FactorGuard – Two-Factor Authentication

FactorGuard hooks into the default WordPress login page at /wp-login.php . For custom login forms, developers can use the factorguard_bypass filter to control the behavior programmatically.

No. The plugin automatically detects API requests and skips OTP verification for them. Application passwords and other API authentication methods continue to work normally.

If the email fails to send, the user will see an error message and can try logging in again to trigger a new email. Check your WordPress email delivery settings if this persists.

No. FactorGuard does not contact a FactorGuard server or any third-party API during normal operation. Email delivery is handled by your WordPress site’s configured mail system.

Verify that your administrator account can complete login with the selected method, confirm that WordPress email delivery works, and generate backup codes from your WordPress profile.

After an administrator enables Authenticator App support under Settings > FactorGuard, each user can enroll from their WordPress profile page. The profile screen shows the QR code, manual setup key, confirmation field, and backup-code controls.

Yes. Use the factorguard_user_can_bypass filter. Example: add_filter( 'factorguard_user_can_bypass', '__return_true' ); to bypass for all users, or check user roles/capabilities in your callback.

No. FactorGuard does not handle file uploads or multipart request bodies, does not execute shell/system commands (PHP exec, shell_exec, system, passthru, proc_open), and does not unserialize untrusted data. Its only outbound communication is the email your site sends via wp_mail(). Vulnerabilities in the PHP runtime itself (such as PHP2Shell, CVE-2026-109618 / CVE-2026-109619) are fixed by updating the server’s PHP to 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, not by plugins.

TOTP setup requires the PHP libsodium extension so FactorGuard can encrypt authenticator app secrets at rest. FactorGuard will not create new authenticator app enrollments if secrets cannot be encrypted. QR codes are generated locally using bundled libraries, and no external QR code API is needed.