WP Manifestindependent plugin directory
manifest / security / comment-2fa

Comment 2FA Verification

2FA comment authorization plugin for WordPress

by MindCapers · github.com/julie-mindcapers/comment-2fa

★ 0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/julie-mindcapers/comment-2fa/archive/refs/heads/main.zip
Readme github.com/julie-mindcapers/comment-2fa ↗

Comment 2FA — WordPress Plugin

Stops spam by requiring email verification before a comment is accepted.

Files

comment-2fa/
├── comment-2fa.php   ← plugin entry point
├── comment-2fa.js    ← front-end logic
├── comment-2fa.css   ← styles
└── README.md

Installation

  1. Copy the comment-2fa/ folder into wp-content/plugins/.
  2. In WordPress admin go to Plugins → Installed Plugins and activate Comment 2FA Verification.
  3. Go to Settings → Comment 2FA and enter your Gmail App Password (see below).

Gmail App Password (required)

The plugin sends mail from mindcapers.noreply@gmail.com via Gmail SMTP.
Google requires an App Password — your regular Gmail password will not work.

Steps to create one

  1. Sign in to the Gmail account (mindcapers.noreply@gmail.com).
  2. Go to Google Account → Security.
  3. Make sure 2-Step Verification is enabled (required by Google).
  4. Under "2-Step Verification", click App Passwords.
  5. Choose app: Mail — device: Other → type WordPress → click Generate.
  6. Copy the 16-character password shown.
  7. Paste it into Settings → Comment 2FA → Gmail App Password in WordPress.

How it works

Step What happens
Commenter fills in the form The 2FA panel appears automatically
Email field has a valid address Send Verification Code button becomes active
User clicks Send Verification Code A 6-digit code is generated, stored server-side (expires in 10 min), and emailed
User enters the code and clicks Authorize Code is verified; a one-time session token is stored
User submits the comment Token is validated server-side; comment proceeds only if valid
  • Logged-in users with moderate_comments capability bypass 2FA.
  • Codes are single-use and expire after 10 minutes.
  • Tokens are also single-use and expire after 10 minutes.

Security notes

  • All AJAX endpoints are protected with a WordPress nonce.
  • Codes are compared with hash_equals() to prevent timing attacks.
  • Email addresses are never stored in plain text as transient keys (MD5-hashed).
  • The Gmail App Password is stored in wp_options (same as any other plugin credential). Consider a secrets manager or environment variable for higher-security environments.