gpaterno

<p>A lot of web sites, even well known ones (newspapers, telcos, …) adopts<br />
WordPress as their CMS. WordPress is a great platform, however it<br />
can happen that password leaking or guessing might lead to unauthorized<br />
access to the platform. A potential attacker can be therefore able to<br />
change articles, part of the web site and/or make the website unavailable,<br />
with image and economic damages for a company or for a blogger.<br />
This is even more true if your website is not SSL protected.</p>
<p>SecurePass is a SaaS service offering an easy and affordable solution<br />
for One Time Passwords (OTP) and strong authentication in general. They<br />
offer 5 users for free included with their standard (=basic) account, which<br />
is more than enough for standard blogs and web sites. Companies can purchase<br />
additional users, if needed.</p>
<p>More information on the section “Setup and configure SecurePass” in Other Notes.<br />
To open a SecurePass account go to http://www.secure-pass.net/open</p>
<h3>Setup and configure SecurePass</h3>
<p>If you don’t own already an account with SecurePass, you can sign-up for a new account here: http://www.secure-pass.net/open</p>
<p>Note: Use “misec2011” as promo code, it will give you an entitlement for using<br />
SecurePass up to 10 users for 2 years free-of-charge. Without any promo code,<br />
you will have 5 users for 20 years for free. It depends on what you need (more users or more years).</p>
<p>Connect to the admin interface on https://admin.secure-pass.net<br />
and create a new device (basically a RADIUS client).</p>
<p>In the admin interface, go to the “Device” section and add a new device.<br />
You will need to set the public IP Address of the server, a fully qualified<br />
domain name (FQDN), and the secret password for the radius authentication.<br />
It’s ok if your web server is behind a firewall and/or NAT, ensure that<br />
your server has rights to send (and receive) RADIUS authentication requests,<br />
i.e. UDP port 1812.</p>
<h3>Further reading</h3>
<ul>
<li>
<p>This plugin web site:<br />
https://github.com/gpaterno/wp-securepass/</p>
</li>
<li>
<p>SecurePass web site:<br />
http://www.secure-pass.net/</p>
</li>
<li>
<p>UK on-line shop for SecurePass (they sell hardware tokens):<br />
http://shop.nervinesecurity.com/</p>
</li>
</ul>


SecurePass authentication

This is a plugin to autheticate users through the SecurePass One Time Passwords service.

