Gupti 2FA

Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server — no third-party APIs, no account signup, no data leaves your site.

For users:

• Easy setup via QR code — scan and go, or enter the secret key manually.

• Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.

• 8 one-time recovery codes in case you lose your device.

• Verification code required when enabling, so you can never lock yourself out by mistake.

• Clean, distraction-free verification page at login.

For admins:

• Modern dashboard with 2FA coverage stats across your site.

• Role-based enforcement — require 2FA for administrators, editors, or any role.

• Optional grace period so enforced users get time to set up.

• Choose where users complete setup: right after login, or inside the dashboard.

• 2FA Status Report — see who has 2FA enabled and reset a user’s 2FA in one click.

• Login page branding — add your own logo to the verification pages.

Security hardening built in:

• TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site’s salts).

• Rate limiting on all verification steps — codes can’t be brute-forced.

• Replay protection — a used code is never accepted twice.

• Recovery codes are stored hashed and each works only once.

• QR codes are generated locally in pure PHP — nothing is sent to external services.

• No external fonts, scripts, or API calls anywhere.

Development

The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin’s app/ directory. To rebuild the compiled files in assets/dist/, run npm install followed by npm run build inside the app/ directory.