WFMattR

Mark Maunder

wfryan

wfmatt

<h3>WORDFENCE LOGIN SECURITY</h3>
Wordfence Login Security contains a subset of the functionality found in the full Wordfence plugin: Two-factor Authentication, XML-RPC Protection and Login Page CAPTCHA.
Are you looking for comprehensive WordPress Security? <a href="https://wordpress.org/plugins/wordfence/" rel="ugc">Check out the full Wordfence plugin</a>.
<h4>TWO-FACTOR AUTHENTICATION</h4>
<ul>
<li>Two-factor authentication (2FA), one of the most secure forms of remote system authentication available.</li>
<li>Use any TOTP-based authenticator app or service like Google Authenticator, Authy, 1Password or FreeOTP.</li>
<li>Enable 2FA for any WordPress user role.</li>
<li>Completely free to use, no limits or restrictions of any kind.</li>
</ul>
<h4>LOGIN PAGE CAPTCHA</h4>
<ul>
<li>Easily enable Google ReCAPTCHA v3 on your login and registration pages.</li>
<li>Stops bots from logging in without inconveniencing your site visitors.</li>
<li>Robust protection against password guessing and credential stuffing attacks distributed across large IP pools</li>
</ul>
<h4>XML-RPC PROTECTION</h4>
<ul>
<li>XML-RPC is the biggest target for WordPress attacks, but is often overlooked.</li>
<li>Protect XML-RPC with 2FA or disable it altogether if it’s not needed.</li>
</ul>

Wordfence Login Security

The Plugin works and integrates nicely into wordfence security and wp itself. TOTP works great, and the captcha integration works too. Sadly it doesn't support multiple 2fa methods like TOTP & "backup codes" as well as email as backup. Other 2fa methods like U2F are not supported. This Plugin doesn't work with the yubico yubikey hardware keys. 

Good, but somewhat limited

Good compliment to Wordfence, but please add login URL obfuscation!

Because you do not do this either I take another plugin as well like WPS Hide Login, or I just take WP Cerber which does everything!

Great, but...

Easy to use


Does not include the ability to limit login attempts, add password complexity requirements, or anything that would comprise modern security best practices. It's strictly a 2FA plugin, which is done more simply and better by other plugins. It does work tho.


Too much load for a simple 2FA plugin

Secure your website with Wordfence Login Security, providing two-factor authentication, login and registration CAPTCHA, and XML-RPC protection.

