Two Factor Authentication for WordPress
- Listing audit
- 49/100
Two Factor Authentication is a WordPress Plugin Directory app by David Anderson / Team Updraft. With a rating of 4.4★ from 77 reviews.
Two Factor Authentication is a WordPress app, with a 4.4 average rating from 77 reviews, as of Sep 11, 2026.
AppRanks verdict
Generated from marketplace data as of Sep 11, 2026
Two Factor Authentication is a WordPress app. It holds a 4.4★ average from 77 reviews on WordPress.
Pros
- No standout positives in the measured data.
Cons
- −Only 77 reviews — the average can still move with a few new ratings
How Two Factor Authentication works
Show full descriptionShow less
Secure WordPress login with this two factor authentication (TFA / 2FA) plugin. Users for whom it is enabled will require a one-time code in order to log in. From the authors of UpdraftPlus – WP’s #1 backup/restore plugin, with over two million active installs.
Are you completely new to TFA? If so, please see our FAQ.
Features (please see the “Screenshots” for more information):
Supports standard TOTP + HOTP protocols (and so supports Google Authenticator, Authy, and many others).
Displays graphical QR codes for easy scanning into apps on your phone/tablet
TFA can be made available on a per-role basis (e.g. available for admins, but not for subscribers)
TFA can be turned on or off by each user
TFA can be required for specified user levels, after a defined time period (e.g. require all admins to have TFA, once their accounts are a week old) (Premium version), including forcing them to immediately set up (by redirecting them to the page to do so)
Supports front-end editing of settings, via [twofactor_user_settings] shortcode (i.e. users don’t need access to the WP dashboard). (The Premium version allows custom designing of any layout you wish).
Site owners can allow “trusted devices” on which TFA codes are only asked for a chosen number of days (instead of every login); e.g. 30 days (Premium version)
Encrypt the TFA-generating secret keys using an on-disk encryption key, so that an attacker would need to break into both your WordPress database and your files in order to break TFA codes (as well as breaking a user’s password in order to use them)