外掛說明
FactorGuard is a lightweight, privacy-first Two-Factor Authentication (2FA) plugin for WordPress. It adds a rock-solid two-step verification layer to the default WordPress login page — without relying on any external cloud service or third-party API.
After a user enters the correct username and password, they must complete a second step: enter a one-time code sent to their email or use a time-based code from an authenticator app like Google Authenticator or Authy.
🔒 Zero external API calls. All verification happens on your own server.
Core Features:
- ⚡ Email OTP — send a one-time passcode to the user’s registered email address
- 📱 Authenticator App (TOTP) — full RFC 6238 support for Google Authenticator, Authy, Microsoft Authenticator, and any TOTP-compatible app
- 🔑 One-time backup codes — hashed recovery codes so users never get locked out
- 🔐 Military-grade encryption — TOTP secrets encrypted at rest using libsodium XSalsa20-Poly1305
- 🚫 Replay attack protection — accepted TOTP codes are invalidated for the current time-slice
- ⏱️ Brute force & rate limiting — configurable lockout after too many failed attempts
- 🎛️ Flexible settings — OTP code length (4–10 digits), code expiry (1–60 min), lockout duration
- 🧙 Setup wizard — guided onboarding to configure your preferred 2FA method in minutes
- 🌐 API-safe — automatically bypasses OTP for REST API and XML-RPC requests
- 🌍 Translation ready — fully internationalised and
.potfile included - 🧹 Clean uninstall — removes all plugin data on uninstall (opt-in)
How It Works – Email OTP
- User enters their username and password on the login page
- If credentials are correct and OTP is enabled, a verification code is emailed to the user
- The login form shows an OTP input field (username/password fields are hidden)
- User enters the code sent to their email
- On success, login completes. On failure, the attempt is counted toward the lockout limit
How It Works – TOTP (Authenticator App)
- Site admin enables TOTP under Settings > FactorGuard
- Each user visits their Profile page and scans the QR code with their authenticator app
- Users enter the 6-digit code shown in their app to activate TOTP on their account
- On subsequent logins, the login form asks for the current authenticator app code instead of sending an email
螢幕擷圖
安裝方式
- Upload the
factorguardfolder to the/wp-content/plugins/directory - Activate the plugin through the ‘Plugins’ menu in WordPress
- Go to Settings > FactorGuard to configure the plugin
- Make sure your WordPress site can send emails (test with a password reset if unsure)
Privacy and External Services
FactorGuard performs OTP and authenticator app verification locally on your WordPress site. It does not send verification codes, authentication secrets, site data, or user data to a FactorGuard service.
Email OTP messages are sent through WordPress using wp_mail(). Your site’s configured mail delivery provider may process those emails according to that provider’s terms and privacy policy.
QR codes for authenticator app setup are generated locally using libraries bundled with the plugin. No external QR code API is contacted. The bundled TOTP library includes optional remote provider classes, but FactorGuard initializes only the local QR provider and does not use those remote providers.
Recovery Notice
Before forcing two-factor authentication for all users, confirm that at least one administrator has a working verification method, has generated backup codes, and can access those codes if email delivery or an authenticator app is unavailable.
常見問題集
-
Does this work with custom login forms?
-
FactorGuard hooks into the default WordPress login page at
/wp-login.php. For custom login forms, developers can use thefactorguard_bypassfilter to control the behavior programmatically. -
Does this affect REST API or XML-RPC authentication?
-
No. The plugin automatically detects API requests and skips OTP verification for them. Application passwords and other API authentication methods continue to work normally.
-
What if the email doesn’t arrive?
-
If the email fails to send, the user will see an error message and can try logging in again to trigger a new email. Check your WordPress email delivery settings if this persists.
-
Does FactorGuard contact external services?
-
No. FactorGuard does not contact a FactorGuard server or any third-party API during normal operation. Email delivery is handled by your WordPress site’s configured mail system.
-
What should I do before forcing two-factor authentication for all users?
-
Verify that your administrator account can complete login with the selected method, confirm that WordPress email delivery works, and generate backup codes from your WordPress profile.
-
Where do users scan the authenticator app QR code?
-
After an administrator enables Authenticator App support under Settings > FactorGuard, each user can enroll from their WordPress profile page. The profile screen shows the QR code, manual setup key, confirmation field, and backup-code controls.
-
Can I exclude specific users from OTP?
-
Yes. Use the
factorguard_user_can_bypassfilter. Example:add_filter( 'factorguard_user_can_bypass', '__return_true' );to bypass for all users, or check user roles/capabilities in your callback. -
Does TOTP require any server extensions?
-
TOTP setup requires the PHP libsodium extension so FactorGuard can encrypt authenticator app secrets at rest. FactorGuard will not create new authenticator app enrollments if secrets cannot be encrypted. QR codes are generated locally using bundled libraries, and no external QR code API is needed.
使用者評論
這個外掛目前沒有任何使用者評論。
參與者及開發者
變更記錄
1.0.0
- Initial release with email OTP and TOTP (authenticator app) support