">Terms of Use</a></p>


Yubikey


Calling all regular Yubikey users! If you haven’t done so already, please take the time to review the plugin here



If you have a problem, issue or question, please post in the forums first before rating the plugin negatively – most things can be sorted out either through communication or a new release!


Reviews welcome

Enhanced login security for WordPress by requiring the presentation of a One Time Password (OTP) from a registered Yubikey

Tiny 2FA + Brute Force Protection vs Yubikey