內容簡介
Gupti 2FA 為您的 WordPress 網站增添額外的安全層，透過 Google Authenticator 等應用程式要求時間性一次性密碼 (TOTP) 進行登入。所有操作均在本地伺服器上進行，無需第三方 API 或帳號註冊，確保數據不外洩。
【主要功能】
• QR 碼輕鬆設置，掃描即可使用
• 支援多種 TOTP 應用程式
• 提供 8 個一次性恢復碼
• 角色基礎的 2FA 強制執行
• 登入頁面可自訂品牌標誌
• 安全性加強，密碼加密存儲
外掛標籤
開發者團隊
原文外掛簡介
Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server — no third-party APIs, no account signup, no data leaves your site.
For users:
Easy setup via QR code — scan and go, or enter the secret key manually.
Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.
8 one-time recovery codes in case you lose your device.
Verification code required when enabling, so you can never lock yourself out by mistake.
Clean, distraction-free verification page at login.
For admins:
Modern dashboard with 2FA coverage stats across your site.
Role-based enforcement — require 2FA for administrators, editors, or any role.
Optional grace period so enforced users get time to set up.
Choose where users complete setup: right after login, or inside the dashboard.
2FA Status Report — see who has 2FA enabled and reset a user’s 2FA in one click.
Login page branding — add your own logo to the verification pages.
Security hardening built in:
TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site’s salts).
Rate limiting on all verification steps — codes can’t be brute-forced.
Replay protection — a used code is never accepted twice.
Recovery codes are stored hashed and each works only once.
QR codes are generated locally in pure PHP — nothing is sent to external services.
No external fonts, scripts, or API calls anywhere.
Development
The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin’s app/ directory. To rebuild the compiled files in assets/dist/, run npm install followed by npm run build inside the app/ directory.
