2FA (by ROBOTSTXT) WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA git.robotstxt.es

Security plugin that adds per-role two-factor authentication to the WordPress login flow.

Description

2FA (by ROBOTSTXT) enforces two-factor authentication on the WordPress login screen. Administrators configure a per-role matrix that specifies exactly which verification methods are required for each role: email codes, authenticator apps (TOTP), or recovery codes.

After the username and password are validated, the login screen redirects to a dedicated verification step. The screen hides the username and password controls, prioritises authenticator apps when enabled, and offers links to switch between methods without restarting the login. Email users can request a fresh code from the same screen.

Users manage their preferences from their profile page. Every method starts unchecked until explicitly confirmed. Activating the authenticator app requires scanning the QR code and entering a valid six-digit code. Recovery codes must be saved and confirmed with one code before activation. Codes are shown in a two-column grid and automatically refresh when the batch is exhausted.

Administrators can remember successful verifications for a configurable duration — per login, daily, weekly, or every 28 days — and lock the schedule so all users follow the global setting. Device and IP fingerprints are stored securely to decide when a fresh challenge is needed.

Multisite is fully supported: network administrators can set and lock enforcement settings across all sites.

Installation

1. Upload the robotstxt-2fa directory to /wp-content/plugins/.
2. Activate the plugin through the "Plugins" menu in WordPress (or network-activate it for multisite).
3. Open the 2FA top-level menu in the dashboard and configure which methods are required per role.
4. Users can set up their preferred methods from their profile page.

Frequently Asked Questions

Is this plugin production ready?

Yes. Email codes, authenticator apps with on-site QR codes, and recovery codes are all available and tested.

How do I enable the authenticator QR code?

Install the optional QR library inside this plugin directory with composer require bacon/bacon-qr-code:^3.0. The plugin loads the Composer autoloader automatically when present.

Can I enforce 2FA for specific roles only?

Yes. The admin settings page shows a matrix of roles × methods. Check the methods you want to require for each role. Roles with no methods checked leave the choice to the user.

What happens if a user loses all their verification methods?

An administrator can edit the user's profile and generate a fresh batch of recovery codes, or disable the role enforcement temporarily while the user regains access.

Is multisite supported?

Yes. Activate the plugin at the network level. Network administrators can set and lock enforcement settings; per-site settings are overridden when network settings exist.

Compatibility

• WordPress: 5.6 – 7.0
• PHP: 8.0 – 8.5
• MariaDB: 11.4 or newer

Changelog

1.6.3

Release date: 2026-08-24

Changed

• Manager detection now uses the ecosystem presence constant (ROBOTSTXT_MANAGER_NOTICED, defined by Manager 1.6.2+) with a fallback to the plugin-list scan for older Manager versions.

Fixed

• Compatibility with the ALTCHA Spam Protection plugin: when "Protect login" was enabled, submitting the 2FA verification code failed with "[ALTCHA] Sorry, your request could not be processed.". The ALTCHA interceptor is now disabled while the verification screen is shown; the first login step keeps its ALTCHA check.

1.6.2

Release date: 2026-08-17

Added

• Recommendation notice for the Manager (by ROBOTSTXT) plugin: when it is not installed and active, a dismissible notice appears on the Plugins screen and a permanent notice is shown on the plugin settings page, since updates are delivered through the Manager plugin.

Changed

• Updates are now handled by the Manager (by ROBOTSTXT) plugin. The bundled self-updater (robotstxt-updater.php and update.json) has been removed.
• Plugin and update URLs moved to robotstxt.software.
• Minimum WordPress version lowered from 6.4 to 5.6 after a full compatibility review (the code only requires WordPress 5.3+ functions, and WordPress 5.6 is the first release that runs on the required PHP 8.0).

1.6.1

Release date: 2026-08-14

Fixed

• Fatal error during editor autosaves: the [robotstxt_2fa_profile] shortcode expanded when WordPress applied content filters to a post revision via REST (for example, an article that merely mentions the shortcode in its text). In that context the wp-admin render helpers are not loaded, causing a fatal error. The shortcode now bails out early on REST requests and loads the required wp-admin includes on demand elsewhere.

Previous versions

For the full changelog see the changelog page.

Compliance

This plugin adheres to the following security measures and review protocols for each version:

• WordPress Plugin Handbook
• WordPress Plugin Security
• WordPress APIs Security
• WordPress Coding Standards
• Plugin Check (PCP)