Gupti 2FA Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server — no third-party APIs, no account signup, no data leaves your site.
For users:
- Easy setup via QR code — scan and go, or enter the secret key manually.
- Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.
- 8 one-time recovery codes in case you lose your device.
- Verification code required when enabling, so you can never lock yourself out by mistake.
- Clean, distraction-free verification page at login.
For admins:
- Modern dashboard with 2FA coverage stats across your site.
- Role-based enforcement — require 2FA for administrators, editors, or any role.
- Optional grace period so enforced users get time to set up.
- Choose where users complete setup: right after login, or inside the dashboard.
- 2FA Status Report — see who has 2FA enabled and reset a user’s 2FA in one click.
- Login page branding — add your own logo to the verification pages.
Security hardening built in:
- TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site’s salts).
- Rate limiting on all verification steps — codes can’t be brute-forced.
- Replay protection — a used code is never accepted twice.
- Recovery codes are stored hashed and each works only once.
- QR codes are generated locally in pure PHP — nothing is sent to external services.
- No external fonts, scripts, or API calls anywhere.
Development
The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin’s app/ directory. To rebuild the compiled files in assets/dist/, run npm install followed by npm run build inside the app/ directory.
Screenshots
No screenshots provided