miniorange

twofactorauthentication

<p><strong>Multi-Factor Authentication – Two Factor (2FA/OTP)</strong> – Multi-factor authentication can be configured for any TOTP-based authentication method like Google Authenticator, Microsoft Authenticator, etc to secure your WordPress website. It also supports OTP Over SMS, OTP Over Email, Duo Authenticator, Microsoft Authenticator, OTP Over WhatsApp, OTP Over Telegram, and many more authentication methods.</p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/BS6tY-Goa1Q?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p><strong>Note: The two-factor plugin is GDPR Compliant and supports a wide variety of Language Translations</strong></p>
<h4>Google Authenticator ( 2FA, Two Factor Authentication ) sync on multiple websites with the same OTP</h4>
<p>You only need to configure <strong>Google Authenticator</strong> and other Two Factor Authentication ( 2FA ) methods once even on a multisite environment. This configuration will then be automatically reflected on the entire network. This is available for Google Authenticator, Duo Authenticator, Microsoft Authenticator, Security Questions, LastPass, Authy, miniOrange methods, OTP over SMS, and OTP over Email. It is supported only if you are using our MFA cloud services.</p>
<h4>supports variety of WordPress forms</h4>
<ul>
<li><a href="https://wordpress.org/plugins/ultimate-member/" rel="ugc">Ultimate Member – User Profile & Membership Form</a></li>
<li><a href="https://wordpress.org/plugins/restrict-content/" rel="ugc">Restrict Content Form</a></li>
<li><a href="https://wordpress.org/plugins/theme-my-login/" rel="ugc">My theme Login Form</a></li>
<li><a href="https://wordpress.org/plugins/user-registration" rel="ugc">User Registration – Custom Registration Form</a></li>
<li><a href="https://wordpress.org/plugins/loginpress/" rel="ugc">Custom Login Page Customizer Form</a></li>
<li><a href="https://wordpress.org/plugins/admin-custom-login/" rel="ugc">Admin Custom Login Form</a></li>
<li><a href="https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/" rel="ugc">RegistrationMagic – Custom Registration Forms</a><br />
and more.</li>
</ul>
<h4>Features</h4>
<ul>
<li>We support multi-factor authentication for all types of devices.</li>
<li>Simplified & user friendly UI to set up Google Authenticator and other Two Factor Authentication ( 2FA/TFA/MFA ) methods.</li>
<li><strong>Variety of Authentication Methods:</strong> Any application supporting OTP methods like Google Authenticator, OTP over SMS, Duo Authenticator, OTP over EMAIL, Authy Authenticator, LastPass Authenticator, QR Code, Push Notification, Soft Token, and Security Questions(KBA)</li>
<li>Two Factor Authentication (2FA/TFA) allows authentication on the login page itself for Google Authenticator </li>
</ul>
<h4>How is miniOrange Two Factor Authentication different?</h4>
<ul>
<li>We support multiple authentication methods and also provide the option of a backup method.</li>
<li>We support Device Identification or remember device features.</li>
<li>We support MFA methods like OTP over SMS, OTP over Email, etc for the Woocommerce frontend login theme.</li>
<li>ShortCode is now available for different frontend custom login pages and Premium themes as well.</li>
</ul>
<h4>Multi-Factor Authenticator ( 2FA/OTP )</h4>
<p><a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#pricing" rel="nofollow ugc">Premium Plugin Features</a></p>
<ul>
<li>Two Factor Authentication (2FA) for Users as per the upgrade <em>( Site-based pricing )</em></li>
<li><strong>Two-Factor Authentication Methods:</strong> <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/google-authenticator" rel="nofollow ugc">Google Authenticator</a>, <a href="https://youtu.be/fV-VnC_5Q5c" rel="nofollow ugc">Authy Authenticator</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/microsoft-authenticator" rel="nofollow ugc">Microsoft Authenticator</a>, <a href="https://plugins.miniorange.com/two-factor-authentication-2fa-mfa-for-user-registration-login-form" rel="nofollow ugc">LastPass Authenticator</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/step-by-setup-guide-to-set-up-security-question" rel="nofollow ugc">Security Questions</a>, OTP Authentication( OTP Over Email & OTP Over SMS), Email Verification, Mobile Verification <em>( SMS credits need to be purchased as per the need)</em></li>
