Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server — no third-party APIs, no account signup, no data leaves your site.

For users:

Easy setup via QR code — scan and go, or enter the secret key manually.
Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.
8 one-time recovery codes in case you lose your device.
Verification code required when enabling, so you can never lock yourself out by mistake.
Clean, distraction-free verification page at login.

For admins:

Modern dashboard with 2FA coverage stats across your site.
Role-based enforcement — require 2FA for administrators, editors, or any role.
Optional grace period so enforced users get time to set up.
Choose where users complete setup: right after login, or inside the dashboard.
2FA Status Report — see who has 2FA enabled and reset a user’s 2FA in one click.
Login page branding — add your own logo to the verification pages.

Security hardening built in:

TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site’s salts).
Rate limiting on all verification steps — codes can’t be brute-forced.
Replay protection — a used code is never accepted twice.
Recovery codes are stored hashed and each works only once.
QR codes are generated locally in pure PHP — nothing is sent to external services.
No external fonts, scripts, or API calls anywhere.

Development

The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin’s app/ directory. To rebuild the compiled files in assets/dist/, run npm install followed by npm run build inside the app/ directory.