Super Duper Two-Factor Login adds robust two-factor authentication to your WordPress site. Unlike many alternatives, this plugin is completely free – no hidden costs, no premium tiers, no upsells. Every feature is included from the start.

🇨🇭🇩🇪🇦🇹 Hinweis für DACH-Nutzer: Plugin und Support sind auf Deutsch (Schweiz/Deutschland/Österreich) verfügbar. Alle Texte und Einstellungen sind vollständig auf Deutsch übersetzt.

Fully translated out of the box in German (Switzerland, Germany, Austria), English, French, Spanish, Italian and Dutch – no separate language pack required.

PHP 8.2 or higher required (for security reasons)

This plugin requires PHP 8.2 or higher. PHP 8.0 and 8.1 have both reached End of Life and no longer receive security updates – running a 2FA plugin on an unmaintained PHP version would defeat its purpose. PHP 8.2 lets us use modern security primitives (immutable configuration, type-safe method handling, strict return contracts) that make the plugin harder to attack.

Don’t have PHP 8.2 yet? Most hosting providers let you switch the PHP version with a single click in the control panel (Plesk, cPanel, Hostpoint, all-inkl, Cyon, raidboxes, etc.). It usually takes less than a minute and does not require any downtime. If in doubt, ask your hoster’s support – they help with PHP upgrades for free.

Two Verification Methods

TOTP (Authenticator App) – Works with Google Authenticator, FreeOTP+, Authy, Microsoft Authenticator, and any TOTP-compatible app. Setup via QR code or manual key entry.
Email – Receive a 6-digit code via email on every login. No smartphone required.

Comprehensive Fallback System

10 Backup Codes – One-time emergency codes in case you lose your phone. Copy, download, print, or email them to yourself.
Administrator Recovery Key – Each admin receives a personal 32-character key during setup. Works even when all backup codes are used up.
FTP Emergency Recovery (optional, off by default) – As a last resort, an empty file created via FTP can switch 2FA off for administrators. The file name has to contain a secret token that is generated in the settings and shown once (wp-content/.sdtfa-recovery-<TOKEN>), and it is only accepted for 15 minutes after it was created. All administrators are notified by email, both when it is used and when an invalid file shows up.

Enforcement & Trust

Role-Based Enforcement – Require 2FA for administrators, editors, subscribers, or any role.
Grace Period – Set a deadline so users have time to set up 2FA before enforcement kicks in.
Hard Enforcement – Without a grace period, users must complete 2FA setup on the login page before gaining any access.
Enforcement Areas – Choose where to enforce: admin area, WooCommerce account, checkout, or entire site.
Trust This Device – Users can save their computer so the 2FA code isn’t required on every login. Configurable duration (1–365 days).

Integration

WooCommerce – Adds a “Two-Factor Authentication” tab to the My Account page. Enforce 2FA for the account area and checkout.
Shortcode – Display the user’s 2FA status anywhere with [sdtfa_status].
Setup Reminder – A dismissable admin notice with a “Set up now” button. No auto-popups; users open the setup flow only by clicking.

Security

AES-256-GCM encryption for TOTP secrets at rest
Secure HttpOnly cookies for trusted devices
Hashed token storage (never stored in plain text)
No external dependencies – everything runs locally in pure PHP
No third-party API calls, no tracking, no data collection. The only HTTP request the plugin ever makes goes to your own site, and only when you click “Run live test” in the hardening section

Privacy & Hardening (optional)

Hide user data in REST API – Replace sensitive user fields (name, slug, link, avatar) with neutral values for unauthenticated requests. The REST endpoint stays reachable for SEO and import tools, but anonymous visitors no longer see real display names. Uses a strict whitelist that automatically drops any extra fields injected by SEO, page-builder or e-commerce plugins (Yoast, Rank Math, AIOSEO, Elementor, WooCommerce, …). Example response for an anonymous visitor on /wp-json/wp/v2/users/1:

{“id”:1,”name”:”Author”,”url”:””,”description”:””,”link”:”https:\/\/example.com\/”,”slug”:”author”,”avatar_urls”:{}}
Block author archives – Redirect unauthenticated visitors away from ?author=N and /author/<slug>/ to prevent user enumeration.
Disable password reset – Disable the “Lost your password?” function for administrators and/or selected roles. Useful when 2FA must be the only authentication path.
Users list column – A clean “SDTFA” column on Users All Users that shows the real 2FA status (TOTP, Email, or off) and replaces duplicate columns added by host mu-plugins or other 2FA plugins.

Server & File Hardening (optional)

A strong login does not help when a single uploaded file can take over the whole site. This section closes that path. Every switch is optional and off by default.

Block PHP in the uploads folder – The single most effective measure against an uploaded web shell: even if a malicious file makes it into wp-content/uploads/, the server refuses to execute it. The plugin writes a managed rule block into the uploads and upgrade folders and leaves everything else in those files untouched. A live test drops a harmless probe file, requests it over HTTP and tells you whether your server really refuses to run it – the only way to be sure, and it covers nginx too, where .htaccess files are silently ignored. Both probe files are deleted immediately. Ready-made nginx rules are shown for servers without .htaccess support.
Reject dangerous file types – Uploads of PHP and other server-side scripts are refused before the file is stored. Every extension segment is checked, so the classic photo.php.jpg trick is caught as well, and files whose name starts with a dot (.htaccess, .user.ini) are refused.
Protect sensitive files – Denies public access to debug.log, readme.html (which reveals your exact WordPress version), license.txt, database dumps, backup and editor left-overs, .env, .user.ini and version-control folders such as .git.
Block XML-RPC – xmlrpc.php allows hundreds of password guesses in a single request and is a popular way around login rate limits. It also powers pingback amplification attacks. The X-Pingback header and the RSD link are removed as well.
Disable the file editor – Removes the built-in plugin and theme file editors, the same effect as DISALLOW_FILE_EDIT. Anyone who gets hold of an administrator account can otherwise write PHP straight into your site from the browser.
Disable plugin/theme installation – The same effect as DISALLOW_FILE_MODS, so a stolen administrator account cannot install a backdoor plugin. For sites that deploy over FTP, Git or a pipeline. Both options use WordPress’ own filters instead of defining constants, so nothing in your wp-config.php is touched and an existing setting there always wins.
File permission report – Shows the current permissions of wp-config.php, wp-content, uploads, plugins and themes next to the recommended values and flags world-writable paths. This is a report only – the plugin never changes permissions by itself.

Rules written to the .htaccess in your WordPress root are verified with a request to your own site afterwards. If your server rejects them, the block is removed again automatically, so a restrictive server configuration can never take your site offline.