內容簡介
Loqwall 2FA 是一款增強 WordPress 登入安全性的外掛，透過第二步驟的身份驗證，確保使用者在輸入帳號密碼後，必須使用一次性代碼進行身份確認，從而提升網站的安全性。
【主要功能】
• 電子郵件一次性密碼（OTP）
• 支援 Authenticator App（TOTP）
• 提供備用代碼以防失去訪問權限
• 設定受信裝置，最多可記住 30 天
• 管理員可強制使用 2FA
• 每次驗證事件皆有記錄
外掛標籤
開發者團隊
原文外掛簡介
Loqwall 2FA adds a secure second authentication step after the standard WordPress username/password login. After entering their credentials, users must verify their identity with a one-time code before gaining access.
Features
Email OTP — a 6-digit code is sent to the user’s registered email address.
Authenticator App (TOTP) — time-based codes compatible with Google Authenticator, Authy, Bitwarden, and any RFC 6238 app.
Backup codes — 10 one-time recovery codes generated per user.
Device trust — optionally remember a trusted device for up to 30 days.
Role enforcement — admins can be required to use 2FA regardless of their personal preference.
Per-user control — users enable and configure 2FA from their own profile page.
Rate limiting — brute-force protection on OTP verification.
Audit log — every authentication event is recorded in a private database table.
No external dependencies — all cryptographic operations use PHP’s built-in functions. No Composer, no remote APIs.
Developer-friendly — hooks and filters let you customise behaviour without modifying plugin files.
For Developers: Hooks & Filters
Filters
Loqwall_2FA_required_for_user
Runs on every login attempt. Return false to exempt a user, or true to force 2FA regardless of settings.
add_filter( 'Loqwall_2FA_required_for_user', function( $required, $user ) {
// Exempt the user with ID 5 from 2FA.
if ( 5 === $user->ID ) {
return false;
}
return $required;
}, 10, 2 );
Loqwall_2FA_otp_email_message
Filters the email body before the OTP is sent. Receives the body string, the WP_User object, the plain-text 6-digit code, and a boolean indicating whether the email is HTML.
add_filter( 'Loqwall_2FA_otp_email_message', function( $body, $user, $code, $html_mode ) {
// Append a custom footer to every OTP email.
return $body . '
Need help? Contact [email protected]
';
}, 10, 4 );
Actions
Loqwall_2FA_verified
Fires immediately after a user successfully passes 2FA. Receives the user ID and the method used ('email', 'totp', or 'backup_code').
add_action( 'Loqwall_2FA_verified', function( $user_id, $method ) {
// Log the successful verification to a custom audit system.
my_audit_log( $user_id, 'login_verified', $method );
}, 10, 2 );
Loqwall_2FA_failed
Fires after each failed 2FA verification attempt. Receives the user ID and the method attempted.
add_action( 'Loqwall_2FA_failed', function( $user_id, $method ) {
// Notify an admin after a failed attempt.
wp_mail( get_option('admin_email'), 'Failed 2FA attempt', "User #$user_id failed via $method." );
}, 10, 2 );
Third Party Libraries
This plugin bundles the following third-party library:
qrcodejs
* Author: Sangmin Shim (davidshimjs)
* License: MIT
* Source: https://github.com/davidshimjs/qrcodejs
* Files: assets/js/qrcode.min.js, assets/js/qrcode.js
* Purpose: Renders the QR code displayed during Authenticator App setup. Used entirely client-side; makes no external network requests.
