{"id":350350,"date":"2026-08-22T08:42:17","date_gmt":"2026-08-22T08:42:17","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/suraksha-2fa\/"},"modified":"2026-08-22T09:08:11","modified_gmt":"2026-08-22T09:08:11","slug":"gupti-2fa","status":"publish","type":"plugin","link":"https:\/\/mg.wordpress.org\/plugins\/gupti-2fa\/","author":23544195,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.0.4","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"Gupti 2FA","header_author":"PlexoMedia","header_description":"Adds two-factor authentication (2FA) to WordPress login using any TOTP authenticator app.","assets_banners_color":"","last_updated":"2026-08-22 09:08:11","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/plexomedia.com\/gupti-2fa\/","header_author_uri":"https:\/\/plexomedia.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":36,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"plexomedia","date":"2026-08-22 09:08:11"}},"upgrade_notice":[],"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[9211,9163,1229,9225,9217],"plugin_category":[],"plugin_contributors":[276926],"plugin_business_model":[],"class_list":["post-350350","plugin","type-plugin","status-publish","hentry","plugin_tags-2fa","plugin_tags-google-authenticator","plugin_tags-login-security","plugin_tags-totp","plugin_tags-two-factor","plugin_contributors-plexomedia","plugin_committers-plexomedia"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/gupti-2fa.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server \u2014 no third-party APIs, no account signup, no data leaves your site.<\/p>\n\n<p><strong>For users:<\/strong><\/p>\n\n<ul>\n<li>Easy setup via QR code \u2014 scan and go, or enter the secret key manually.<\/li>\n<li>Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.<\/li>\n<li>8 one-time recovery codes in case you lose your device.<\/li>\n<li>Verification code required when enabling, so you can never lock yourself out by mistake.<\/li>\n<li>Clean, distraction-free verification page at login.<\/li>\n<\/ul>\n\n<p><strong>For admins:<\/strong><\/p>\n\n<ul>\n<li>Modern dashboard with 2FA coverage stats across your site.<\/li>\n<li>Role-based enforcement \u2014 require 2FA for administrators, editors, or any role.<\/li>\n<li>Optional grace period so enforced users get time to set up.<\/li>\n<li>Choose where users complete setup: right after login, or inside the dashboard.<\/li>\n<li>2FA Status Report \u2014 see who has 2FA enabled and reset a user's 2FA in one click.<\/li>\n<li>Login page branding \u2014 add your own logo to the verification pages.<\/li>\n<\/ul>\n\n<p><strong>Security hardening built in:<\/strong><\/p>\n\n<ul>\n<li>TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site's salts).<\/li>\n<li>Rate limiting on all verification steps \u2014 codes can't be brute-forced.<\/li>\n<li>Replay protection \u2014 a used code is never accepted twice.<\/li>\n<li>Recovery codes are stored hashed and each works only once.<\/li>\n<li>QR codes are generated locally in pure PHP \u2014 nothing is sent to external services.<\/li>\n<li>No external fonts, scripts, or API calls anywhere.<\/li>\n<\/ul>\n\n<h3>Development<\/h3>\n\n<p>The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin's <code>app\/<\/code> directory. To rebuild the compiled files in <code>assets\/dist\/<\/code>, run <code>npm install<\/code> followed by <code>npm run build<\/code> inside the <code>app\/<\/code> directory.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>gupti-2fa<\/code> folder to <code>\/wp-content\/plugins\/<\/code>, or install via <strong>Plugins \u2192 Add New<\/strong>.<\/li>\n<li>Activate the plugin through the <strong>Plugins<\/strong> menu in WordPress.<\/li>\n<li>To enable 2FA for yourself: go to your <strong>Profile<\/strong> page, scan the QR code with your authenticator app, and enter the 6-digit code to verify.<\/li>\n<li>To enforce 2FA for user roles: go to <strong>Gupti 2FA \u2192 Configuration<\/strong>, select the roles, and save.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20if%20i%20lose%20my%20phone%3F\"><h3>What if I lose my phone?<\/h3><\/dt>\n<dd><p>Use one of your 8 recovery codes on the login screen to complete verification, then reconfigure 2FA from your profile. If you have lost the recovery codes too, a site administrator can reset your 2FA from the 2FA Status Report.<\/p><\/dd>\n<dt id=\"can%20i%20require%202fa%20only%20for%20administrators%3F\"><h3>Can I require 2FA only for administrators?<\/h3><\/dt>\n<dd><p>Yes. Go to Gupti 2FA \u2192 Configuration and select only the roles you want to enforce \u2014 for example, just Administrators. Other users can still enable 2FA voluntarily from their profile page.<\/p><\/dd>\n<dt id=\"will%20this%20plugin%20slow%20down%20my%20site%3F\"><h3>Will this plugin slow down my site?<\/h3><\/dt>\n<dd><p>No. The plugin makes no external API calls and loads its scripts and styles only on the login page and its own admin pages. Your site's front end is completely unaffected.<\/p><\/dd>\n<dt id=\"does%20this%20work%20with%20custom%20login%20pages%3F\"><h3>Does this work with custom login pages?<\/h3><\/dt>\n<dd><p>It hooks into WordPress core authentication, so it works with any theme or plugin that uses the standard <code>wp_authenticate<\/code> \/ <code>wp_login_url<\/code> flow.<\/p><\/dd>\n<dt id=\"does%20it%20send%20my%20data%20anywhere%3F\"><h3>Does it send my data anywhere?<\/h3><\/dt>\n<dd><p>No. Secrets are generated, stored (encrypted), and verified entirely on your own server. QR codes are rendered locally in PHP. The plugin makes no external requests.<\/p><\/dd>\n<dt id=\"will%20rest%20api%20or%20xml-rpc%20logins%20bypass%202fa%3F\"><h3>Will REST API or XML-RPC logins bypass 2FA?<\/h3><\/dt>\n<dd><p>No. Password-based programmatic logins are blocked for 2FA-enabled accounts. Use WordPress application passwords for API access \u2014 they are unaffected.<\/p><\/dd>\n<dt id=\"where%20can%20i%20get%20support%3F\"><h3>Where can I get support?<\/h3><\/dt>\n<dd><p>Use the plugin support forum on WordPress.org, or email us at hello@plexomedia.com.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"Secure your WordPress login with two-factor authentication (2FA) using any TOTP authenticator app \u2014 no external services, no bloat.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/350350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=350350"}],"author":[{"embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/plexomedia"}],"wp:attachment":[{"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=350350"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=350350"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=350350"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=350350"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=350350"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/mg.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=350350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}