WordPress/two-factor

View on GitHub

Two-Factor Authentication for WordPress.

Stars: 825
Forks: 187
Open beginner issues: 0
Indexed issues: 55
Avg merge: 2d 11h
Merged PRs (30d): 17

Dominant language: PHP
License: GPL-2.0
Last GitHub push: Sep 17, 2026
Latest indexed: Sep 20, 2026
Contributing guide: No contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

55 open issues indexed

Pasting verification code no longer fires automatic login Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

WordPress/two-factor#959 · 1 comment · Opened Aug 13, 2026
Backup codes download file identifies the site by full URL rather than name or host Open

Difficulty 5/5 Over a week Newbie friendliness 45/100

WordPress/two-factor#957 · Opened Aug 10, 2026
generate_codes() with 'method' => 'append' stores an empty code when the user has none Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

WordPress/two-factor#956 · Opened Aug 10, 2026
Privacy: register a personal data exporter and eraser Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/two-factor#954 · Opened Aug 9, 2026
Enrolling a second factor destroys the user's other sessions and sends no notification Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

WordPress/two-factor#953 · Opened Aug 9, 2026
Conflict between Two Factor (v0.16.0) and Login with Google plugin Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

WordPress/two-factor#951 · 1 comment · Opened Aug 5, 2026
Password managers can capture the TOTP setup QR and lock users out of login Open

Emailed Codes TOTP

Difficulty 5/5 Over a week Newbie friendliness 35/100

WordPress/two-factor#945 · 1 comment · Opened Jul 25, 2026
Keep authentication fail-closed when provider filters change between lookups Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

WordPress/two-factor#943 · Opened Jul 23, 2026
Normalize malformed primary-provider meta before array-key access Open

Difficulty 3/5 1-2 days Newbie friendliness 65/100

WordPress/two-factor#944 · Opened Jul 23, 2026
Normalize malformed enabled-provider user meta before array operations Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

WordPress/two-factor#941 · Opened Jul 23, 2026
Recovery-code REST route accepts nonexistent users Open

Difficulty 3/5 1-2 days Newbie friendliness 72/100

WordPress/two-factor#937 · Opened Jul 23, 2026
Reject oversized TOTP confirmation codes before validation Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

WordPress/two-factor#936 · Opened Jul 22, 2026
Expose provider management and server-owned TOTP enrollment over REST Open

Difficulty 5/5 Over a week Newbie friendliness 38/100

WordPress/two-factor#934 · 1 comment · Opened Jul 22, 2026
Bug: Users list table dies (wp_die) when a user's only 2FA provider has been deregistered Open

WordPress/two-factor#932 · 1 assignee · Opened Jul 22, 2026
Email provider "Resend Code" button remains visible and interactive while user is rate-limited Open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

WordPress/two-factor#920 · Opened Jul 3, 2026
Failed-attempt warning addresses two mutually exclusive audiences simultaneously Open

Difficulty 3/5 1-2 days Newbie friendliness 52/100

WordPress/two-factor#919 · Opened Jul 3, 2026
Rate-limit error message is alarming and its countdown is stale for legitimate users Open

Difficulty 3/5 1-2 days Newbie friendliness 68/100

WordPress/two-factor#918 · 1 comment · Opened Jul 3, 2026
Roadmap: Account recovery after losing a second factor Open

WordPress/two-factor#909 · 1 assignee · Opened Jun 14, 2026
Access Token from Email Provider subject filters Open

WordPress/two-factor#898 · 1 assignee · Opened Jun 7, 2026
Add network-level provider settings for WordPress Multisite Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

WordPress/two-factor#894 · Opened May 20, 2026
Bug: login_url() breaks WPML / multi-domain setups — causes session loops and "Invalid verification code" Open

WordPress/two-factor#885 · 1 reaction · 1 assignee · Opened May 4, 2026
TOTP codes from Apple Passwords are wiped on the login screen Open

Difficulty 3/5 1-2 days Newbie friendliness 64/100

WordPress/two-factor#880 · Opened Apr 18, 2026
The 'two_factor_enabled_providers_for_user' filter behaves differently in version 0.16.0 Open

