內容簡介
SPIDY 2FA LOGIN 為 WordPress 登入提供第二層安全防護，使用者在輸入正確密碼後，需再輸入 6 位數代碼（透過電子郵件或簡訊）或進行生物識別確認（指紋/Face ID）。此外掛簡單易用，無需安裝額外應用程式。
【主要功能】
• 電子郵件代碼的雙重身份驗證
• 可選的簡訊發送功能
• 生物識別登入（指紋/Face ID）
• 每位使用者可選擇登入方式
• 無使用者數量限制
• 支援翻譯，準備接收社群翻譯
外掛標籤
開發者團隊
原文外掛簡介
SPIDY 2FA LOGIN adds a second layer of security to the WordPress login: after entering the correct password, the user is asked for a 6-digit code (email or SMS) or a biometric confirmation (fingerprint / Face ID via WebAuthn), depending on the method chosen for that account.
Why it’s different
Most two-factor plugins fall into one of two categories: dedicated 2FA plugins that rely on a separate authenticator app (Google Authenticator, Authy, and similar TOTP apps the user has to install and set up before they can even log in), or full security suites where 2FA is one small feature buried inside a much heavier toolkit of malware scanning, firewalls, and file monitoring — useful if you need all of that, overkill if you just want a second login step.
SPIDY 2FA LOGIN doesn’t ask the user to install anything. Email and SMS just work with a code. Biometric login uses the device’s own fingerprint sensor, Face ID, or a passkey already saved in the browser — the same technology behind passwordless sign-in on major websites — with automatic fallback to email if it’s ever unavailable, so nobody gets permanently locked out. Three methods, one plugin, nothing extra to install on either side.
What’s included
Two-factor authentication via email code
Optional SMS delivery via your own Twilio or Clickatell account (pay-as-you-go pricing set by the provider you choose)
Biometric login (fingerprint / Face ID / passkey) via the WebAuthn/FIDO2 standard — requires PHP 8.2+ and an HTTPS site; falls back to email automatically if unavailable or no device is registered
Simple, immediate user management panel with per-user method selection
No user cap
Translation-ready (all strings use the spidy-2fa-login text domain) — ready to receive community translations via translate.wordpress.org once listed
Testing environment
This plugin has always been developed and tested exclusively on live, publicly reachable WordPress and WooCommerce installations — never on a local or offline environment. Testing specifically took place on a subdomain (not the root/apex domain), which is relevant for the Biometric method: WebAuthn/FIDO2 scopes credentials to the Relying Party ID actually serving the page, so behavior on a subdomain reflects real-world multisite/staging-style setups rather than only the simplest single-root-domain case. This is stated here for accuracy, since local setups can hide issues (HTTPS, real SMTP delivery, actual mobile authenticators, real domain scoping) that only show up under real-world conditions.
External services
This plugin sends emails using WordPress’s native wp_mail() function: no data is transmitted to third parties for this feature.
The Biometric login method (WebAuthn/FIDO2) never sends any data to third parties: the cryptographic verification happens entirely on your own server and the user’s own device.
If you configure SMS delivery, the 6-digit login code and your site name are sent to your own Twilio or Clickatell account (whichever you choose) each time a user with SMS as their method and a saved phone number logs in. Message delivery, retention, and pricing are governed by the provider you choose — see Twilio’s privacy policy or Clickatell’s privacy policy.
