noplanman

<p>With WP-OTP you can easily set up 2 Factor Authentication with One Time Passwords for your WordPress login.<br />
This extra layer makes your WordPress site a lot more secure.</p>
<p>The new stealth mode allows for invisible OTP code entry, making your login screen look like any other, no extra OTP code input field.</p>
<h4>Getting started</h4>
<p>After installing and activating the plugin, every user can enable WP-OTP on their profile page.</p>
<p>It’s as easy as scanning the provided QR Code or entering the OTP secret to any OTP generator app.<br />
Then just activate it by entering the generated OTP and voilà, all set up.<br />
Now, the login requires an OTP code to succeed.</p>
<p>Each user gets their own secret key to authenticate with, giving them control over their login security.</p>
<h4>Development</h4>
<p>This plugin is completely open source and a work of passion.<br />
If you would like to be part of it and join in, make your way over to the <a href="https://git.feneas.org/noplanman/wp-otp" rel="nofollow ugc">project page</a> now.<br />
Also, if you have an idea you would like to see in this plugin or if you’ve found a bug, please <a href="https://git.feneas.org/noplanman/wp-otp/issues/new" rel="nofollow ugc">let me know</a>.</p>
<h4>Configuration</h4>
<ul>
<li><code>WP_OTP_STEALTH</code>: Set this to <code>true</code> to enable stealth OTP mode.</li>
</ul>
<h4>Filters</h4>
<p>There are a multitude of filters to be adjusted.</p>
<ul>
<li><code>wp_otp_qr_code_provisioning_uri</code>: URI for online QR Code rendering (must contain <code>{PROVISIONING_URI}</code> placeholder for QR Code data).</li>
<li><code>wp_otp_login_form_text</code>: Text for input field on the login screen.</li>
<li><code>wp_otp_login_form_text_sub</code>: Subtext for the input field on the login screen.</li>
<li><code>wp_otp_login_form_invalid_code_text</code>: Error text for an invalid code input on the login screen.</li>
<li><code>wp_otp_code_expiration_window</code>: Set the window of code verification expiration.</li>
<li><code>wp_otp_recovery_codes_count</code>: Number of recovery codes to generate.</li>
<li><code>wp_otp_recovery_codes_length</code>: Length of the recovery codes.</li>
<li><code>wp_otp_secret_length</code>: Length of the secret key.</li>
</ul>
<h4>Minimum requirements</h4>
<p>WordPress 4.6, PHP 7.4.</p>
<h4>Donate / Support</h4>
<p>All <a href="https://noplanman.ch/donate" rel="nofollow ugc">donations</a> are much appreciated, thank you 🙏</p>
<p><a href="https://tidelift.com/subscription/pkg/wordpress-wp-otp?utm_source=wordpress-wp-otp&utm_medium=referral&utm_campaign=readme" rel="nofollow ugc">Get professional support for this plugin with a Tidelift subscription</a><br />
<em>Tidelift helps make open source sustainable for maintainers while giving companies assurances about security, maintenance, and licensing for their dependencies.</em></p>
<h4>Security</h4>
<p>To report a security vulnerability, please use the <a href="https://tidelift.com/security" rel="nofollow ugc">Tidelift security contact</a>. Tidelift will coordinate the fix and disclosure.</p>


WP-OTP

Make your WordPress login extra secure with One Time Passwords.

oosoft

OOSOFT

<p>OOSOFT 2FA Security adds robust two-factor authentication to your WordPress site. Protect every login with a second verification step using a TOTP authenticator app (Google Authenticator, Authy, etc.) or a one-time code sent to your email address.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>TOTP Authenticator App</strong> — compatible with Google Authenticator, Authy, Microsoft Authenticator, and any RFC 6238-compliant app.</li>
<li><strong>Email OTP</strong> — sends a time-limited one-time code to the user’s registered email address.</li>
<li><strong>Backup Codes</strong> — generate single-use recovery codes so users are never locked out.</li>
<li><strong>Role-Based Enforcement</strong> — require 2FA for specific roles (e.g. administrators) while leaving it optional for others.</li>
<li><strong>Rate Limiting</strong> — brute-force protection with configurable attempt limits and lockout periods.</li>
<li><strong>Security Logs</strong> — detailed event logging with filterable admin view and automatic pruning.</li>
<li><strong>Encrypted Secret Storage</strong> — TOTP secrets are encrypted at rest using libsodium (preferred) or AES-256-GCM/CBC via OpenSSL.</li>
<li><strong>HKDF Key Derivation</strong> — encryption keys are derived from your WordPress secret keys; no raw key material is stored.</li>
</ul>


OOSOFT 2FA Security

Enterprise-grade Two-Factor Authentication for WordPress with TOTP, Email OTP, backup codes, and role-based enforcement.

WP-OTP vs OOSOFT 2FA Security