newwaypmsco

For years, users worldwide have faced security risks due to insecure login pages. WordPress sites are no exception to these challenges. Our plugin provides an innovative solution for login security by integrating facial recognition technology with traditional username and password methods.
Currently, users log in using either a username and password or a Two-Factor Authentication (2FA) method. While 2FA enhances security, it has its own vulnerabilities:
<ol>
<li>Phishing attacks: Hackers can deceive users into entering their 2FA codes on fake websites.</li>
<li>Lost or stolen devices: If the device used to receive 2FA codes (e.g., a mobile phone) is lost or stolen, unauthorized access becomes possible.</li>
<li>SMS-based 2FA: SMS codes can be intercepted through SIM swapping attacks.</li>
<li>Access issues: Users may face challenges accessing 2FA codes due to technical issues.</li>
<li>Software flaws: Authentication apps can have security vulnerabilities.</li>
</ol>
Our plugin addresses these issues by leveraging facial recognition for authentication. When a user attempts to log in, our plugin communicates with a secure Django server for authentication, ensuring no sensitive user data is stored in WordPress databases. The facial recognition system can distinguish between a live user and a static photo, making unauthorized access virtually impossible.
For a complete tutorial on installing and using the plugin, <a href="https://youtu.be/sBdnzxpg0UA" rel="nofollow ugc">watch this video</a>.
Key Features:
<ul>
<li>Facial recognition authentication using a simple webcam.</li>
<li>No storage of user credentials in WordPress databases.</li>
<li>Interaction between the plugin and server is conducted through secure APIs with encrypted data transmission.</li>
<li>Enhanced security with PBKDF2 password hashing (870,000 iterations with salt) on the Django server.</li>
<li>Seamless integration with WordPress login pages, adding an extra layer of security.</li>
<li>Simplified registration process for users to set up facial recognition and credentials.</li>
<li>New Manage Account section for users to change their password, update photo, or delete their account, secured with OTP and facial recognition.</li>
<li>Activation email sent during registration, with a 24-hour expiration period.</li>
<li>Each user can only register with a single email address.</li>
</ul>
Why Choose Our Plugin?
<ol>
<li>Protects against brute-force attacks targeting WordPress login pages.</li>
<li>Eliminates reliance on weak password hashing mechanisms in WordPress.</li>
<li>Enhances user experience by enabling secure logins without expensive hardware.</li>
<li>Provides a scalable solution for future platforms beyond WordPress.</li>
</ol>
Try Our Demo Before Installing!
Want to test our plugin in a safe environment before installing it on your own site? We’ve set up a demo WordPress site where you can experience the plugin in action.
Email us at [support@newwaypmsco.com] to request access – we’ll send you the demo site link, along with a username and password to log in and test the plugin.
Once you’re satisfied, you can install it on your own WordPress site with confidence!
<h3>External Services</h3>
This plugin connects to an external Django server to perform facial recognition authentication. The communication between the plugin and the server is secure, ensuring the safety of user data through encrypted transmission.
<h3>Third-Party Service Details</h3>
<ol>
<li>
Service Name: Django Server for Facial Recognition Authentication
<ul>
<li>Purpose: To authenticate users using facial recognition.</li>
<li>Data Sent:
<ul>
<li>During login:</li>
<li>Username and password entered by the user.</li>
<li>Facial image captured by the webcam for authentication.</li>
<li>During registration:</li>
<li>Username and password chosen by the user.</li>
<li>Facial image captured by the webcam to set up facial recognition.</li>
</ul>
</li>
<li>Storage & Security:
<ul>
<li>All data is transmitted securely using SSL encryption.</li>
<li>Facial data is stored on our Django server with AES-256 encryption.</li>
<li>No facial data is stored in WordPress databases.</li>
</ul>
</li>
<li>Conditions: Data is sent only when users initiate login or registration.</li>
<li>User Control: We’re working on adding a feature to let users delete their facial data in future updates. For now, contact our support team at [support@newwaypmsco.com] for assistance with data management.</li>
<li>Terms of Service: <a href="https://api.newwaypmsco.com/terms-of-service/" rel="nofollow ugc">https://api.newwaypmsco.com/terms-of-service/</a></li>
<li>Privacy Policy: <a href="https://api.newwaypmsco.com/privacy-policy/" rel="nofollow ugc">https://api.newwaypmsco.com/privacy-policy/</a></li>
</ul>
</li>
<li>
External API Endpoints Used:
<ul>
<li><code>https://api.newwaypmsco.com/api/user/login/</code></li>
<li><code>https://api.newwaypmsco.com/api/user/register/</code></li>
</ul>
</li>
</ol>
By using this plugin, users acknowledge and agree to the terms and conditions outlined above.
<h3>Resources</h3>
This plugin uses the open-source SweetAlert library for user alerts. Non-minified source code is available in: 
– assets/js/bootstrap.js (non-minified version) 
– assets/js/sweetalert.min.js (SweetAlert library)
<ul>
<li>Official SweetAlert Website: https://sweetalert.js.org/</li>
<li>SweetAlert CDN: https://cdnjs.com/libraries/sweetalert/2.1.2</li>
<li>GitHub Repository: https://github.com/t4t5/sweetalert</li>
</ul>

Facial Recognition Authentication

Facial Recognition Authentication plugin integrates facial recognition with WordPress login for enhanced security and user experience.

Wordfence Login Security vs Facial Recognition Authentication