Plugin profile · observed daily since 02 Aug 2026
WP 2FA – Two-factor authentication for WordPress
Active installs100,000+ rounded
Current authorMelapress
Owner changesNone while we have been watching
Last release25 days ago 14 Oct 2026
Support11 / 16 resolved, last 2 months
Releases on record43
Rating4.7 /5 · 184
Added to directory20 Mar 2020
Requires WP5.7
Requires PHP7.4
Version lag0 up to date
Tested up toWP 7.1.4 up to date
PluginsPedia reports published data and observable changes. It does not rate plugin quality or safety, infer intent, or make recommendations. These are observations rather than a verdict. How this works
Ownership
Held by Melapress throughout, with no change of ownership observed since daily tracking began on 02 Aug 2026.
Full observed history, including every field transition
Committing accounts
Read from the plugin’s public release log, so these predate this registry. A committing account is not an owner. Thirty accounts commit to WooCommerce and it has never changed hands.
| Account | Releases | First | Last |
|---|---|---|---|
| WPWhiteSecurity | 24 | 06 May 2020 | 14 Dec 2023 |
| melapress | 17 | 16 Jan 2024 | 24 Jul 2026 |
This registry did not observe a transfer; it read these names off a public log. Whether that reflects a change of ownership is not something the directory publishes.
Adoption
How widely the plugin is installed, and what the people running it think of it. WordPress.org rounds install figures to one significant digit, so they describe an order of magnitude rather than a headcount.
Very widely adopted: 100,000+ active installs. In the top tier of the directory by install count.
3,266 downloads a day over the last 7 days, falling 33% against the 7 days before. Downloads are counted exactly and without a ceiling, so they show movement the rounded install figure cannot.
11 Sep 2026peak 48,907/day31 Oct 2026
9 ratings left in the last 82 days, averaging 4.3 out of 5 against a lifetime average of 4.7 (1 of them one or two stars). Recent ratings are in line with the lifetime figure.
From recent reviews
What reviewers wrote on wordpress.org between 23 Jul 2026 and 15 Oct 2026: 10 reviews, counted by theme. Every count links to the reviews behind it.
Reviewers for WP 2FA talk mostly about the support team: 6 of 10 reviews credit staff with quick, patient help, from migration cleanup to tracing a theme conflict that hid the 2FA setup screen. 2 of 10 reviews single out the setup itself as simple, calling it a breeze to configure with a straightforward interface. 1 of 10 reviews highlight the plugin's range of 2FA methods, including passkey support and an enforcement option users cannot disable themselves. 1 of 10 reviews report the plugin broke their site's backend, leading them to remove it.
- 6 of 10 mention quick, patient, or helpful support. [1] [2] [3] [4] [5] [6]
- 2 of 10 describe setup or the interface as simple and easy. [1] [2]
- 1 of 10 highlight support for multiple 2FA methods, including passkeys. [1]
- 1 of 10 report the plugin broke their site's backend. [1]
Counted from the public review forum on 16 Oct 2026. The reviews are their authors’ own words and their own claims; the counts are ours.
Daily record
Every field we record, one column per observation. Fields that never moved are named once rather than repeated across every column. A row of identical numbers would be padding.
| Field | 18 Oct | 19 Oct | 20 Oct | 21 Oct | 22 Oct | 23 Oct | 24 Oct | 25 Oct | 26 Oct | 27 Oct | 28 Oct | 29 Oct | 30 Oct | 31 Oct |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Downloads that day | — | 2,069 | 5,071 | 4,756 | 5,885 | 8,251 | 4,734 | 1,729 | 1,705 | 3,895 | 3,314 | 3,037 | 6,416 | 2,769 |
| Ratings total | 183 | 183 | 183 | 183 | 183 | 184 | 184 | 184 | 184 | 184 | 184 | 184 | 184 | 184 |
| Support threads | 12 | 12 | 12 | 13 | 13 | 13 | 13 | 13 | 13 | 14 | 13 | 13 | 15 | 16 |
| Threads resolved | 9 | 9 | 9 | 9 | 9 | 9 | 9 | 9 | 9 | 9 | 8 | 8 | 11 | 11 |
Unchanged throughout: active installs (100,000+) · version (4.2.1)
91 days of observation, most recent 14 shown.
Maintenance
When it was last released, and how far its declared compatibility has drifted from current WordPress.
Added to directory6.5 years ago 20 Mar 2020
Requires WP5.7
Requires PHP7.4
Version lagcurrent
Is anyone still maintaining this?
- Last released 14 Oct 2026, 25 days ago.
- Declares compatibility with WordPress 7.1.4, which is current.
- 11 of 16 support threads answered in the last two months.
- The same account maintains 5 other plugins, 5 of which were updated in the last 90 days. the account is active.
A plugin that does one thing correctly may need no changes for years; a long gap is not, by itself, evidence of neglect.
History
Everything dated that this registry holds about the plugin, most recent first. Releases carry the author’s own release date; everything else is dated to when it was observed.
Entries marked from the release log predate this registry, and daily observation began 02 Aug 2026. They were read from the plugin’s public SVN history after the fact, not watched as they happened. Everything else was observed directly.
