Two Factor Authentication
by David Anderson / Team Updraft · Uncategorized
Also makes 15 other plugins · 7.3M+ installs across the portfolio →
Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (Google Authenticator, Authy, etc.)
Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.
Health
A 88/100
no flags
Active installs
20K+
≈25K estimated
Momentum
+13%
downloads vs prior 30d
Biggest opportunity: Swap “2fa” and “google authenticator” for “authentication” and “totp”. “2fa” isn't earning its slot: it only gets you to #24. “authentication” sits at #4 untagged, close enough for a declared tag to move it up. “google authenticator” isn't earning its slot: it only gets you to #11. “totp” sits at #7 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
88 health vs 58 average across 25,736 Uncategorized plugins
Install conversion
How it's measured →2.2%
of downloads still active
At least 20K of 910K lifetime downloads are still running, above its category: the median Uncategorized plugin keeps 0.6%, across 17,765 plugins.
Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Uncategorized plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.
This plugin shipped 3 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.
Details
Directory ranking optimization
How it's scored →How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.
Excellent listing optimization
Well tuned across the board
Updated 5 days ago
Tested up to WordPress 7.1.4, the current branch or newer
4.4★ over 77 reviews, smoothed to 4.28★
5 of 5 tags set · short description in place
Search visibility
How it's tracked →Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.
42
Momentum
Mixed: one swing, the rest drifting
+0.0
Velocity
places per keyword, 28d
26%
Breadth
of keywords climbing, 28d
+0.0
Acceleration
recent half vs earlier
wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.
| Keyword | wp.org | On merit | wp.org move, 90 days |
|---|---|---|---|
| tfa your tag | #2 | #2 | 0 |
| two factor auth your tag | #3 | #3 | 0 |
| authentication | #4 | #5 | down 1 |
| two factor your tag | #5 | #6 | down 1 |
| two factor authentication | #5 | #6 | down 1 |
| json web authentication | #3 | #3 | up 1 |
| totp | #7 | #8 | 0 |
| multi factor authentication | #3 | #4 | 0 |
| google authenticator your tag | #11 | #14 | down 2 |
| email two factor authentication | #4 | #5 | 0 |
| two factor authentication or 2fa | #5 | #6 | 0 |
| authenticator | #13 | #16 | up 1 |
| wordpress authentication | #6 | #9 | 0 |
| auth | #11 | #6 | 0 |
| second life | #12 | #11 | up 3 |
| 2fa authentication | #8 | #7 | 0 |
| login authentication | #8 | #9 | — |
| 2fa your tag | #24 | #21 | — |
| encrypt | #20 | #14 | down 2 |
| secure auth key | #19 | #15 | up 1 |
82 searches this plugin appeared in over the last 90 days, 20 listed. 62 left out as unrelated or noise (years, numbers, stray words).
What to do about it
- Swap “2fa” and “google authenticator” for “authentication” and “totp”. “2fa” isn't earning its slot: it only gets you to #24. “authentication” sits at #4 untagged, close enough for a declared tag to move it up. “google authenticator” isn't earning its slot: it only gets you to #11. “totp” sits at #7 untagged, close enough for a declared tag to move it up. All five slots are taken, so one has to go.
- One page off on “google authenticator”. #11 puts you just past the first ten results, where almost all the clicks stop. The gap to close is small.
Daily downloads
Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive
30-day downloads
Rolling 30-day volume · peak 36.7K · peaks are release surges
Directory rank vs rivals
wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you
Health trend
Composite health score, snapshotted daily
Update activity
How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.
Release cadence
Occasionally updatedHow often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.
3
releases in the last 12 months
5d ago
latest release · v1.17.0 · 26 Oct 2026
98
tagged releases on record
Recent releases
What its installed base runs
via wordpress.orgShare of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.
Estimated active installs
The public count shows “20K+”. Our estimate pins where the real number sits.
Modeled within the band wp.org reports; tightens as we track daily.
Install history since 4 Oct 2022
Recent reviews
All reviews on wp.org ↗- ★★★★★ Emilio Lejit2.8y ago
Excellent plugin, works greatly like a charm. This topic was modified 2 years, 6 months ago by Emilio Lejit.
Read on wp.org ↗ - ★★★★★ lcastonguay2.8y ago
Please look elsewhere if you want a plugin that sends one-time passcodes via email. I originally purchased this plugin to send a one-time password to my class subscribers via email whenever they attempt to log in to their WooCommerce account. Only after I bought the plugin did I realize that my customers would need to install a third-party app for this plugin to work. I don’t want to inconvenience customers by requiring them to install another app to have a code sent to them, so this plugin isn’t usable for me. The author of the plugin was responsive when I contacted them for support. Still, I recommend adding a statement about not being able to send one-time passcodes via email on the plugin’s landing page.
Read on wp.org ↗ - ★★★★★ pave12.8y ago
Perfect, simple solution for Google Authenticator
Read on wp.org ↗ - ★★★★★ gangof43.2y ago
So, I ordered Simbas’ 2FAplugin for my website. However, when I tried to install it, I got locked out. Not that I even knew what I was doing when I set it up. I contacted Simba and I was told they would work with me, but they needed cpanel access to my account. My hosting account didn’t come with it. My first thought was to just give up, but my Simba rep David kept after me to follow through, even after a dozen e-mails back and forth with half as many failures. So, I upgraded my account and got cpanel along with some other useful feature and comme par magie, Simba had the 2FA working on my website. These guys are definnitely getting a Christmas card from me.
