Two Factor Authentication

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 72% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ Emilio Lejit

   2.6y ago

   Excellent plugin, works greatly like a charm. This topic was modified 2 years, 6 months ago by Emilio Lejit.

   Read on wp.org ↗
2. ★★★★★ lcastonguay

   2.6y ago

   Please look elsewhere if you want a plugin that sends one-time passcodes via email. I originally purchased this plugin to send a one-time password to my class subscribers via email whenever they attempt to log in to their WooCommerce account. Only after I bought the plugin did I realize that my customers would need to install a third-party app for this plugin to work. I don’t want to inconvenience customers by requiring them to install another app to have a code sent to them, so this plugin isn’t usable for me. The author of the plugin was responsive when I contacted them for support. Still, I recommend adding a statement about not being able to send one-time passcodes via email on the plugin’s landing page.

   Read on wp.org ↗
3. ★★★★★ pave1

   2.6y ago

   Perfect, simple solution for Google Authenticator

   Read on wp.org ↗
4. ★★★★★ gangof4

   3.0y ago

   So, I ordered Simbas’ 2FAplugin for my website. However, when I tried to install it, I got locked out. Not that I even knew what I was doing when I set it up. I contacted Simba and I was told they would work with me, but they needed cpanel access to my account. My hosting account didn’t come with it. My first thought was to just give up, but my Simba rep David kept after me to follow through, even after a dozen e-mails back and forth with half as many failures. So, I upgraded my account and got cpanel along with some other useful feature and comme par magie, Simba had the 2FA working on my website. These guys are definnitely getting a Christmas card from me.

   Read on wp.org ↗
5. ★★★★★ kurtmanos

   4.0y ago

   While the plugin is well written, it follows a recent trend that is a massive turnoff. The features most needed are only available in the paid version. The free version doesn’t allow the admin to make using this plugin compulsory, which means it’s useless. While I greatly appreciate the amount of effort involved in coding (been coding for over 40 years, myself), charging $20+ annually PER site is entirely unrealistic. Add the sheer number of plugins a typical WP site uses, multiply that by the number of sites many web admins are responsible for, and it’s simply too expensive for what I’m getting. We all want to live in mansions, but let’s get real. I pay $100 annually for my Office 365 Family, and six of us gets the full suite of products PLUS each of us gets a terabyte of cloud storage. I’ll be using a different plugin on my sites.

   Read on wp.org ↗
6. ★★★★★ Mike

   4.4y ago

   Payed only? Not ready for PHP-8 ? Asking for server features not being available? This topic was modified 4 years, 3 months ago by Mike. This topic was modified 4 years, 3 months ago by Mike.

   Read on wp.org ↗
7. ★★★★★ Günter Duba

   4.6y ago

   Does the job without any troubles. Works with Google Authenticator and the Microsoft Authenticator as well. I also recommend the plugins big brother: “UpdraftPlus – Safe & restore”

   Read on wp.org ↗
8. ★★★★★ ryazhari

   5.0y ago

   I have used this product on a dozen websites I have built and have had very positive results without exception. The plugin is updated and maintained regularly for years now and works with a variety of Authenticator apps. Over time it has become a go to plugin for my 2FA needs because it is simple to install and configure, and highly effective at implementing 2FA with a variety of options. Great product, Highly recommended! This topic was modified 3 years, 8 months ago by ryazhari. Reason: To make the verbiage even more positive!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.16.0 FEATURE: Add support for Easy Digital Downloads(EDD) login form TWEAK: Resolve a typo in the emergency code usage email notification text 1.16.0
2. — Version 1.15.5 FIX: Function WP_Block_Type_Registry::register was called incorrectly FIX: Fix regression in 1.15.1 which could result in displaying settings incorrectly, with checkboxes hidden FEATURE: Add support for RegistrationMagic 1.15.5
3. — Version 1.15.2 TWEAK: Fix regression in 1.15.1 in parsing of multisite capabilities 1.15.2
4. — Version 1.15.1 TWEAK: Replace use of maybe_unserialize() TWEAK: Add support for shortcode-based login forms from Paid Memberships Pro (Premium version) 1.15.1
5. — Version 1.15.0 TWEAK: The ‘twofactor_user_settings’ shortcode will now not include the “advanced” settings section (with a selector for the TOTP or HOTP algorithm) in the settings output. You can revert to the previous behaviour by add 1.15.0
6. — Version 1.14.27 FIX: 1.14.26 broke saving settings on a front-end page via the shortcode TWEAK: Purge empty members of the tfa_incorrect_code_attempts list, to prevent unnecessary growth; and key by user ID, not user login 1.14.27

2 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 8.8 Two Factor Authentication <= 1.3.12 - Cross-Site Request Forgery ↗
   2018-12-18 CVE-2018-20231 Cross-Site Request Forgery (CSRF) Affects < 1.3.13 Patched in 1.3.13
2. Medium · 6.1 Two Factor Authentication < 1.1.10 - Cross-Site Scripting ↗
   2015-04-20 CVE-2015-9355 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.1.10 Patched in 1.1.10

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 26 languages, 9 at 90% or more

Plus 2 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• A Absolute 2fa For Woocommerce 10+ installs · 3.6★ · 5 shared tags D
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) 3M+ installs · 4.9★ · 2 shared tags A
• WP 2FA – Two-factor authentication for WordPress 100K+ installs · 4.6★ · 2 shared tags A
• Two Factor (2FA) Authentication via Email 9K+ installs · 4.2★ · 2 shared tags A
• W WP 2-step verification 1K+ installs · 4.1★ · 2 shared tags B
• WebAuthn Provider for Two Factor 1K+ installs · 4.3★ · 2 shared tags B

Embed this report card

Drop a live Pulse card for Two Factor Authentication into a readme, a review or a deck. It updates itself.

Two Factor Authentication: 20K+ active installs, 4.4★ (77 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/two-factor-authentication