內容簡介
Super Duper Two-Factor Login 為您的 WordPress 網站提供強大的雙重身份驗證功能。此外掛完全免費，無隱藏費用或升級選項，所有功能自始至終都可使用，確保網站安全。
【主要功能】
• 支援 TOTP 認證應用程式
• 電子郵件發送 6 位數驗證碼
• 提供 10 個備用緊急碼
• 管理員專屬恢復金鑰
• 可選的 FTP 緊急恢復功能
外掛標籤
開發者團隊
② 後台搜尋「Super Duper Two-Factor Login」→ 直接安裝（推薦）
原文外掛簡介
Super Duper Two-Factor Login adds robust two-factor authentication to your WordPress site. Unlike many alternatives, this plugin is completely free – no hidden costs, no premium tiers, no upsells. Every feature is included from the start.
🇨🇭🇩🇪🇦🇹 Hinweis für DACH-Nutzer: Plugin und Support sind auf Deutsch (Schweiz/Deutschland/Österreich) verfügbar. Alle Texte und Einstellungen sind vollständig auf Deutsch übersetzt.
Fully translated out of the box in German (Switzerland, Germany, Austria), English, French, Spanish, Italian and Dutch – no separate language pack required.
PHP 8.2 or higher required (for security reasons)
This plugin requires PHP 8.2 or higher. PHP 8.0 and 8.1 have both reached End of Life and no longer receive security updates – running a 2FA plugin on an unmaintained PHP version would defeat its purpose. PHP 8.2 lets us use modern security primitives (immutable configuration, type-safe method handling, strict return contracts) that make the plugin harder to attack.
Don’t have PHP 8.2 yet? Most hosting providers let you switch the PHP version with a single click in the control panel (Plesk, cPanel, Hostpoint, all-inkl, Cyon, raidboxes, etc.). It usually takes less than a minute and does not require any downtime. If in doubt, ask your hoster’s support – they help with PHP upgrades for free.
Two Verification Methods
TOTP (Authenticator App) – Works with Google Authenticator, FreeOTP+, Authy, Microsoft Authenticator, and any TOTP-compatible app. Setup via QR code or manual key entry.
Email – Receive a 6-digit code via email on every login. No smartphone required.
Comprehensive Fallback System
10 Backup Codes – One-time emergency codes in case you lose your phone. Copy, download, print, or email them to yourself.
Administrator Recovery Key – Each admin receives a personal 32-character key during setup. Works even when all backup codes are used up.
FTP Emergency Recovery (optional, off by default) – As a last resort, an empty file created via FTP can switch 2FA off for administrators. The file name has to contain a secret token that is generated in the settings and shown once (wp-content/.sdtfa-recovery-
Enforcement & Trust
Role-Based Enforcement – Require 2FA for administrators, editors, subscribers, or any role.
Grace Period – Set a deadline so users have time to set up 2FA before enforcement kicks in.
Hard Enforcement – Without a grace period, users must complete 2FA setup on the login page before gaining any access.
Enforcement Areas – Choose where to enforce: admin area, WooCommerce account, checkout, or entire site.
Trust This Device – Users can save their computer so the 2FA code isn’t required on every login. Configurable duration (1–365 days).
Integration
WooCommerce – Adds a “Two-Factor Authentication” tab to the My Account page. Enforce 2FA for the account area and checkout.
Shortcode – Display the user’s 2FA status anywhere with [sdtfa_status].
Setup Reminder – A dismissable admin notice with a “Set up now” button. No auto-popups; users open the setup flow only by clicking.
Security
AES-256-GCM encryption for TOTP secrets at rest
Secure HttpOnly cookies for trusted devices
Hashed token storage (never stored in plain text)
No external dependencies – everything runs locally in pure PHP
No third-party API calls, no tracking, no data collection. The only HTTP request the plugin ever makes goes to your own site, and only when you click “Run live test” in the hardening section
Privacy & Hardening (optional)
Hide user data in REST API – Replace sensitive user fields (name, slug, link, avatar) with neutral values for unauthenticated requests. The REST endpoint stays reachable for SEO and import tools, but anonymous visitors no longer see real display names. Uses a strict whitelist that automatically drops any extra fields injected by SEO, page-builder or e-commerce plugins (Yoast, Rank Math, AIOSEO, Elementor, WooCommerce, …). Example response for an anonymous visitor on /wp-json/wp/v2/users/1:
{“id”:1,”name”:”Author”,”url”:””,”description”:””,”link”:”https:\/\/example.com\/”,”slug”:”author”,”avatar_urls”:{}}
Block author archives – Redirect unauthenticated visitors away from ?author=N and /author/
Disable password reset – Disable the “Lost your password?” function for administrators and/or selected roles. Useful when 2FA must be the only authentication path.
Users list column – A clean “SDTFA” column on Users → All Users that shows the real 2FA status (TOTP, Email, or off) and replaces duplicate columns added by host mu-plugins or other 2FA plugins.
Server & File Hardening (optional)
A strong login does not help when a single uploaded file can take over the whole site. This section closes that path. Every switch is optional and off by default.
Block PHP in the uploads folder – The single most effective measure against an uploaded web shell: even if a malicious file makes it into wp-content/uploads/, the server refuses to execute it. The plugin writes a managed rule block into the uploads and upgrade folders and leaves everything else in those files untouched. A live test drops a harmless probe file, requests it over HTTP and tells you whether your server really refuses to run it – the only way to be sure, and it covers nginx too, where .htaccess files are silently ignored. Both probe files are deleted immediately. Ready-made nginx rules are shown for servers without .htaccess support.
Reject dangerous file types – Uploads of PHP and other server-side scripts are refused before the file is stored. Every extension segment is checked, so the classic photo.php.jpg trick is caught as well, and files whose name starts with a dot (.htaccess, .user.ini) are refused.
Protect sensitive files – Denies public access to debug.log, readme.html (which reveals your exact WordPress version), license.txt, database dumps, backup and editor left-overs, .env, .user.ini and version-control folders such as .git.
Block XML-RPC – xmlrpc.php allows hundreds of password guesses in a single request and is a popular way around login rate limits. It also powers pingback amplification attacks. The X-Pingback header and the RSD link are removed as well.
Disable the file editor – Removes the built-in plugin and theme file editors, the same effect as DISALLOW_FILE_EDIT. Anyone who gets hold of an administrator account can otherwise write PHP straight into your site from the browser.
Disable plugin/theme installation – The same effect as DISALLOW_FILE_MODS, so a stolen administrator account cannot install a backdoor plugin. For sites that deploy over FTP, Git or a pipeline. Both options use WordPress’ own filters instead of defining constants, so nothing in your wp-config.php is touched and an existing setting there always wins.
File permission report – Shows the current permissions of wp-config.php, wp-content, uploads, plugins and themes next to the recommended values and flags world-writable paths. This is a report only – the plugin never changes permissions by itself.
Rules written to the .htaccess in your WordPress root are verified with a request to your own site afterwards. If your server rejects them, the block is removed again automatically, so a restrictive server configuration can never take your site offline.