Read on wp.org ↗ - ★★★★★ kurtmanos4.1y ago
While the plugin is well written, it follows a recent trend that is a massive turnoff. The features most needed are only available in the paid version. The free version doesn’t allow the admin to make using this plugin compulsory, which means it’s useless. While I greatly appreciate the amount of effort involved in coding (been coding for over 40 years, myself), charging $20+ annually PER site is entirely unrealistic. Add the sheer number of plugins a typical WP site uses, multiply that by the number of sites many web admins are responsible for, and it’s simply too expensive for what I’m getting. We all want to live in mansions, but let’s get real. I pay $100 annually for my Office 365 Family, and six of us gets the full suite of products PLUS each of us gets a terabyte of cloud storage. I’ll be using a different plugin on my sites.
Read on wp.org ↗ - ★★★★★ Mike4.6y ago
Payed only? Not ready for PHP-8 ? Asking for server features not being available? This topic was modified 4 years, 3 months ago by Mike. This topic was modified 4 years, 3 months ago by Mike.
Read on wp.org ↗ - ★★★★★ Günter Duba4.7y ago
Does the job without any troubles. Works with Google Authenticator and the Microsoft Authenticator as well. I also recommend the plugins big brother: “UpdraftPlus – Safe & restore”
Read on wp.org ↗ - ★★★★★ ryazhari5.2y ago
I have used this product on a dozen websites I have built and have had very positive results without exception. The plugin is updated and maintained regularly for years now and works with a variety of Authenticator apps. Over time it has become a go to plugin for my 2FA needs because it is simple to install and configure, and highly effective at implementing 2FA with a variety of options. Great product, Highly recommended! This topic was modified 3 years, 8 months ago by ryazhari. Reason: To make the verbiage even more positive!
Read on wp.org ↗
Latest updates
via wp.org changelogRecent releases and news for this plugin
- — Version 1.16.0 FEATURE: Add support for Easy Digital Downloads(EDD) login form TWEAK: Resolve a typo in the emergency code usage email notification text 1.16.0
- — Version 1.15.5 FIX: Function WP_Block_Type_Registry::register was called incorrectly FIX: Fix regression in 1.15.1 which could result in displaying settings incorrectly, with checkboxes hidden FEATURE: Add support for RegistrationMagic 1.15.5
- — Version 1.15.2 TWEAK: Fix regression in 1.15.1 in parsing of multisite capabilities 1.15.2
- — Version 1.15.1 TWEAK: Replace use of maybe_unserialize() TWEAK: Add support for shortcode-based login forms from Paid Memberships Pro (Premium version) 1.15.1
- — Version 1.15.0 TWEAK: The ‘twofactor_user_settings’ shortcode will now not include the “advanced” settings section (with a selector for the TOTP or HOTP algorithm) in the settings output. You can revert to the previous behaviour by add 1.15.0
- — Version 1.14.27 FIX: 1.14.26 broke saving settings on a front-end page via the shortcode TWEAK: Purge empty members of the tfa_incorrect_code_attempts list, to prevent unnecessary growth; and key by user ID, not user login 1.14.27
Security history
via Wordfence IntelligenceAll 2 disclosed vulnerabilities are patched in the current version (1.17.0). Sites still on an older version should update.
- 2015-04-20 CVE-2015-9355 Improper Neutralization of Input During Web Page Generation Affects < 1.1.10 Patched in 1.1.10
Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.
CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.
Behavioral tests
via WP HiveAutomated install-time checks, tested on PHP 8.1.12 · WP 7.0.1
Languages
via translate.wordpress.orgTranslated into 27 languages, 9 at 90% or more
Plus 3 more locales with partial translations.
AI assistants
How it's measured →Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.
Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.
Readme readiness
7 of 8 pass · checked 27 Oct 2026Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.
- ✓ Says what it does "Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (G..."
- ✓ Has a FAQ 10 questions in the FAQ.
- ✓ FAQ asks real questions 10 of 10 read like questions a user would type.
- ! Names who it is for Never says who the plugin is for or what they use it for.
- ✓ Names what it works with Mentions WooCommerce, Elementor, Gravity Forms, bbPress and 2 more.
- ✓ Headings and lists 3 headings and 1 list.
- ✓ Enough to quote 4,087 characters of description.
- ✓ Tags match the text All 5 tags appear in the text.
Growth timeline
Install-tier crossings we have observed, and how long each tier took to outgrow
No tier crossings observed yet.
Competes with
The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).
- A Absolute 2fa For Woocommerce 10+ installs · 3.6★ · 5 shared tags
- G Gupti 2FA — installs · 3.6★ · 3 shared tags
-
Teddy ID Lite — installs · 3.6★ · 3 shared tags -
Teddy ID — installs · 3.6★ · 3 shared tags -
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) 3M+ installs · 4.9★ · 2 shared tags A -
WP 2FA – Two-factor authentication for WordPress 100K+ installs · 4.6★ · 2 shared tags A
Embed this report card
Drop a live Pulse card for Two Factor Authentication into a readme, a review or a deck. It updates itself.
<iframe src="https://plugins.wpmayor.com/embed/two-factor-authentication" width="480" height="300" style="border:0" loading="lazy" title="Two Factor Authentication — Plugin Pulse"></iframe> Two Factor Authentication: 20K+ active installs, 4.4★ (77 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/two-factor-authentication
Spotted a number that looks wrong? Report a data issue and we'll check it against the source.