Make two-factor mandatory for all WordPress users (emailed-code floor, per-role exclusions) and lock the XML-RPC/REST API-login path to an allowlist. Optional must-use mode.
Extends the WordPress Two Factor plugin with advanced role-based controls, forced 2FA methods, and enhanced administrative features for single-site and Multisite installations.
WebAuthn for the Wordpress Two Factor plugin
Adds two-factor authentication to the WordPress login flow.
Lightweight email-based two-factor authentication for WordPress admin access.
WordPress passkey 2FA for admins: sign in with Face ID, Touch ID or a security key, with optional passwordless login. Works with the Two Factor plugin and its WebAuthn provider. GPL-2.0.
WordPress Plugin: Enhanced two-factor authentication with an authenticator app, email verification, backup codes, and a secure login process from sxtmedia.
Enforceable, frontend-first two-factor authentication for WordPress with role-based hard enforcement.