Two Factor

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Share of active installs on each version of this plugin · 61% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ jhonhorac

   2mo ago

   It’s an excellent plugin; I use it on all my sites.

   Read on wp.org ↗
2. ★★★★★ vee

   3mo ago

   The basic options expected:1. I must be able to use any authentication app.2. An option to use email as 2nd auth.But this plugin also have backup code.

   Read on wp.org ↗
3. ★★★★★ kloproterra

   3mo ago

   This plugin requires individual users to manage 2FA. Individual users can remove 2FA from their profile at any time leaving that account vulnerable. An admin would need to check regularly that this hasn’t been removed. There is discussion about a custom function to force a user back to the profile page. I tested this. A user can still leave the account with 2FA off, albeit they cannot navigation anywhere but the profile page. However, in this state a bad actor can login with a password only to the unprotected account, then configure 2FA to their own device, this then removes the redirect and therefore undermines the entire process. This is a significant flaw. However, the plugin can protect a single admin account but any sort of user hierarchy is not protected. This topic was modified 1 month, 3 weeks ago by kloproterra. This topic was modified 1 month, 3 weeks ago by kloproterra.

   Read on wp.org ↗
4. ★★★★★ bowerwebsolutions

   4mo ago

   Not only did it work well for my use case with a customer who wanted to offer optional 2fa, but when i asked about customizing the code validation page i had a response in minutes. Very impressive. Worked well with a theme my login branded site.

   Read on wp.org ↗
5. ★★★★★ aelbo

   4mo ago

   Fonctionne parfaitement, simple et fiable

   Read on wp.org ↗
6. ★★★★★ mjezegou35

   4mo ago

   I am in version 6.6.2 of WordPress and in multisite network version. Is it possible to activate your plugin despite the constraint tested up to 6.9.1, please? I can’t activate it at the network level? This topic was modified 2 months, 4 weeks ago by mjezegou35.

   Read on wp.org ↗
7. ★★★★★ Dennis Dallau

   5mo ago

   Easy install, light speed and exactly does what it needs to do. My opinion: No plugin is safer or cleaner than one created by the team behind WordPress.org.

   Read on wp.org ↗
8. ★★★★★ Guy Sharpe

   5mo ago

   I’ve been using the Two Factor plugin on several WordPress sites and it has been a great addition to my security stack. The setup process is very straightforward. Within a few minutes, I was able to enable two-factor authentication and add an extra layer of protection to the login process. The plugin integrates smoothly with the default WordPress login, so there’s no complicated configuration or learning curve. What I really like: Supports multiple 2FA methods (authenticator apps, email, backup codes) Lightweight and doesn’t slow down the site Clean and simple interface Works perfectly without conflicts with other plugins/themes For clients and non-technical users, it’s especially helpful because the instructions are clear and easy to follow. In today’s environment where brute-force attacks are common, this plugin feels like a must-have for any WordPress website. Highly recommended for anyone who wants quick, reliable login security without complexity.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-03-27 Version 0.16.0 Breaking Changes: Remove legacy FIDO U2F provider support by #439 . New Features: Add a dedicated settings page for plugin configuration in wp-admin by #764 . New Features: Add a support links filter so consumers can cus 0.16.0
2. 2026-02-13 Version 0.15.0 Breaking Changes: Trigger two-factor flow only when expected by @kasparsd in #660 and #793 . New Features: Include user IP address and contextual warning in two-factor code emails by @todeveni in #728 New Features: Optim 0.15.0
3. 2025-12-11 Version 0.14.2 New Features: Add filter for rest_api_can_edit_user_and_update_two_factor_options by @gutobenn in #689 Development Updates: Remove Coveralls tooling and add inline coverage report by @kasparsd in #717 Development Updates 0.14.2
4. 2025-09-05 Version 0.14.1 Don’t URI encode the TOTP url for display. by @dd32 in #711 Removed the duplicate Security.md by @slvignesh05 in #712 Fixed linting issues by @sudar in #707 Update development dependencies and fix failing QR unit test by 0.14.1
5. 2025-07-03 Version 0.14.0 Features: Enable Application Passwords for REST API and XML-RPC authentication (by default) by @joostdekeijzer in #697 and #698 . Previously this required two_factor_user_api_login_enable filter to be set to true which i 0.14.0
6. 2025-04-02 Version 0.13.0 Add two_factor_providers_for_user filter to limit two-factor providers available to each user by @kasparsd in #669 Update automated testing to cover PHP 8.4 and default to PHP 8.3 by @BrookeDot in #665 View the complete 0.13.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 51 languages, 23 at 90% or more

Plus 27 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-01-04 90K+ → 100K+ up after 195 days in tier
2. 2025-06-23 80K+ → 90K+ up after 345 days in tier
3. 2024-07-13 70K+ → 80K+ up after 258 days in tier
4. 2023-10-29 60K+ → 70K+ up after 1 days in tier
5. 2023-10-28 70K+ → 60K+ down after 1 days in tier
6. 2023-10-27 60K+ → 70K+ up after 136 days in tier
7. 2023-06-13 50K+ → 60K+ up after 227 days in tier
8. 2022-10-29 40K+ → 50K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 10K+ installs · 4.5★ · 4 shared tags A
• Trusona for WordPress 500+ installs · 4.6★ · 3 shared tags A
• Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ installs · 4.7★ · 2 shared tags A
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) 3M+ installs · 4.9★ · 2 shared tags A
• Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention 1M+ installs · 4.8★ · 2 shared tags A
• L Limit Login Attempts 300K+ installs · 4.6★ · 2 shared tags D

Embed this report card

Drop a live Pulse card for Two Factor into a readme, a review or a deck. It updates itself.

Two Factor: 100K+ active installs, 4.8★ (208 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/two-factor