Zeshan Login 2FA Pro
Two-factor authentication for WordPress, with the controls agencies actually need.
Everything in Pro.
Trusted devices — skip the code for a set number of days
Role-based enforcement with an optional grace period
Malware attack shield: brute-force limits, request blocking, file-editor lockdown
Personal setup and priority support from me
Want to try it first? The core plugin is free on WordPress.org. Pro is an upgrade, not a paywall.
A stolen password should not be enough to get into your site. This plugin adds a second step at login: a six-digit code from an authenticator app that changes every thirty seconds.
The free version on WordPress.org covers the essentials. Pro adds the pieces you need once you are running real client sites.
Trusted devices
Typing a code every single login gets old fast, and people work around security that annoys them. Trusted devices let a user skip the code on a device they have already proven, for a number of days you choose.
Revoke a device any time. Losing a laptop does not mean losing the account.
Role-based enforcement
Decide exactly who must use two-factor: administrators only, editors and shop managers too, or everyone.
- Set a grace period so existing users are not locked out overnight
- New users in enforced roles are prompted at their first login
- Nobody is ever blocked before they have finished setting up
Malware attack shield
Two-factor closes the front door. This closes the windows.
- Brute-force throttling - repeated failed logins from one address get slowed, then blocked
- Bad-request blocking - the common probe patterns attackers use to find vulnerable files
- File-editor lockdown - stops the built-in theme and plugin editor being used to inject code
Privacy, properly
No accounts, no telemetry, no third-party services. Your secrets are generated on your own server and never leave it. There is nothing to opt out of because nothing is collected.
Personal setup
Buying Pro includes me setting it up for you and helping your team get onboarded. I wrote the code, so I am the one who answers your email.
Before you buy.
Will this lock me out of my own site?
No. Two-factor is only enforced for users who have finished setup, and you get ten one-time backup codes when you enable it. If you lose your phone and your codes, you can still disable it via the database or by asking me.
Which authenticator apps work?
Any app that supports standard TOTP: Google Authenticator, Authy, Microsoft Authenticator, 1Password, Bitwarden, and others.
What does the licence cover?
One domain and all of its subdomains, forever. It is a one-time purchase with lifetime updates, not a subscription.
Can I move the licence to another site?
Yes. Deactivate it on the old site from the licence screen in the plugin, then activate it on the new one.
Do I need the free version first?
No. Pro is complete on its own. If you already run the free version, your existing two-factor setup carries over untouched.
Be the first to review this.
Used it? Tell other people how it went - good or bad.