oskarhane

<p>Secure WordPress login with this two factor auth. Users will have to enter an One Time Password when they log in.</p>
<h4>Why You Need This</h4>
<p>Users can have common or weak passwords that lets hackers/bots brute-force your WordPress site and gain access to your files and place malware there.<br />
Just like happend not that long ago: <a href="http://techcrunch.com/2013/04/12/hackers-point-large-botnet-at-wordpress-sites-to-steal-admin-passwords-and-gain-server-access/" rel="nofollow ugc">Article on TechCrunch</a></p>
<p>If all sites would have used this plugin, this would never happend.<br />
It doesn’t matter how weak your users passwords are, no one can gain access to your WordPress site<br />
without already having access to the users mobile phone or email inbox (depending on how the user gets his OTP).</p>
<h4>How Does It Work?</h4>
<p>This plugin uses the industry standard algorithm <a href="http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm" rel="nofollow ugc">TOTP</a> or <a href="http://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm" rel="nofollow ugc">HOTP</a> for creating One Time Passwords.<br />
A OTP is valid for a certain time and after that a new code has to be entered.</p>
<p>You can now choose to use third party apps like <a href="http://code.google.com/p/google-authenticator/" rel="nofollow ugc">Google Authenticator</a> which is available for most mobile platforms. You can really use any<br />
third party app that supports TOTP/HOTP that generates 6 digits OTP’s.<br />
Or, as before, you can choose to get your One Time Passwords by email.</p>
<p>Since you have to enter a secret code to third party apps, email is the default way of delivering One Time Passwords. Your<br />
users will have to activate delivery by third party apps themselves.</p>
<h4>Easy To Use</h4>
<p>Just install this plugin and you’re all set. There’s really nothing more to it.<br />
If you want to use a third party app, goto Two Factor Auth in the admin menu and activate it and set up your app.<br />
General settings can be found uner Settings -> Two Factor Auth in admin menu. Settings for each individual user<br />
can be found at the root level of the admin menu, in Two Factor Auth.<br />
A bit more work to get logged in, but a whole lot more secure!</p>
<p>If you use WooCommerce or other plugins that make custom login forms, you will not be able to login through those anymore.<br />
I will be adding a plugin that puts a One Time Password field to WooCommerce. If you use some other plugin that needs<br />
support for this, let me know in the support forum.</p>
<h4>TOTP or HOTP</h4>
<p>Which algorithm you and your users choose doesn’t really matter. The time based TOTP is a bit more secure since a One Time<br />
Password is valid only for a certain amount of time. But this requires the server time to be in sync the clients time (if<br />
the OTP isn’t delivered by email). This is often hard to do with embedded clients and the event based HOTP is then a better choice.<br />
If you have a somewhat slow email server and have chosen email delivery, you might not get the TOTP in time.</p>
<p>Conslusion: Choose which ever you want. TOTP is a little bit safer since OTP:s only are valid for a short period.</p>
<p>Note that email delivery users always uses the site default algorithm, which you can set on the settings page. Third party<br />
apps users can choose which one they want.</p>
<h4>Is this really Two Factor Auth?</h4>
<p>Before version 3.0 this plugin had ‘kind of’ two factor auth where the OTP was delivered to an email address.<br />
Since version 3.0 you can have real two factor auth if you activate the Third Party Apps delivery type.</p>
<p>Read more about <a href="http://oskarhane.com/two-factor-auth-explained/" rel="nofollow ugc">what two factor auth means >></a>.</p>
<p>See http://oskarhane.com/plugin-two-factor-auth-for-wordpress/ for more info.</p>


Two Factor Auth

Secure WordPress login with Two Factor Auth. Users will have to enter an One Time Password when they log in.

Two Factor Auth vs Two Factor Authentication