Title: FactorGuard – Two-Factor Authentication
Author: Usman Ali Qureshi
Published: <strong>2026 年 8 月 31 日</strong>
Last modified: 2026 年 8 月 31 日

---

搜尋外掛

![](https://ps.w.org/factorguard/assets/banner-772x250.png?rev=3674744)

![](https://ps.w.org/factorguard/assets/icon-256x256.png?rev=3674744)

# FactorGuard – Two-Factor Authentication

 由 [Usman Ali Qureshi](https://profiles.wordpress.org/usmanaliqureshi/) 開發

[下載](https://downloads.wordpress.org/plugin/factorguard.1.0.0.zip)

 * [詳細資料](https://tw.wordpress.org/plugins/factorguard/#description)
 * [使用者評論](https://tw.wordpress.org/plugins/factorguard/#reviews)
 *  [安裝方式](https://tw.wordpress.org/plugins/factorguard/#installation)
 * [開發資訊](https://tw.wordpress.org/plugins/factorguard/#developers)

 [技術支援](https://wordpress.org/support/plugin/factorguard/)

## 外掛說明

**FactorGuard** is a lightweight, privacy-first Two-Factor Authentication (2FA) 
plugin for WordPress. It adds a rock-solid two-step verification layer to the default
WordPress login page — without relying on any external cloud service or third-party
API.

After a user enters the correct username and password, they must complete a second
step: enter a one-time code sent to their email **or** use a time-based code from
an authenticator app like Google Authenticator or Authy.

> 🔒 **Zero external API calls. All verification happens on your own server.**

**Core Features:**

 * ⚡ **Email OTP** — send a one-time passcode to the user’s registered email address
 * 📱 **Authenticator App (TOTP)** — full RFC 6238 support for Google Authenticator,
   Authy, Microsoft Authenticator, and any TOTP-compatible app
 * 🔑 **One-time backup codes** — hashed recovery codes so users never get locked
   out
 * 🔐 **Military-grade encryption** — TOTP secrets encrypted at rest using libsodium
   XSalsa20-Poly1305
 * 🚫 **Replay attack protection** — accepted TOTP codes are invalidated for the
   current time-slice
 * ⏱️ **Brute force & rate limiting** — configurable lockout after too many failed
   attempts
 * 🎛️ **Flexible settings** — OTP code length (4–10 digits), code expiry (1–60 min),
   lockout duration
 * 🧙 **Setup wizard** — guided onboarding to configure your preferred 2FA method
   in minutes
 * 🌐 **API-safe** — automatically bypasses OTP for REST API and XML-RPC requests
 * 🌍 **Translation ready** — fully internationalised and `.pot` file included
 * 🧹 **Clean uninstall** — removes all plugin data on uninstall (opt-in)

#### How It Works – Email OTP

 1. User enters their username and password on the login page
 2. If credentials are correct and OTP is enabled, a verification code is emailed to
    the user
 3. The login form shows an OTP input field (username/password fields are hidden)
 4. User enters the code sent to their email
 5. On success, login completes. On failure, the attempt is counted toward the lockout
    limit

#### How It Works – TOTP (Authenticator App)

 1. Site admin enables TOTP under Settings > FactorGuard
 2. Each user visits their Profile page and scans the QR code with their authenticator
    app
 3. Users enter the 6-digit code shown in their app to activate TOTP on their account
 4. On subsequent logins, the login form asks for the current authenticator app code
    instead of sending an email

## 螢幕擷圖

[⌊General settings for email OTP length, expiry, rate limiting, and lockout behavior.⌉⌊
General settings for email OTP length, expiry, rate limiting, and lockout behavior
.⌉[

General settings for email OTP length, expiry, rate limiting, and lockout behavior.

[⌊Authenticator App settings with profile enrollment guidance for QR-code setup.⌉⌊
Authenticator App settings with profile enrollment guidance for QR-code setup.⌉[

Authenticator App settings with profile enrollment guidance for QR-code setup.

[⌊FactorGuard setup wizard for choosing the site's two-factor verification method.⌉⌊
FactorGuard setup wizard for choosing the site's two-factor verification method.⌉[

FactorGuard setup wizard for choosing the site’s two-factor verification method.

[⌊User profile two-factor section showing active authenticator status and backup-
code controls.⌉⌊User profile two-factor section showing active authenticator status
and backup-code controls.⌉[

User profile two-factor section showing active authenticator status and backup-code
controls.

## 安裝方式

 1. Upload the `factorguard` folder to the `/wp-content/plugins/` directory
 2. Activate the plugin through the ‘Plugins’ menu in WordPress
 3. Go to Settings > FactorGuard to configure the plugin
 4. Make sure your WordPress site can send emails (test with a password reset if unsure)

#### Privacy and External Services

FactorGuard performs OTP and authenticator app verification locally on your WordPress
site. It does not send verification codes, authentication secrets, site data, or
user data to a FactorGuard service.

