WPU Two Factor

Additional features for the official two factor plugin

Notification methods

When a user has no active two-factor method — or uses a provider that is no longer allowed — the plugin can react in three ways:

• admin_notices : a standard error notice at the top of the admin screens.
• modal : a full-page modal, displayed everywhere except the profile screen.
• redirect : the user is sent to their profile page, where a modal explains that a two-factor method is required. Technical requests (ajax, cron, REST, POST) and the profile screens themselves are never redirected.

The default method is none.

Set the method globally

add_filter('wpu_two_factor_notice_method', function ($method) {
    return 'redirect';
});

Set the method per role

add_filter('wpu_two_factor_notice_by_role', function ($roles) {
    $roles['administrator'] = 'redirect';
    $roles['editor'] = 'modal';
    $roles['subscriber'] = 'admin_notices';
    return $roles;
});

Roles are tested in order with current_user_can(), so the first match wins. On multisite, super admins use the super_admin key if it is defined, and fall back to administrator.

Customize the redirect

/* Change the modal content displayed on the profile page */
add_filter('wpu_two_factor_redirect_modal_content', function ($content, $user_status) {
    return __('Your account requires a two-factor authentication method.', 'my_theme');
}, 10, 2);

/* Add screens that should never trigger a redirect */
add_filter('wpu_two_factor_redirect_excluded_pages', function ($pages) {
    $pages[] = 'options-general.php';
    return $pages;
});