WP Manifestindependent plugin directory
manifest / security / comment-2fa

Comment 2FA Verification

2FA comment authorization plugin for WordPress

by MindCapers · github.com/julie-mindcapers/comment-2fa

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/julie-mindcapers/comment-2fa/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/julie-mindcapers/comment-2fa ↗

Comment 2FA — WordPress Plugin

Stops spam by requiring email verification before a comment is accepted.

Files

comment-2fa/
├── comment-2fa.php   ← plugin entry point
├── comment-2fa.js    ← front-end logic
├── comment-2fa.css   ← styles
└── README.md

Installation

  1. Copy the comment-2fa/ folder into wp-content/plugins/.
  2. In WordPress admin go to Plugins → Installed Plugins and activate Comment 2FA Verification.
  3. Go to Settings → Comment 2FA and enter your Gmail App Password (see below).

Gmail App Password (required)

The plugin sends mail from mindcapers.noreply@gmail.com via Gmail SMTP.
Google requires an App Password — your regular Gmail password will not work.

Steps to create one

  1. Sign in to the Gmail account (mindcapers.noreply@gmail.com).
  2. Go to Google Account → Security.
  3. Make sure 2-Step Verification is enabled (required by Google).
  4. Under "2-Step Verification", click App Passwords.
  5. Choose app: Mail — device: Other → type WordPress → click Generate.
  6. Copy the 16-character password shown.
  7. Paste it into Settings → Comment 2FA → Gmail App Password in WordPress.

How it works

Step What happens
Commenter fills in the form The 2FA panel appears automatically
Email field has a valid address Send Verification Code button becomes active
User clicks Send Verification Code A 6-digit code is generated, stored server-side (expires in 10 min), and emailed
User enters the code and clicks Authorize Code is verified; a one-time session token is stored
User submits the comment Token is validated server-side; comment proceeds only if valid
  • Logged-in users with moderate_comments capability bypass 2FA.
  • Codes are single-use and expire after 10 minutes.
  • Tokens are also single-use and expire after 10 minutes.

Security notes

  • All AJAX endpoints are protected with a WordPress nonce.
  • Codes are compared with hash_equals() to prevent timing attacks.
  • Email addresses are never stored in plain text as transient keys (MD5-hashed).
  • The Gmail App Password is stored in wp_options (same as any other plugin credential). Consider a secrets manager or environment variable for higher-security environments.