內容簡介
SPIDY 2FA LOGIN 為 WordPress 登入增加第二層安全性，使用者在輸入正確密碼後，需提供 6 位數的驗證碼（透過電子郵件或簡訊）或生物識別確認（指紋/Face ID），確保帳號安全。
【主要功能】
• 透過電子郵件驗證碼進行雙重身份驗證
• 可選擇使用 Twilio 或 Clickatell 簡訊發送
• 支援生物識別登入（指紋/Face ID）
• 每位使用者可生成 10 個一次性備份碼
• 簡單的用戶管理面板，支持個別方法選擇
• 無用戶數量限制
外掛標籤
開發者團隊
原文外掛簡介
SPIDY 2FA LOGIN adds a second layer of security to the WordPress login: after entering the correct password, the user is asked for a 6-digit code (email or SMS) or a biometric confirmation (fingerprint / Face ID via WebAuthn), depending on the method chosen for that account.
Why it’s different
Most two-factor plugins fall into one of two categories: dedicated 2FA plugins that rely on a separate authenticator app (Google Authenticator, Authy, and similar TOTP apps the user has to install and set up before they can even log in), or full security suites where 2FA is one small feature buried inside a much heavier toolkit of malware scanning, firewalls, and file monitoring — useful if you need all of that, overkill if you just want a second login step.
SPIDY 2FA LOGIN doesn’t ask the user to install anything. Email and SMS just work with a code. Biometric login uses the device’s own fingerprint sensor, Face ID, or a passkey already saved in the browser — the same technology behind passwordless sign-in on major websites — with automatic fallback to email if it’s ever unavailable, so nobody gets permanently locked out. Three methods, one plugin, nothing extra to install on either side.
What’s included
Two-factor authentication via email code
Optional SMS delivery via your own Twilio or Clickatell account (pay-as-you-go pricing set by the provider you choose)
Biometric login (fingerprint / Face ID / passkey) via the WebAuthn/FIDO2 standard — requires PHP 8.2+ and an HTTPS site; falls back to email automatically if unavailable or no device is registered
One-time backup codes: each user can generate 10 printable codes to sign in when the email or SMS code doesn’t arrive
Emergency switch: a single line in wp-config.php (define( 'SPIDY_2FA_OFF', true );) disables 2FA for everyone — no need to rename or delete the plugin folder
Simple, immediate user management panel with per-user method selection
No user cap
Translation-ready (all strings use the spidy-2fa-login text domain) — ready to receive community translations via translate.wordpress.org once listed
Testing environment
This plugin has always been developed and tested exclusively on live, publicly reachable WordPress and WooCommerce installations — never on a local or offline environment. Testing specifically took place on a subdomain (not the root/apex domain), which is relevant for the Biometric method: WebAuthn/FIDO2 scopes credentials to the Relying Party ID actually serving the page, so behavior on a subdomain reflects real-world multisite/staging-style setups rather than only the simplest single-root-domain case. This is stated here for accuracy, since local setups can hide issues (HTTPS, real SMTP delivery, actual mobile authenticators, real domain scoping) that only show up under real-world conditions.
External services
This plugin sends emails using WordPress’s native wp_mail() function: no data is transmitted to third parties for this feature.
The Biometric login method (WebAuthn/FIDO2) never sends any data to third parties: the cryptographic verification happens entirely on your own server and the user’s own device.
If you configure SMS delivery, the 6-digit login code and your site name are sent to your own Twilio or Clickatell account (whichever you choose) each time a user with SMS as their method and a saved phone number logs in. Message delivery, retention, and pricing are governed by the provider you choose — see Twilio’s privacy policy or Clickatell’s privacy policy.
