Two-Factor Extended WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB git.robotstxt.es

Extends the WordPress Two Factor plugin with advanced role-based controls and enhanced administrative features.

Description

Two-Factor Extended is a comprehensive extension for the WordPress Two Factor plugin that provides administrators with enterprise-level controls over two-factor authentication across their site.

Core Features:

• Role-Based 2FA Requirements - Require specific 2FA methods for each user role (administrators need Email + TOTP, editors need Email only, etc.)
• Provider Visibility Control - Show or hide specific 2FA methods based on user role to simplify options for non-technical users
• Grace Period Enforcement - Give users a configurable number of days (0-365) to configure required 2FA methods before enforcement
• WordPress Multisite Support - Network-wide enforcement with super admin requirements and site-level override controls
• Compliance Reporting - Real-time compliance dashboards showing which users meet 2FA requirements
• Audit Logging - Comprehensive logging of all 2FA configuration changes and enforcement actions
• Bulk Operations - Bulk require 2FA or reset grace periods for multiple users at once
• Import/Export Settings - Backup and restore your 2FA configuration with JSON export/import

Advanced Features:

• WP-CLI Commands - Manage 2FA requirements via command line (status, enforce, report, reset)
• REST API - Programmatic access to compliance data and enforcement actions
• Security Hardening - Built following WordPress and OWASP security best practices (Security Grade A)
• Accessibility - WCAG 2.1 Level AA compliant for inclusive administration
• Performance Optimized - Efficient database queries and caching for large user bases

Requirements:

This plugin requires the Two Factor plugin (version 0.15.0 tested) to be installed and activated.

Installation

Automatic Installation

1. Visit the Plugins section in your WordPress admin
2. Search for "Two-Factor Extended"
3. Click "Install Now" and then "Activate"

Important: Make sure the Two Factor plugin is installed and activated first.

Manual Installation

1. Download the plugin ZIP file
2. Extract the contents and upload the two-factor-extended directory to /wp-content/plugins/
3. Activate the plugin through the 'Plugins' menu in WordPress

After Installation

1. Go to Settings → Two-Factor Extended
2. Configure your role-based 2FA requirements
3. Set which 2FA methods are available to different user roles

Frequently Asked Questions

Does this plugin replace the Two Factor plugin?

No, Two-Factor Extended is an extension that works alongside the Two Factor plugin. Both plugins must be installed and activated.

Is this compatible with WordPress Multisite?

Yes! Two-Factor Extended fully supports WordPress Multisite with network-wide settings and site-level overrides.

Which PHP versions are supported?

Two-Factor Extended requires PHP 8.2 or higher.

Can users bypass the 2FA requirements?

No. When a 2FA method is marked as required for a user's role, they cannot disable or remove it.

Compatibility

• WordPress: 6.7 - 6.9
• PHP: 8.2 - 8.5
• Database: MariaDB 10.6 or newer
• Two Factor Plugin: 0.15.0 (tested)

Security

Two-Factor Extended follows WordPress security best practices:

Security Features

• Capability Checks: All admin functions require manage_options or manage_network_options capability
• CSRF Protection: All forms use WordPress nonces to prevent cross-site request forgery
• Input Validation: All user inputs are validated and sanitized before processing
• Output Escaping: All outputs are properly escaped to prevent XSS attacks
• SQL Injection Protection: Uses WordPress database APIs exclusively (no direct SQL queries)
• Audit Logging: All configuration changes and enforcement actions are logged
• REST API Security: All API endpoints require authentication and authorization
• File Upload Validation: Import files are validated for type, size, and content

Security Best Practices

1. Keep WordPress Updated: Always use the latest WordPress version
2. Use Strong Passwords: Enforce strong passwords for all user accounts
3. Enable 2FA for All Admins: Require 2FA for administrator and editor roles
4. Regular Backups: Export your 2FA settings regularly
5. Monitor Audit Logs: Review the audit log for suspicious activity
6. Review Compliance Reports: Check compliance reports regularly

Reporting Security Issues

If you discover a security vulnerability, please email the plugin authors directly. Do not create public GitHub issues for security vulnerabilities.

We take security seriously and will respond promptly to all security reports.

Changelog

1.1.1

Release date: 2026-03-28

Fixed

• Version constant mismatch: TWO_FACTOR_EXTENDED_VERSION was 1.0.2 instead of 1.1.0.
• Replaced current_time('timestamp') with time() in audit log and settings export to ensure UTC-correct timestamps.
• Added wp_unslash() before sanitizing $_GET['tab'] in the settings page renderer.