<li><strong><a href="https://docs.miniorange.com/documentation/login-username-2nd-factor-2" rel="nofollow ugc">Multiple Login Options</a>:</strong> Username + password + two-factor (or) Username + two-factor i.e. Passwordless login /Login without password /Password free authentication. You can opt between a password and 2FA or only a second factor</li>
<li><a href="https://docs.miniorange.com/documentation/specific-set-authentication-methods-based-role" rel="nofollow ugc">Role based MFA</a></li>
<li><strong>Backup Method:</strong> KBA(Security Questions), OTP over Email</li>
<li>Multisite compatible</li>
<li><a href="https://docs.miniorange.com/documentation/custom-redirect-login-url" rel="nofollow ugc">User role based redirection after Login</a></li>
<li><a href="https://docs.miniorange.com/documentation/google-authenticator-app-name" rel="nofollow ugc">Customize account name in Google Authenticator app</a></li>
<li><a href="https://docs.miniorange.com/documentation/custom-security-questions" rel="nofollow ugc">Custom Security Questions (KBA)</a></li>
</ul>
<h4>Multi Factor Authenticator ( 2FA/OTP )</h4>
<p><a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#pricing" rel="nofollow ugc">Premium Plugin(All Inclusive) Features</a></p>
<ul>
<li>Two Factor Authentication (2FA) for Users as per the upgrade <em>( Site-based pricing )</em></li>
<li><strong>Two-Factor Authentication Methods:</strong> <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/google-authenticator" rel="nofollow ugc">Google Authenticator</a>, <a href="https://youtu.be/fV-VnC_5Q5c" rel="nofollow ugc">Authy Authenticator</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/microsoft-authenticator" rel="nofollow ugc">Microsoft Authenticator</a>, <a href="https://plugins.miniorange.com/two-factor-authentication-2fa-mfa-for-user-registration-login-form" rel="nofollow ugc">LastPass Authenticator</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/step-by-setup-guide-to-set-up-security-question" rel="nofollow ugc">Security Questions</a>, OTP Authentication( OTP Over Email & OTP Over SMS), Email Verification, Mobile Verification <em>( SMS credits need to be purchased as per the need)</em></li>
<li><strong><a href="https://docs.miniorange.com/documentation/login-username-2nd-factor-2" rel="nofollow ugc">Multiple Login Options</a>:</strong> Username + password + two-factor (or) Username + two-factor i.e. Passwordless login /Login without password /Password free authentication. You can opt between a password and 2FA or only a second factor.</li>
<li><strong>Unlimited Email transactions</strong></li>
<li><strong>Backup Method:</strong> KBA (Security Questions), OTP Over Email, Backup codes</li>
<li><a href="https://docs.miniorange.com/documentation/custom-redirect-login-url" rel="nofollow ugc">User role based redirection after Login</a></li>
<li><a href="https://docs.miniorange.com/documentation/google-authenticator-app-name" rel="nofollow ugc">Customize account name in Google Authenticator app</a></li>
<li><a href="https://docs.miniorange.com/documentation/custom-security-questions" rel="nofollow ugc">Custom Security Questions (KBA)</a></li>
<li><a href="https://docs.miniorange.com/documentation/specific-set-authentication-methods-based-role" rel="nofollow ugc">Role based 2 Factor</a></li>
<li><a href="https://docs.miniorange.com/documentation/enforce-2fa-users" rel="nofollow ugc">Force Two-factor for users</a></li>
<li><a href="https://docs.miniorange.com/documentation/want-send-email-notification-users-setting-2-factor" rel="nofollow ugc">Email notification to users asking them to set up Two-Factor Authentication (WP 2FA/TFA)</a></li>
<li><a href="https://docs.miniorange.com/documentation/privacy-policy-site" rel="nofollow ugc">Set Privacy Policy for users</a></li>
<li><a href="https://docs.miniorange.com/documentation/remember-my-device" rel="nofollow ugc">Remember Device to skip 2fa</a></li>
<li><strong>Customizable Login UI Popup:</strong> Using google authenticator plugin you can customize the user interface of the login popup as per your preference</li>
<li>Multisite compatible (only 3 subsites)</li>
</ul>
<h4>Multi-Factor Authenticator ( 2FA/OTP )</h4>
<p><a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#pricing" rel="nofollow ugc">Enterprise Plugin Features</a></p>
