About this plugin
Zeshan Login 2FA adds real two-factor authentication (2FA) to your WordPress login. A password alone is no longer enough. Bots and leaked-password attacks target WordPress logins around the clock.
With Zeshan Login 2FA, a second step (a 6-digit code from an authenticator app) stands between an attacker and your admin area.
It works with the authenticator apps you already know: Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any other TOTP app.
Setup takes about two minutes: open your profile, scan a QR code with your phone, confirm one code, and save your backup codes. That is it. Your login is protected.
What you get (free)
- App-based 2FA at login. Standard TOTP (RFC 6238), the same technology your bank uses.
- QR-code setup. Scan once from your user profile. Your secret is generated on your own server.
- 10 backup codes. One-time codes so you can always get in, even if you lose your phone.
- Enforced for Administrators by default. Protect the accounts that matter most.
- Lockout-safe. 2FA is only enforced for users who have finished setup, so enabling the plugin never locks anyone out before they opt in.
- Privacy-first. No accounts, no tracking, no phone-home. Everything stays on your site.
Why Zeshan Login 2FA
- Lightweight and focused. It does one thing (2FA) and does it well.
- No account, no signup, no external service required.
- Clean, standards-based TOTP that every authenticator app supports.
- Backup codes are stored hashed (never in plaintext) and are one-time use.
Going further (Pro & personal setup)
The free plugin fully protects your login on its own. If you want more control or a done-for-you setup, Zeshan Login 2FA Pro adds:
- Trusted-device management. Remember the devices you trust and skip the code for a set number of days.
- Role-based enforcement. Require 2FA for editors, authors, shop managers, or everyone, with an optional grace period.
- Malware attack shield. Brute-force login protection, malicious-request blocking, and file-editor lockdown.
- Personal setup and priority support. I set it up for you and help your team get onboarded.
Pro is a one-time purchase and includes personal setup. dev/zeshan-login-2fa.
Credits & third-party libraries
This plugin bundles the following third-party library, used to draw the QR code in your browser:
- QRCode.js by Sangmin Shim (davidshimjs). Source: https://github.com/davidshimjs/qrcodejs (MIT License).
The library is included locally (not loaded from a third-party CDN) as required by the plugin directory guidelines. All other code is original work by the plugin author and licensed under GPLv2 or later.