Email OTP messages are sent through WordPress using `wp_mail()`. Your site’s configured
mail delivery provider may process those emails according to that provider’s terms
and privacy policy.

QR codes for authenticator app setup are generated locally using libraries bundled
with the plugin. No external QR code API is contacted. The bundled TOTP library 
includes optional remote provider classes, but FactorGuard initializes only the 
local QR provider and does not use those remote providers.

#### Recovery Notice

Before forcing two-factor authentication for all users, confirm that at least one
administrator has a working verification method, has generated backup codes, and
can access those codes if email delivery or an authenticator app is unavailable.

## 常見問題集

### Does this work with custom login forms?

FactorGuard hooks into the default WordPress login page at `/wp-login.php`. For 
custom login forms, developers can use the `factorguard_bypass` filter to control
the behavior programmatically.

### Does this affect REST API or XML-RPC authentication?

No. The plugin automatically detects API requests and skips OTP verification for
them. Application passwords and other API authentication methods continue to work
normally.

### What if the email doesn’t arrive?

If the email fails to send, the user will see an error message and can try logging
in again to trigger a new email. Check your WordPress email delivery settings if
this persists.

### Does FactorGuard contact external services?

No. FactorGuard does not contact a FactorGuard server or any third-party API during
normal operation. Email delivery is handled by your WordPress site’s configured 
mail system.

### What should I do before forcing two-factor authentication for all users?

Verify that your administrator account can complete login with the selected method,
confirm that WordPress email delivery works, and generate backup codes from your
WordPress profile.

### Where do users scan the authenticator app QR code?

After an administrator enables Authenticator App support under Settings > FactorGuard,
each user can enroll from their WordPress profile page. The profile screen shows
the QR code, manual setup key, confirmation field, and backup-code controls.

### Can I exclude specific users from OTP?

Yes. Use the `factorguard_user_can_bypass` filter. Example: `add_filter( 'factorguard_user_can_bypass','
__return_true' );` to bypass for all users, or check user roles/capabilities in 
your callback.

### Does TOTP require any server extensions?

TOTP setup requires the PHP libsodium extension so FactorGuard can encrypt authenticator
app secrets at rest. FactorGuard will not create new authenticator app enrollments
if secrets cannot be encrypted. QR codes are generated locally using bundled libraries,
and no external QR code API is needed.

## 使用者評論

這個外掛目前沒有任何使用者評論。

## 參與者及開發者

以下人員參與了開源軟體〈FactorGuard – Two-Factor Authentication〉的開發相關工作。

參與者

 *   [ Usman Ali Qureshi ](https://profiles.wordpress.org/usmanaliqureshi/)

[將〈FactorGuard – Two-Factor Authentication〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/factorguard)

### 對開發相關資訊感興趣？

任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/factorguard/)、
查看 [SVN 存放庫](https://plugins.svn.wordpress.org/factorguard/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/factorguard/?limit=100&mode=stop_on_copy&format=rss)
訂閱[開發記錄](https://plugins.trac.wordpress.org/log/factorguard/)。

## 變更記錄

#### 1.0.0

 * Initial release with email OTP and TOTP (authenticator app) support

## 中繼資料

 *  版本 **1.0.0**
 *  最後更新 **1 週前**
 *  啟用安裝數 **少於 10 次**
 *  WordPress 版本需求 ** 5.6 或更新版本 **
 *  已測試相容的 WordPress 版本 **7.1**
 *  PHP 版本需求 ** 8.2 或更新版本 **
 *  語言
 * [English (US)](https://wordpress.org/plugins/factorguard/)
 * 標籤:
 * [2FA](https://tw.wordpress.org/plugins/tags/2fa/)[authentication](https://tw.wordpress.org/plugins/tags/authentication/)
   [login security](https://tw.wordpress.org/plugins/tags/login-security/)[otp](https://tw.wordpress.org/plugins/tags/otp/)
   [two factor](https://tw.wordpress.org/plugins/tags/two-factor/)
 *  [進階檢視](https://tw.wordpress.org/plugins/factorguard/advanced/)

## 評分

這個項目尚無任何評論記錄。

[撰寫評分](https://wordpress.org/support/plugin/factorguard/reviews/#new-post)

[查看全部使用者評論](https://wordpress.org/support/plugin/factorguard/reviews/)

## 參與者

 *   [ Usman Ali Qureshi ](https://profiles.wordpress.org/usmanaliqureshi/)

## 技術支援

使用者可在技術支援論壇提出意見反應或使用問題。

 [檢視技術支援論壇](https://wordpress.org/support/plugin/factorguard/)