- 14 Oct 202625 days agoVersion 4.2.1 released
- 06 Oct 20261 month agoVersion 4.2.0 released
- 05 Oct 20261 month agoVersion 4.1.0 released
- 02 Aug 20263 months agoFirst observed by PluginsPediaDaily snapshots of this plugin’s directory record begin here. Everything above this line is observed; anything before it comes from fields the API itself reports.
- 07 Jul 20264 months agoVersion 4.0.0 releasedfrom the release logCommitted by melapress.
- 20 May 20266 months agoVersion 3.1.1.2 releasedfrom the release logCommitted by melapress.
- 18 Feb 20269 months agoVersion 3.1.1 releasedfrom the release logCommitted by melapress.
- 17 Dec 202511 months agoVersion 3.1.0 releasedfrom the release logCommitted by melapress.
- 04 Dec 202511 months agoVersion 3.0.1 releasedfrom the release logCommitted by melapress.
- 06 Nov 202512 months agoVersion 3.0.0 releasedfrom the release logCommitted by melapress.
- 11 Sep 202514 months agoVersion 2.9.3 releasedfrom the release logCommitted by melapress.
- 12 Aug 202515 months agoVersion 2.9.2 releasedfrom the release logCommitted by melapress.
- 01 Aug 202515 months agoVersion 2.9.1 releasedfrom the release logCommitted by melapress.
- 31 Jul 202515 months agoVersion 2.9.0 releasedfrom the release logCommitted by melapress.
- 02 Jul 202516 months agoVersion 2.8.0 releasedfrom the release logCommitted by melapress.
- 28 May 202517 months agoVersion 2.6.2 releasedfrom the release logCommitted by melapress.
- 06 May 20206.5 years ago28 earlier releasesfrom the release logBetween 06 May 2020 and 10 Jun 2024. Listed individually in the public release log rather than here.
- 20 Mar 20206.5 years agoAdded to the WordPress.org directoryReported by the plugin API as the date this plugin was added.
Media coverage
Writing about this plugin elsewhere, collected by this registry. The links go to the sources; what they claim is theirs.
- 08 Oct 2026 · CVE-2026-62142: WP 2FA CSRF (CVSS 8.8)Strix
- 01 Oct 2026 · WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code ReplayWPScan
- 17 Dec 2025 · WP 2FA version 3 release notesMelapress
What we know, and what we don’t
Everything on this page in one place, including the gaps, so that nothing here is mistaken for a clean bill of health.
What we know
- It has been held by Melapress for all 91 days we have observed it.
- It was last released 25 days ago (14 Oct 2026).
- Its author declares it tested up to WordPress 7.1.4, which is current.
- WordPress.org reports 100,000+ active installs.
- It carries 184 ratings, averaging 4.7 out of 5.
- 11 of 16 support threads in the last two months are marked resolved.
Every record on this site, this one included, works under the same limits. We read what WordPress.org publishes about a plugin, never the plugin’s own code, so nothing here says whether a plugin is well built or safe. Install counts reach us already rounded; a change smaller than a band step doesn’t show. We don’t track security advisories yet. For anything older than our first observation we rely on the plugin’s public release log, where one exists. What this registry can and cannot see
Similar plugins
Plugins that share this one’s tags and talk about the same things in their own descriptions. Distinctive tags count for far more than broad ones. Sharing hover means something, sharing woocommerce does not, and a plugin that never mentions the subject matter is left out however its author tagged it. Among close matches, more widely installed plugins are listed first. This is a grouping rather than a ranking of quality.
Two Factor Authentication
Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (Google Authenticator, Authy, etc.)
20,000+ installs4.4★ (77)updated 26 Oct 2026
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)
Free 2FA plugin for unlimited users with Passkey, Google Authenticator, Email/SMS OTP, Push Notification & passwordless login.
10,000+ installs4.5★ (385)updated 21 Oct 2026
far fewer installs
Two Factor (2FA) Authentication via Email
Enable one-click login with this WordPress Two-Factor Authentication (2FA) plugin, utilizing email for added security.
9,000+ installs5.0★ (4)updated 21 Oct 2026
far fewer installs
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
Easily improve site security with WordPress Hardening, Two-Factor Authentication (2FA), Login Protection, Vulnerability Detection and SSL certificate.
3,000,000+ installs4.9★ (8,869)updated 26 Oct 2026
30× the installs
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
WordPress login security with brute force protection, Two-factor authentication (2FA/MFA), firewall, IP/country blocking, and login monitoring
1,000,000+ installs4.8★ (1,488)updated 23 Sep 2026
10× the installs
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
Harden your site security with Login Security, Two-Factor Authentication (2FA), Vulnerability Scanner, Firewall, and more. Formerly iThemes Security.
700,000+ installs4.6★ (3,992)updated 14 Oct 2026
Grouped from the tags each author chose for their own plugin, so the grouping is only as good as those tags.
Reach out about this record
Corrections, missing context, or anything else about WP 2FA – Two-factor authentication for WordPress: a person reads every submission, and corrections get a reply within 5 business days.