Compatibility

• WordPress: 6.8, 6.9, 7.0
• PHP: 8.2, 8.3, 8.4, 8.5
• MariaDB: 10.6 or newer
• Multisite: Supported
• Two-Factor plugin: 0.16 or newer
• Tested on WordPress 7.0, PHP 8.5.3; PHPUnit 9.6.34 — 28 unit tests, 64 assertions, all passing

1.1.0

Release date: 2026-03-28

Changed

• Code quality: phpcbf auto-fixed 112 formatting issues across 12 files (operator alignment, array double arrows, pre-increment style).

Compatibility

• WordPress: 6.7, 6.8, 6.9
• PHP: 8.2, 8.3, 8.4, 8.5
• MariaDB: 10.6 or newer
• Multisite: Supported
• Two-Factor plugin: 0.16 or newer

1.0.2

Release date: 2026-03-28

Changed

• Plugin renamed from "Two Factor Extended" to "Two-Factor Extended".
• Enforcement now respects Two-Factor's globally-disabled providers (two_factor_enabled_providers option, Two-Factor 0.16+). Users will no longer be blocked by providers disabled site-wide.
• Added Catalan (ca) translation — 145 strings, 100% coverage.
• Updated Spanish (es_ES) translation to reflect the new plugin name.

Compatibility

• WordPress: 6.7, 6.8, 6.9
• PHP: 8.2, 8.3, 8.4, 8.5
• MariaDB: 10.6 or newer
• Multisite: Supported
• Two-Factor plugin: 0.16 or newer

1.0.1

Release date: 2026-03-28

Changed

• Settings menu now registered at admin_menu priority 20 to always appear after Two Factor plugin's Settings page (Two Factor 0.16+).
• PHPUnit downgraded from 10.x to 9.6 for compatibility with the WordPress test library.

Fixed

• PHPCS: spacing and docblock type hint fixes across multiple files.
• PHPStan level 9: all errors resolved.

Compatibility

• WordPress: 6.7, 6.8, 6.9
• PHP: 8.2, 8.3, 8.4, 8.5
• MariaDB: 10.6 or newer
• Multisite: Supported
• Two-Factor plugin: 0.16 or newer

1.0.0

Release date: 2026-02-17

Initial Production Release

This is the first comprehensive release of Two-Factor Extended, implementing enterprise-level two-factor authentication management for WordPress.

Core Features

• Role-Based 2FA Requirements - Require specific 2FA methods for each user role with multiple methods support per role
• Provider Visibility Control - Control which 2FA methods are visible to each role (hide complex methods from non-technical users)
• Grace Period Enforcement - Configurable grace period (0-365 days) with automatic tracking and login blocking after expiration
• WordPress Multisite Support - Network-wide enforcement, super admin requirements, site override control, inheritance notices
• Consolidated Admin Interface - Single settings page with tabs for Settings, Audit Log, and Compliance
• Reset Plugin Functionality - Complete settings reset with user grace period cleanup and audit logging

Advanced Features

• Audit Logging - Comprehensive event logging with filtering by action, user, and date; CSV export; automatic cleanup
• Compliance Reporting - Real-time compliance statistics, by-role breakdown, non-compliant user identification, CSV export
• Bulk Operations - Bulk "Require 2FA Setup" and "Reset Grace Period" actions on Users page
• WP-CLI Commands - Complete CLI interface: status, enforce, report, reset (with table, JSON, CSV output formats)
• REST API Endpoints - Full API access to compliance data, enforcement actions, and reporting
• Import/Export Settings - Backup and restore configuration with JSON export/import, validation, and audit logging

Security & Quality

• Grade A Security Audit - Comprehensive security hardening, complete nonce verification, input validation, output escaping
• 28 Unit Tests - PHPUnit test coverage for core classes
• WCAG 2.1 Level AA Compliant - Fully accessible administration interface
• WordPress Coding Standards - 100% PHPCS compliant
• Performance Optimized - Efficient queries and caching for large user bases

Bug Fixes

• Fixed provider visibility filter applying globally (now only applies on user profile pages)
• Fixed compliance report data structure access for user and email columns
• Fixed cache issues in role requirements and provider visibility fields

Compatibility

• WordPress: 6.7, 6.8, 6.9
• PHP: 8.2, 8.3, 8.4, 8.5
• MariaDB: 10.6 or newer
• Multisite: Supported
• Two-Factor plugin: 0.15 or newer

Previous versions

This is the initial release. For detailed development progress, visit the CHANGELOG.md file.

Compliance

This plugin adheres to the following security measures and review protocols for each version:

• WordPress Plugin Handbook
• WordPress Plugin Security
• WordPress APIs Security
• WordPress Coding Standards
• Plugin Check (PCP)