Title: TFA for WP
Last modified: September 3, 2016

---

# TFA for WP

 *  [bobwyzguy](https://wordpress.org/support/users/bobwyzguy/)
 * (@bobwyzguy)
 * [9 years, 10 months ago](https://wordpress.org/support/topic/tfa-for-wp/)
 * Hardening and securing WordPress websites is one of my specialties. We have reported
   previously on three of the best WordPress security plugins, Sucuri, Bulletproof,
   and WordFence. I can tell you that each of these plug-ins performed admirably
   against the continuous barrage of brute force and password reset attacks that
   my sites have endured. Security appeared to be strong, but I wanted more.
 * I have been deploying two-factor authentication (TFA) everywhere I can, in order
   to overcome the inherent weakness of password only security. The Dark Web is 
   awash in stolen credentials, and I am sure mine are in the lists, too. I have
   been using Google Authenticator primarily, and have been pretty happy with it.
   Now, an attacker needs more than my password, they need my smartphone too, and
   if the attacker in in India or the Ukraine, that is not a likely scenario.
 * Could I add TFA to my WordPress site? Something that worked with Authenticator,
   too?
 * I found miniOrange 2-Factor, by Krishna Murari Vijay, of miniOrange. I set it
   up to work with Google Authenicator, but it can also provide two-factor via email
   verification, soft token, one time password (OTP) over SMS, QR code authentication
   via the miniOrange Authenticator smartphone app, Authy TFA, phone call verification,
   push notification to your phone, and security questions with knowledge based 
   answers (KBA). Somewhere in that extensive collection is a method that will work
   for you.
 * I have to say that it appears to be adding an extra layer of security, as my 
   WordFence alerts for brute force and reset exploits has decreased considerably.
   I am happy to give it a strong recommendation. All of my WordPress clients will
   be getting miniOrange 2-Factor added to the WordFence security we already have
   in place. If you own or manage a WordPress site, maybe you should add this too.

The topic ‘TFA for WP’ is closed to new replies.

 * ![](https://ps.w.org/miniorange-2-factor-authentication/assets/icon-256x256.gif?
   rev=2652528)
 * [miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)](https://wordpress.org/plugins/miniorange-2-factor-authentication/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/miniorange-2-factor-authentication/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/)
 * [Active Topics](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/miniorange-2-factor-authentication/reviews/)

 * 0 replies
 * 1 participant
 * Last reply from: [bobwyzguy](https://wordpress.org/support/users/bobwyzguy/)
 * Last activity: [9 years, 10 months ago](https://wordpress.org/support/topic/tfa-for-wp/)