WordPress Plugin
FactorGuard
< 10 Active Installations
FactorGuard adds a two-step verification layer to the standard WordPress login without sending anything to a third-party cloud service. Every check happens on your own server. Users verify with a one-time code by email or a time-based code from Google Authenticator, Authy, Microsoft Authenticator or any RFC 6238 compatible app, with hashed one-time backup codes so nobody gets locked out. TOTP secrets are encrypted at rest with libsodium XSalsa20-Poly1305, accepted codes are invalidated within their time slice to block replay attacks, and configurable rate limiting locks out brute force attempts. REST API and XML-RPC requests bypass OTP automatically so integrations keep working.
Key Features
Email OTP and TOTP authenticator app support (RFC 6238)
TOTP secrets encrypted at rest with libsodium XSalsa20-Poly1305
Hashed one-time backup codes for account recovery
Replay protection: accepted codes invalidated per time-slice
Brute force lockout with configurable attempts and duration
Zero external API calls, REST and XML-RPC safe