georgestephanis/two-factor

Two-Factor Authentication for WordPress.

0.16.0 2026-03-27 17:19 UTC

Requires

• php: >=7.2.24|^8

Requires (Dev)

• automattic/vipwpcs: ^3.0
• dealerdirect/phpcodesniffer-composer-installer: ^1.0
• phpcompatibility/phpcompatibility-wp: 3.0.0-alpha2
• phpunit/phpunit: ^8.5|^9.6
• spatie/phpunit-watcher: ^1.23
• szepeviktor/phpstan-wordpress: ^1.3
• wp-coding-standards/wpcs: ^3.3
• yoast/phpunit-polyfills: ^4.0

GPL-2.0-or-later

README

Two-Factor plugin for WordPress. View on WordPress.org →

Description

The Two-Factor plugin adds an extra layer of security to your WordPress login by requiring users to provide a second form of authentication in addition to their password. This helps protect against unauthorized access even if passwords are compromised.

Usage

See the readme.txt for installation and usage instructions.

Contribute

Please report (non-security) issues and open pull requests on GitHub. See below for information on reporting potential security/privacy vulnerabilities.

Join the #core-passwords channel on WordPress Slack (sign up here).

To use the provided development environment, you'll first need to install and launch Docker. Once it's running, the next steps are:

git clone https://github.com/wordpress/two-factor.git
cd two-factor
npm install
npm run build
npm run env start

See package.json for other available scripts you might want to use during development, like linting and testing.

When you're ready, open a pull request with the suggested changes.

Testing

1. Run npm test or npm run test:watch.

To generate a code coverage report, be sure to start the testing environment with coverage support enabled: npm run env start -- --xdebug=coverage

To view the code coverage report, you can open a web browser, go to File > Open file..., and then select {path to two-factor}/tests/logs/html/index.html.

Deployments

Deployments to WP.org plugin repository are handled automatically by the GitHub action .github/workflows/deploy.yml. Versioned releases are deployed from Git tags under the tags directory. See the workflow for current branch/release conditions used for readme and asset updates.

View release documentation →

Known Issues

• PHP codebase doesn't pass the WordPress coding standard checks, see #437.

Changelog

A complete listing of all notable changes are documented in CHANGELOG.md.

Credits

Created by contributors and released under GPLv2 or later.

Security

Please privately report any potential security issues to the WordPress HackerOne program.