<ul>
<li>Two Factor Authentication (2FA) for Users as per the upgrade <em>( User-based pricing )</em></li>
<li><strong>Available Authentication Methods:</strong> <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/google-authenticator" rel="nofollow ugc">Google Authenticator</a>, <a href="https://youtu.be/fV-VnC_5Q5c" rel="nofollow ugc">Authy Authenticator</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/microsoft-authenticator" rel="nofollow ugc">Microsoft Authenticator</a>, <a href="https://plugins.miniorange.com/two-factor-authentication-2fa-mfa-for-user-registration-login-form" rel="nofollow ugc">LastPass Authenticator</a>, QR Code, <a href="https://plugins.miniorange.com/two-factor-authentication-2fa-mfa-for-user-registration-login-form" rel="nofollow ugc">Push Notification</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/step-by-setup-guide-to-set-up-miniorange-soft-token" rel="nofollow ugc">Soft Token</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/step-by-setup-guide-to-set-up-miniorange-soft-token" rel="nofollow ugc">Security Questions(KBA)</a>, OTP Authentication(<a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/otp_over_email" rel="nofollow ugc">OTP Over Email</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/step-by-setup-guide-to-set-up-otp-over-sms" rel="nofollow ugc">OTP Over SMS</a> or OTP Over SMS and Email), <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/email_verification" rel="nofollow ugc">Email Verification</a>, <a href="https://mail.google.com/mail/u/0/?fs=1&tf=cm&source=mailto&su=TWO+FACTOR+WORDRESS+-+Hardware+Token+2FA+Method+.&to=2fasupport@xecurify.com&body=I+am+interested+in+the+Hardware+Token+method+of+the+2FA+plugin.+" rel="nofollow ugc">Hardware Token</a> <em>( SMS and Email credits need to be purchased for successful OTP authentication as per the need)</em></li>
<li><strong>Multiple Login Options:</strong> Username + password + two-factor Authentication (or) Username + two-factor authentication(2FA) i.e. <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/passwordless-login" rel="nofollow ugc">Passwordless login /Login without password</a>.</li>
<li><strong>Backup Methods:</strong> <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/step-by-setup-guide-to-set-up-security-question" rel="nofollow ugc">KBA(Security Questions)</a>, <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/otp_over_email" rel="nofollow ugc">OTP Over Email</a>, <a href="https://plugins.miniorange.com/wordpress-two-factor-authentication-setup-guides#" rel="nofollow ugc">Backup Codes</a></li>
<li><strong><a href="https://plugins.miniorange.com/two-factor-authentication-2fa-for-multiple-wordpress-websites" rel="nofollow ugc">Sync 2fa for multiple websites</a></strong></li>
<li><strong>Multisite compatible</strong> for all WordPress 2FA methods</li>
<li>Email notification to users asking them to set up Google Authenticator – Two-Factor Authentication (WP 2FA/TFA)</li>
<li><a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/custom-redirect-login-url" rel="nofollow ugc">User <strong>role based redirection</strong></a> after Login, Custom Security Questions (KBA), Customizable account name in Google Authenticator app</li>
<li><a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/specific-set-authentication-methods-based-role" rel="nofollow ugc">Enable Two-Factor Authentication (WP 2FA/OTP) for specific Users/User Roles</a></li>
<li>Choose specific two-factor authentication methods for Users</li>
<li><strong>Add-Ons Included:</strong> <a href="https://developers.miniorange.com/docs/security/wordpress/wp-security/remember-my-device" rel="nofollow ugc">RBA & Trusted Devices Management Add-on</a>, <a href="https://plugins.miniorange.com/wordpress-two-factor-authentication-setup-guides#" rel="nofollow ugc">Personalization Add-on</a> and <a href="https://plugins.miniorange.com/wordpress-two-factor-authentication-setup-guides#" rel="nofollow ugc">Short Codes Add-on</a></li>
<li><strong>Brute force attack prevention, IP Blocking & User login Monitoring</strong></li>
<li>File protection & strong password</li>
<li>Monitoring current Google Authenticator and other two-factor authentication (2 Factor) method of all the users in the plugin</li>
