Two-Factor Extend

Why Add Extra Security to Two-Factor Authentication?

The official Two-Factor plugin adds 2FA to WordPress, but it lacks critical security features that real-world sites need. Two Factor Extend fills the gap with forced 2FA enforcement, brute force protection, IP management, and comprehensive audit logging — all free and open source.

Key Features

Core Security Enhancements

Forced 2FA

Require all users (or specific roles) to enable two-factor authentication. Set grace periods before enforcement kicks in.

Login Attempt Limits

Lock out users after a configurable number of failed login attempts. Rate-limit brute force attacks automatically.

IP Lockout & Whitelist

Block IPs after repeated failures. Whitelist trusted IPs (office network, VPN) to bypass 2FA entirely.

 

Custom Login URL

Change wp-login.php to a custom URL. Reduce automated attack surface — bots can’t attack what they can’t find.

User Management Features

Trusted Devices

Let users mark devices as trusted. Skip 2FA on recognized browsers for a configurable period (7/14/30 days).

Login Notifications

Email users when their account is accessed from a new device or location. Early warning for compromised credentials.

Grace Periods

Give new users time to set up 2FA before enforcement. Customizable per user role — admins can have different rules than subscribers.

Audit & Monitoring

Audit Log

Track every 2FA-related event: setups, failures, bypasses, IP lockouts. Filter by user, action, or date range.

Dashboard Widget

See security stats at a glance from your WordPress dashboard. Active 2FA users, recent lockouts, pending enforcements.

User Profile Integration

Manage 2FA settings directly from the user profile page. Admins can reset 2FA for locked-out users.

 

Compatibility & Requirements

Two Factor Extend requires the official Two-Factor plugin (free on WordPress.org). It works with all 2FA methods: TOTP (Google Authenticator, Authy), FIDO U2F security keys, email codes, and backup codes. Compatible with all WordPress themes and most security plugins.

How to Install & Set Up Two Factor Extend

Get started in under 5 minutes:

Step 1 — Install the Two-Factor plugin — Go to Plugins → Add New and search for “Two-Factor” by the WordPress Core Contributors. Install and activate it first.

Step 2 — Install Two Factor Extend — Search for “Two Factor Extend” in Plugins → Add New, or download from WordPress.org.

Step 3 — Activate both plugins — Two-Factor must be active. Two Factor Extend will add its settings menu automatically.

Step 4 — Configure security rules — Go to Settings → Two Factor Extend. Set forced 2FA roles, login attempt limits, and IP lockout thresholds.

 

Frequently Asked Questions

Do I need the original Two-Factor plugin?

Yes. Two Factor Extend is an add-on — it requires the official Two-Factor plugin to be installed and active. Both are free on WordPress.org.

 

What happens if a user loses their 2FA device?

Admins can reset 2FA for any user from the WordPress admin panel. Backup codes (if enabled) also provide a recovery path.

 

Will this lock me out of my own site?

No. IP whitelist your own IP first, and configure grace periods before enforcing 2FA. We recommend testing on a staging site first.

 

Does this work with WooCommerce or membership sites?

Yes. 2FA enforcement works for all WordPress user roles, including WooCommerce customers and membership site subscribers.

 

Is this plugin compatible with Wordfence or other security plugins?

Generally yes. Avoid enabling login attempt limits in both plugins simultaneously to prevent conflicts. Choose one plugin to handle rate limiting.