內容簡介
Email 2FA for WordPress 為 WordPress 登入過程增添了一層安全性，透過電子郵件發送一次性密碼（OTP）來進行雙重身份驗證。此外掛不需外部 2FA 服務，簡單輕巧，適合各種 WordPress 網站。
【主要功能】
• 電子郵件雙重身份驗證
• 自動創建驗證頁面
• 可配置的 OTP 長度
• 可配置的 OTP 過期時間
• 針對特定用戶角色要求 2FA
• 自訂驗證頁面和網址
外掛標籤
開發者團隊
② 後台搜尋「Dimitridedou – Email Login Codes」→ 直接安裝（推薦）
原文外掛簡介
Email 2FA for WordPress adds an extra layer of security to the WordPress login process by using one-time passwords (OTP) sent via email.
The plugin does not require any external 2FA service, making it a simple and lightweight solution for WordPress websites.
The verification process takes place on a dedicated WordPress page, without requiring wp-login.php for the OTP verification step. This page is created automatically when the plugin is activated, with the verification shortcode already added. No manual page creation or shortcode configuration is required.
The plugin is completely free and focuses on providing essential Email 2FA functionality without unnecessary complexity or premium restrictions.
Features
Two-factor authentication via email
One-time passwords (OTP)
Automatic creation of the verification page with the shortcode already added upon activation
Configurable OTP length
Configurable OTP expiration time
Configurable maximum number of verification attempts
Configurable OTP resend delay
Require 2FA for all users
Require 2FA for specific user roles
Enable 2FA on a per-user basis
Custom verification page using a shortcode
Customizable login and verification URLs
Uses WordPress wp_mail() functionality
No external 2FA service required
Settings
The plugin settings are available on the Email 2FA settings page.
Available settings include:
Enable or disable 2FA
OTP length
OTP expiration time
Maximum number of failed verification attempts
OTP resend delay
Require 2FA for all users
Require 2FA for specific user roles
Email subject
If “Require 2FA for all users” is disabled, 2FA is required when the user’s role has been configured as mandatory, or when the user has enabled 2FA for their own account.
Note: On the first activation, “Require 2FA for all users” is enabled by default. This means that every account, including your own, will be required to complete 2FA on the next login. Make sure that your site can send emails correctly through wp_mail() before logging in again.
Verification Page
The OTP verification form is displayed using the shortcode:
[email_2fa_verify]
This page is created automatically when the plugin is activated, with the shortcode already added. If you need to use the verification form on another page (for example, in a custom template or page builder), you can manually add the same shortcode there.
The plugin manages the verification process and completes the user’s login when the correct OTP is entered.
URL Customization
The default verification page is the page automatically created during plugin activation (/verify-2fa/).
If you prefer to use a different URL — for example, another page or slug — you can override the default page using the following filter:
add_filter( 'email_2fa_verify_url', function () {
return home_url( '/custom-2fa-verification/' );
} );
To change the login page URL:
add_filter( 'email_2fa_login_url', function () {
return home_url( '/login/' );
} );
Email Configuration
The plugin uses WordPress’s wp_mail() functionality to send OTP codes.
No separate external email delivery service is required.
If you want to set a specific sender email address:
add_filter( 'wp_mail_from', function ( $email ) {
return '[email protected]';
} );
To change the sender name:
add_filter( 'wp_mail_from_name', function ( $name ) {
return 'Your Website Name';
} );
If you are using an SMTP plugin, it is recommended to configure the sender address through your SMTP plugin settings.
Caching
The login and verification pages are dynamic.
If you use a caching plugin or server-level caching, you must exclude the login and verification pages from caching.
Examples of caching plugins include:
LiteSpeed Cache
WP Rocket
WP Super Cache
Incorrectly caching these pages may cause problems with the login and verification process.
Troubleshooting
The user is not redirected to the verification page
Check that 2FA is actually required for the specific user.
Check the following settings:
Require 2FA for all users
Require 2FA for specific user roles
Enable 2FA per user
If the login form uses AJAX, make sure that the plugin’s login detection mechanisms can run correctly on the login page.
The verification page keeps refreshing
This may be caused by another redirect configured on the website.
Check for redirects affecting wp-login.php, the login page, or the verification page.
The verification session has expired or is invalid
This may mean that the pending verification cookie or token could not be found or has expired.
Check that:
The OTP database table exists.
Cookies are enabled in the browser.
Cookies are not being deleted by another plugin.
The login and verification pages use the correct domain.
The pages are excluded from page caching.
The WordPress timezone is configured correctly.
The verification page no longer exists / I accidentally deleted it
The page will be created again the next time you activate the plugin (deactivate and activate it again).
The verification form is displayed to users who have not started a login attempt
Check whether the verification page is being cached by a caching system.
Exclude the verification page from page caching so that the shortcode is executed separately for each visitor.
Security
Email 2FA for WordPress is designed to provide an additional layer of security to the WordPress login process by using one-time passwords (OTP) sent via email.
For better security, keep WordPress, plugins, and themes up to date.
Links
Website: https://grcodeclub.gr/
GitHub: https://github.com/dimitridedou
Discord: https://discord.gg/VWXWSBtvKd
