Plugin
Updated
Two Factor Authentication
User Registration Two Factor Authentication by WPEverest is a WordPress plugin that adds a second verification step to your login process. After entering a password, users confirm their identity with a one-time password sent by email or by SMS through Twilio.
- Version
- 1.2.1
- Released
- Sep 9, 2026
- Developer
- WPEverest
- Type
- WordPress plugin
- Licence
- GPL
- Included in
- Every plan, or $3.99 on its own
- Topics
- Security Plugins
What’s new in Two Factor Authentication 1.2.1
Version 1.2.1 · Sep 9, 2026
Latest
- FixedOTP attempt counter reset on every re-authentication, allowing brute-force.
What it does
A username and password on their own leave an account open to anyone who guesses or steals them. This add-on works with the User Registration plugin and asks users for a one-time password (OTP) before their login completes. Codes can go to the email address on file, or to a mobile phone when you connect a Twilio account for SMS delivery. Because it plugs into the existing User Registration forms, the extra check becomes part of the login flow you already have, and no custom coding is needed.
You decide who has to pass the second step. You can apply two-factor authentication to every user or only to chosen user roles, such as administrators and other accounts with wider access. The OTP settings let you set code length, expiration time, resend limits, usage restrictions and how long a login is held after failed attempts. You can also edit the frontend messages users see during verification, so the wording fits your site. It suits membership sites, online shops and any site where people log in to an account.
Best for
- Membership sites built with the User Registration plugin
- Online stores that want safer customer and admin logins
- Site owners protecting admin and privileged user accounts
Features
Email OTP verification
Sends a one-time password to the user's registered email address during login, so a password alone is not enough to get into the account.
SMS codes through Twilio
Connect the plugin to Twilio to deliver authentication codes by text message, letting users verify their login from their mobile phone.
Role-based enforcement
Choose which user roles must complete two-factor authentication, so you can focus the extra check on accounts with higher privileges or sensitive access.
Configurable OTP rules
Set the OTP length, expiration time, resend limits, usage restrictions and login hold duration to match how strict you want verification to be.
Editable login messages
Change the frontend messages shown at each stage of the OTP process so users get clear instructions in wording that suits your site.
All users or select groups
Turn on two-factor authentication for everyone on the site or limit it to selected groups, depending on your security policy and user base.
Works with User Registration forms
Built as a companion to the WPEverest User Registration plugin, it adds OTP checks to your existing registration and login forms without coding.
Two Factor Authentication older versions
- 1.2.0Aug 132 fixes
- 1.1.8Jun 262 fixes
- 1.1.7Jan 231 improvement
- 1.1.6Oct 11, 2025
- 1.1.4Jun 8, 2025
- 1.1.3Apr 23, 2025
- 1.1.2Feb 26, 2025
- 1.1.1Nov 21, 2024
- 1.1.0Sep 19, 2024
- 1.0.14Aug 23, 2024
Members and buyers of this product can download older versions.
16 older versions in all. If you need one that is not listed, ask support.
Questions about Two Factor Authentication
Do I need the User Registration plugin for this to work?
Yes. This add-on is built to work with the WPEverest User Registration plugin and adds the one-time password step to its registration and login workflows. It is designed around those forms rather than as a standalone login security tool.
Can users get their codes by text message?
They can, once you connect the plugin to a Twilio account. Twilio handles SMS delivery, and users receive the authentication code on their mobile phone. If you prefer not to use SMS, codes can be sent to the user's registered email address instead.
Can I require two-factor authentication only for administrators?
Yes. You can pick which user roles must complete the OTP step, so you could apply it only to administrators and other privileged roles. You can also enable it for all users if you want the whole site covered.
How much control do I have over the one-time passwords?
You can set the code length, how long a code stays valid, how many times it can be resent, usage restrictions and how long a login is held after failed attempts. The messages users see during verification can be edited as well.
Is Two Factor Authentication free?
The code of Two Factor Authentication is licensed under the GPL, so anyone may use, change and share it. GPL Feast is a paid service: a plan or a single purchase gives you the download and automatic updates. The developer's own support, licence key and online services are not included.
Which version of Two Factor Authentication is this?
Version 1.2.1, released Sep 9, 2026. New versions appear here when the developer publishes them, and members get them as automatic updates.
How do I update Two Factor Authentication?
Install the free GPL Feast Updater on your site and connect it with your API key. It installs new versions of Two Factor Authentication automatically and keeps a backup, so you can roll back.
More from WPEverest
