Title: Digipacket Login Security with Two-Factor Authentication Author: digipacket Published: June 20, 2026 Last modified: June 20, 2026 --- Search plugins ![](https://ps.w.org/digipacket-login-security/assets/banner-772x250.png?rev=3580152) ![](https://ps.w.org/digipacket-login-security/assets/icon-256x256.png?rev=3580152) # Digipacket Login Security with Two-Factor Authentication By [digipacket](https://profiles.wordpress.org/digipacket/) [Download](https://downloads.wordpress.org/plugin/digipacket-login-security.1.0.1.zip) * [Details](https://wordpress.org/plugins/digipacket-login-security/#description) * [Reviews](https://wordpress.org/plugins/digipacket-login-security/#reviews) * [Installation](https://wordpress.org/plugins/digipacket-login-security/#installation) * [Development](https://wordpress.org/plugins/digipacket-login-security/#developers) [Support](https://wordpress.org/support/plugin/digipacket-login-security/) ## Description Digipacket Login Security adds strong, standards-based two-factor authentication to any WordPress site. It uses the TOTP algorithm (RFC 6238), so it works with Google Authenticator, Authy, Microsoft Authenticator, FreeOTP and any standard authenticator app — with **no external service or cloud dependency**. Everything runs on your own server. #### Key features * **TOTP** compatible with Google Authenticator and all standard apps. * **Choice of method** — each user picks an authenticator app (TOTP) or a one-time code sent by e-mail at login. * **QR Code enrolment** rendered locally on the user profile screen (no external image service). * **Mandatory code verification** after every login. * **Single-use backup codes** for account recovery if the device is lost. * **Brute-force protection** — lock an account after a configurable number of failed attempts, for a configurable duration. Blocks further sign-ins even with the correct password during the lockout window. * **Security e-mail alerts** — notify the account owner when repeated wrong-password attempts or too many incorrect 2FA codes are detected. * **Login notifications** — e-mail the user and/or the administrator (per selected roles) with sign-in details (user, date, IP, browser). * **Login screen warning** — optional full-screen security notice that visitors must accept before signing in. * **Enforce 2FA by role** with a configurable grace period. * **Admin reset** of a user’s 2FA from the Users list, plus a 2FA status column. * **Audit log** of all security events with filtering by role or user. * **Modern admin interface** — dashboard, focused settings tabs and an About page. * **Translatable** — ships with French (fr_FR) and English. #### Privacy & external services By default, Digipacket Login Security does not send any data to external services. All secrets, codes and logs are stored in your own WordPress database, and e-mails are sent through your site’s standard `wp_mail()` function. Optional Telegram notifications (disabled by default): if you enable them and provide your own bot token and chat ID, the plugin sends security-event details (event type, username, IP address, date) to the Telegram Bot API at https://api.telegram.org so the message can be delivered to your chosen Telegram chat. This only happens while the feature is enabled and configured. * Telegram Bot API: https://core.telegram.org/bots/api * Telegram Privacy Policy: https://telegram.org/privacy ## Screenshots [⌊Security dashboard with 2FA adoption statistics.⌉⌊Security dashboard with 2FA adoption statistics.⌉[ Security dashboard with 2FA adoption statistics. [⌊Access Policy settings — enforce 2FA by role and configure brute-force lockout.⌉⌊ Access Policy settings — enforce 2FA by role and configure brute-force lockout.⌉[ Access Policy settings — enforce 2FA by role and configure brute-force lockout. [⌊Notifications settings — security alerts and login notifications.⌉⌊Notifications settings — security alerts and login notifications.⌉[ Notifications settings — security alerts and login notifications. [⌊Audit log with filtering by role or user.⌉⌊Audit log with filtering by role or user.⌉[ Audit log with filtering by role or user. [⌊Two-factor enrolment on the user profile screen.⌉⌊Two-factor enrolment on the user profile screen.⌉[ Two-factor enrolment on the user profile screen. ## Installation 1. In WordPress, go to **Plugins Add New Upload Plugin**. 2. Select `digipacket-login-security.zip`, click **Install Now**, then **Activate**. 3. Go to **Users Profile** and enable 2FA on your own account first. 4. Configure site-wide options under **Digipacket Login Security** in the admin menu. Manual installation: copy the `digipacket-login-security` folder into `wp-content/ plugins/` and activate it from the Plugins screen. ## FAQ ### Which authenticator apps are supported? Any standard TOTP (RFC 6238) app: Google Authenticator, Authy, Microsoft Authenticator, FreeOTP, 1Password, and more. ### Does it work without sending data to a third party? Yes. Core 2FA has no external service or cloud dependency — the QR code is generated locally and all data stays on your server. The only optional exception is Telegram notifications, which are disabled by default and only contact api.telegram.org when you enable them with your own bot token (see Privacy & external services). ### A user is locked out. How do I help them? Administrators can reset a user’s 2FA from the Users list (the “Reset 2FA” row action), allowing them to enrol again. ### My notification e-mails land in spam. This is a mail-deliverability matter, not a plugin issue. Configure an SMTP plugin and set up SPF/DKIM/DMARC for your domain so messages are authenticated. ### Does 2FA apply to REST API / XML-RPC / Application Passwords? The interactive second factor applies to the browser login form. Non-interactive API authentication intentionally bypasses it — use Application Passwords for programmatic access. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Digipacket Login Security with Two-Factor Authentication” is open source software. The following people have contributed to this plugin. Contributors * [ digipacket ](https://profiles.wordpress.org/digipacket/) [Translate “Digipacket Login Security with Two-Factor Authentication” into your language.](https://translate.wordpress.org/projects/wp-plugins/digipacket-login-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/digipacket-login-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/digipacket-login-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/digipacket-login-security/) by [RSS](https://plugins.trac.wordpress.org/log/digipacket-login-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Fix: on a fresh install, the very first time the settings were saved the values were silently discarded (roles, brute-force options, Telegram token, etc.). Settings now save correctly from the first save. #### 1.0.0 * Initial public release. * TOTP two-factor authentication (RFC 6238) compatible with Google Authenticator and all standard apps, plus an e-mail one-time-code method. * Local QR-code enrolment and single-use backup codes. * Enforce 2FA by role with a configurable grace period. * Configurable brute-force lockout (number of attempts and duration) with real sign-in enforcement. * Security e-mail alerts for repeated wrong-password attempts and 2FA lockouts. * Login notifications with sign-in details (user, date, IP, browser), scoped by role, to the user and/or administrator. * Optional login-screen security warning popup with a customizable message. * Audit log of security events with filtering by role or user. * Admin Dashboard “Security Overview” widget. * Reset 2FA and Ban / Unban actions from the Users list, with status badges. * Optional Telegram notifications for audit-log events, scoped by role/user, with one-click logout/ban response links. ## Meta * Version **1.0.1** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.0** * PHP version ** 8.2 or higher ** * Tags * [2FA](https://wordpress.org/plugins/tags/2fa/)[Brute Force](https://wordpress.org/plugins/tags/brute-force/) [login security](https://wordpress.org/plugins/tags/login-security/)[totp](https://wordpress.org/plugins/tags/totp/) [two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://wordpress.org/plugins/digipacket-login-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/digipacket-login-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/digipacket-login-security/reviews/) ## Contributors * [ digipacket ](https://profiles.wordpress.org/digipacket/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/digipacket-login-security/)