Title: Rad 2FA — Two-Factor Login (Email & Authenticator App) Author: Rad Published: September 15, 2026 Last modified: September 16, 2026 --- Search plugins ![](https://ps.w.org/rad-2fa/assets/banner-772x250.png?rev=3696591) ![](https://ps.w.org/rad-2fa/assets/icon.svg?rev=3696591) # Rad 2FA — Two-Factor Login (Email & Authenticator App) By [Rad](https://profiles.wordpress.org/rad18/) [Download](https://downloads.wordpress.org/plugin/rad-2fa.1.2.1.zip) * [Details](https://sa.wordpress.org/plugins/rad-2fa/#description) * [Reviews](https://sa.wordpress.org/plugins/rad-2fa/#reviews) * [Installation](https://sa.wordpress.org/plugins/rad-2fa/#installation) * [Development](https://sa.wordpress.org/plugins/rad-2fa/#developers) [Support](https://wordpress.org/support/plugin/rad-2fa/) ## Description This plugin adds a second authentication factor for the user roles you choose. After a correct username and password, an extra code is required — the site admin picks the method: * **Email** — a one-time numeric code sent to the user’s email address. * **Authenticator app (TOTP)** — a standard 6-digit code from an app such as Google Authenticator, Authy, or Microsoft Authenticator (this plugin is not affiliated with or endorsed by Google). Each user connects the app in their own profile: scan the QR code or enter the secret key manually. If the site uses TOTP but a specific user hasn’t connected the app yet, they temporarily get an email code at login instead — so nobody gets locked out. Features: * Enable 2FA per user role * Two verification methods: email code or authenticator app (TOTP) * Configurable email code length, lifetime, and attempt limit * Admin screens and email codes follow each user’s own WordPress language setting( Users Profile Language) — no site-wide language switch needed * Email codes are stored only as a hash; the TOTP secret is stored encrypted (AES- 256-CBC) * The QR code is generated entirely in the browser — the secret is never sent to a third-party service ### Credits The QR code on the authenticator app setup screen is rendered client-side using QRCode.js by davidshimjs (MIT license). This plugin bundles the minified build; the unminified source is available at https://github.com/davidshimjs/qrcodejs ### Donate If you find this plugin useful, please consider supporting its development. https://buymeacoffee.com/rad181 ## Screenshots [⌊Settings — choose which roles require 2FA and the verification method (email code or authenticator app).⌉⌊Settings — choose which roles require 2FA and the verification method (email code or authenticator app).⌉[ Settings — choose which roles require 2FA and the verification method (email code or authenticator app). [⌊Connecting an authenticator app from your own profile — scan the QR code or enter the key manually.⌉⌊Connecting an authenticator app from your own profile — scan the QR code or enter the key manually.⌉[ Connecting an authenticator app from your own profile — scan the QR code or enter the key manually. ## Installation 1. Upload the plugin folder to `/wp-content/plugins/` 2. Activate the plugin from the Plugins screen 3. Go to the Rad 2FA menu item, choose the roles and the verification method 4. If the authenticator app method is selected, each user sets it up in their own profile (Users Your Profile) ## FAQ ### What if a user doesn’t receive the code email? Check the site’s outgoing mail (SMTP) setup. The plugin uses WordPress’s standard` wp_mail()` function. ### Can I enable 2FA for specific roles only, not everyone? Yes — in the plugin settings, tick the roles that require 2FA. ### What happens if the authenticator app method is enabled but a user hasn’t set it up yet? That user temporarily gets the code by email instead — it doesn’t block login. ### Can an administrator set up the authenticator app for another user? No — for security, the secret is tied to one person and can only be set up by that person in their own profile. ### Does this protect Application Passwords / the REST API too? No. 2FA applies to the login form (wp-login.php). WordPress Application Passwords authenticate REST API requests through a separate mechanism that doesn’t go through the login form, so they aren’t covered. If this matters for your site, disable Application Passwords for accounts that require 2FA. ### Is this plugin affiliated with Google? No. “Google Authenticator” is mentioned only as an example of a compatible authenticator app; this plugin implements the standard, open TOTP algorithm (RFC 6238) and works with any compatible app. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Rad 2FA — Two-Factor Login (Email & Authenticator App)” is open source software. The following people have contributed to this plugin. Contributors * [ Rad ](https://profiles.wordpress.org/rad18/) [Translate “Rad 2FA — Two-Factor Login (Email & Authenticator App)” into your language.](https://translate.wordpress.org/projects/wp-plugins/rad-2fa) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/rad-2fa/), check out the [SVN repository](https://plugins.svn.wordpress.org/rad-2fa/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/rad-2fa/) by [RSS](https://plugins.trac.wordpress.org/log/rad-2fa/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.1 * Added a Plugin URI header linking to the wordpress.org plugin page #### 1.2.0 * Renamed to Rad 2FA (was OTP Sentinel) * Removed the plugin-specific language toggle; admin screens and OTP emails now follow each user’s own WordPress language setting (Users Profile Language) * Inline admin scripts moved to properly enqueued files #### 1.1.1 * TOTP codes can no longer be reused across login attempts * Encrypted TOTP secrets are now integrity-checked (HMAC) * Rate-limited login challenge issuance to reduce email/brute-force abuse * Fixed a redirect_to double-encoding bug affecting post-login redirects * Added uninstall.php to remove plugin data on deletion * Activation now checks for the required OpenSSL extension #### 1.1.0 * Added authenticator app (TOTP) support as an alternative to the email code * Settings moved to their own top-level menu item #### 1.0.0 * Initial release ## Meta * Version **1.2.1** * Last updated **13 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/rad-2fa/) * Tags * [2FA](https://sa.wordpress.org/plugins/tags/2fa/)[login](https://sa.wordpress.org/plugins/tags/login/) [security](https://sa.wordpress.org/plugins/tags/security/)[totp](https://sa.wordpress.org/plugins/tags/totp/) [two factor](https://sa.wordpress.org/plugins/tags/two-factor/) * [Advanced View](https://sa.wordpress.org/plugins/rad-2fa/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/rad-2fa/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/rad-2fa/reviews/) ## Contributors * [ Rad ](https://profiles.wordpress.org/rad18/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/rad-2fa/)