<li><a href="https://plugins.miniorange.com/wordpress-two-factor-authentication-setup-guides#" rel="nofollow ugc">Session restriction</a></li>
</ul>
<h3>Multi factor authentication ( 2FA / MFA )</h3>
<p>You can configure multiple WordPress 2FA methods like google authenticator, OTP over Email, OTP over SMS, etc, and choose any one method from a list of configured methods to use as 2FA for your WordPress website. Multi-factor authentication is helpful for cases such as when you do not have your phone and cannot access your TOTP app for login. You can then use other MFA methods like OTP over Email to login.</p>
<p>Check all the features other than MFA ( 2FA ) here: <a href="https://plugins.miniorange.com/2-factor-authentication-for-wordpress-wp-2fa#pricing" rel="nofollow ugc">miniOrange Website</a>.</p>
<h4>Why do you need to register for Multi-Factor authentication?</h4>
<p>Multi-Factor authentication uses miniOrange APIs to communicate between your WP website and miniOrange. To keep this communication secure, we ask you to register and assign API keys specific to your account. This way your account and users’ calls can only be accessed by API keys assigned to you.<br />
Adding to this, you can also use the same account on multiple applications and your users do not have to maintain multiple accounts on WordPress 2FA like Google Authenticator. Single code generated in Google Authenticator will be enough to login to all sites. With this, you can also achieve sync of two factor authentication across multiple sites. This helps to provide a secure WP 2FA cloud solution.</p>
<h4>Useful blog posts about two factor authentication ( 2FA/MFA ) plugin </h4>
<ul>
<li><a href="https://themeisle.com/blog/how-to-add-two-factor-authentication-to-wordpress/" rel="nofollow ugc">Beginner’s Guide: How to Add Two Factor Authentication to WordPress</a></li>
<li><a href="https://phppot.com/wordpress/how-to-add-wordpress-two-factor-authentication-2fa-using-google-authenticator-plugin/" rel="nofollow ugc">How to Add WordPress Two Factor Authentication (2FA/TFA)</a></li>
</ul>
<h4>OTP OVER WHATSAPP</h4>
<p>With <a href="https://plugins.miniorange.com/login-with-whatsapp-as-a-two-factor-method-for-wordpress" rel="nofollow ugc">OTP over WhatsApp</a>, users can receive OTP via the world’s most popular messaging app, WhatsApp as 2FA. Click here to download the <a href="https://miniorange.s3.amazonaws.com/public/plugins/WordPress/2FA/login-with-whatsapp-otp-2fa-1.0.0.zip" rel="nofollow ugc">Login with WhatsApp plugin</a>.</p>
<h4>OTP USING FIREBASE</h4>
<p>This add-on allows you to use Firebase SMS transactions to send OTP via SMS as 2FA. Using this add-on, you can get upto 10,000 SMS transactions a month to send OTPs. For further information, please contact us at <a href="https://mail.google.com/mail/u/0/?fs=1&tf=cm&source=mailto&su=TWO+FACTOR+WORDRESS+-+WP+Firebase+Authentication+Trial+Request.&to=2fasupport@xecurify.com&body=I+want+to+request+a+trial+of+the+Firebase+Authentication+plugin.+" rel="nofollow ugc">2fasupport@xecurify.com</a>.</p>
<h4>OTP FOR SELECTED COUNTRIES</h4>
<p>This is an add-on which allows <strong>OTP Verification to be enabled for selected list of countries only</strong>. OTP Verification for any other country not in the list will be blocked.</p>
<h4>BULK SMS AND OTP</h4>
<p>This is an add-on which allows <strong>Admin to send Custom SMS and OTP Verification codes in bulk</strong>. Upload the CSV file or enter the numbers manually along with the SMS template that needs to be sent in bulk.</p>
<h4>LIMIT OTP REQUEST</h4>
<p>This is an add-on which allows <strong>Blocking of OTP codes from being sent out before the set timer is up.</strong> This Addon helps in limiting malicious users or unwanted OTP requests to be made by blocking the user for the time limit set.</p>
<h4>OTP OVER PHONE CALL</h4>
<p>This is an add-on which allows <strong>OTP Verification over Phone Call instead of SMS.</strong> The code will be received via a phone call to the customer.</p>
<h4>VERIFICATION VIA EMAIL LINK</h4>
<p>This is an add-on which allows <strong>User Verification</strong> via accept/reject links received on the email instead of OTP codes.</p>


Two Factor Authentication (2FA , MFA, OTP SMS and Email)

Two-factor authentication (2FA / MFA) for all your users / user roles.

SecurePass authentication vs Two Factor Authentication (2FA , MFA, OTP SMS and Email)