WordPress/two-factor#871 · 11 comments · 1 assignee · Opened Apr 7, 2026
Email resend bypasses retry delay in 2FA challenge flow Open

WordPress/two-factor#847 · 1 comment · 1 assignee · Opened Mar 23, 2026
Allow site administrators to enforce 2FA for specific user roles Open

WordPress/two-factor#846 · 1 comment · 1 assignee · Opened Mar 21, 2026
Upgrade dependencies Open

WordPress/two-factor#838 · 1 comment · 1 assignee · Opened Mar 14, 2026
Document process for pre-releases Open

Difficulty 3/5 Half a day Newbie friendliness 35/100

WordPress/two-factor#822 · 1 comment · Opened Mar 4, 2026
Setup Onboarding Login-Flow (for Enforce 2FA) Open

Help Wanted

Difficulty 5/5 Over a week Newbie friendliness 35/100

WordPress/two-factor#813 · 3 comments · Opened Feb 24, 2026
Add Passkeys Support Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

WordPress/two-factor#779 · 7 comments · 2 reactions · Opened Feb 4, 2026
Require verification before activating Email TOTP Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

WordPress/two-factor#778 · Opened Feb 4, 2026
Add hook to turn off auto-submission of 2FA form Open

WordPress/two-factor#723 · 3 comments · 1 assignee · Opened Nov 13, 2025
Custom login form input fields dropped during two-factor challenge Open

Difficulty 3/5 1-2 days Newbie friendliness 64/100

WordPress/two-factor#705 · 2 comments · Opened Jul 9, 2025
Woocommerce 2FA settings implementation Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

WordPress/two-factor#704 · 8 comments · Opened Jul 6, 2025
Hooks to support requesting 2FA for plugins extending `two-factor` core functionality Open

Compatibility

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/two-factor#644 · 1 comment · Opened Oct 17, 2024
Stuck on revalidate now loop Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/two-factor#629 · 6 comments · Opened Aug 31, 2024
Account recovery after losing 2fa key Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/two-factor#621 · 4 comments · Opened Jul 30, 2024
Revalidation: Prompted immediately after setting up 2FA Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

WordPress/two-factor#572 · 1 comment · 2 reactions · Opened May 25, 2023
Warn if recovery mode available Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WordPress/two-factor#509 · 4 comments · Opened Feb 1, 2023
Backup codes are saved before user intends Open

Backup Codes

Difficulty 3/5 1-2 days Newbie friendliness 48/100

WordPress/two-factor#507 · 7 comments · Opened Jan 25, 2023
Add e2e tests for critical paths Open

Developer Tooling

WordPress/two-factor#497 · 7 comments · 2 assignees · Opened Nov 18, 2022
Notify user/admin when sensitive events occur Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/two-factor#476 · Opened Oct 14, 2022
Log or alert on failed 2FA codes Open

WordPress/two-factor#459 · 3 comments · 1 assignee · Opened Sep 20, 2022
Add ability to re-encrypt secrets Open

Help Wanted

WordPress/two-factor#456 · 5 comments · 1 assignee · Opened Sep 9, 2022
Add support for encrypting TOTP secrets Open

WordPress/two-factor#455 · 8 comments · 2 assignees · Opened Sep 9, 2022
Passwordless login | Login with emailed link Open

Emailed Codes

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/two-factor#449 · 6 comments · Opened Jul 20, 2022
Make the Two Factor settings portable to other settings screens Open

Compatibility

Difficulty 4/5 3-5 days Newbie friendliness 48/100

WordPress/two-factor#335 · 12 comments · Opened Feb 27, 2020
Enforce 2FA Open

WordPress/two-factor#255 · 1 comment · 1 assignee · Opened Oct 22, 2018
BuddyPress User Two Factor Options Open

Compatibility

Difficulty 5/5 Over a week Newbie friendliness 20/100

WordPress/two-factor#247 · 8 comments · Opened Sep 12, 2018
Error Reporting from Saving methods Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WordPress/two-factor#244 · 1 comment · Opened Sep 5, 2018
Add wp-cli support Open

WordPress/two-factor#233 · 4 comments · 5 reactions · 1 assignee · Opened May 24, 2018

WordPress/two-factor

Get new issues in your inbox