Two Factor (2FA) Authentication via Email

變更記錄

1.9.11

• Fix: Login link tokens are now hex-encoded so firewalls/WAFs no longer mistakenly flag them as malicious and block the login link. Existing links remain valid until they expire.
• Fix: Miscellaneous Plugin Check fixes.

1.9.10

• Security hardening. Please update ASAP.
• New: XML-RPC logins are now blocked for accounts that have the “2FA for REST API” option enabled (matching the existing REST API behaviour). Accounts that have never set that option are unaffected.
• New: The standard wp_login action now fires when a user completes 2FA via the email link, so integrations that rely on it (last-login trackers, login-alert emails, activity logs) work correctly.
• Added child theme support for custom templates. ss88-2fa/login-email.php and ss88-2fa/2fa-page.php are now loaded from the child theme first, then the parent theme. Thanks @gstricklind!
• Added filters SS88_2FAVE_email_template and SS88_2FAVE_page_template so developers can load the templates from any location.
• Fix: The custom email template could fail to load if more than one 2FA email was sent in the same request.
• Compatibility: Tested up to WordPress 7.1.

1.9.9

• Please update ASAP. Security Fix: CVE-2025-13587
• Removal of logo on 2FA Login Screen

1.9.8

• Thank you for 10,000+ active installations! 🙂
• Fix: REST API authentication

1.9.7

• PHP Warning fix on new user

1.9.6

• Integrated Initialization Vector
• Canged Cipher to AES-256-CBC
• Added ‘pretty formatting’ when token decrption fails

1.9.5

• UX improvement: Refresh 2FA Page with countdown when user is sucessfully logged in

1.9.4

• Improved header_remove() function by only removing Set-Cookie

1.9.3

• A new constant has been integrated which can be added in wp-config.php to override individual user settings to force 2FA to be enabled for Contributors. Add SS88_2FAVE_ENABLE_CONTRIBUTORS to your wp-config.php i.e. define('SS88_2FAVE_ENABLE_CONTRIBUTORS', true);.

1.9.2

• Added PHP’s header_remove(); function upon logging in. Seems to solve 502 ad 503 issues, especially with GoDaddy.

1.9.1

• A new filter SS88_2FAVE_custom_redirect was added. You can now override the final URL where users are redirect to after sucessfully logging in. See example in FAQs.
• A new filter SS88_2FAVE_isEnabled was added. You can now override if 2FA is enabled. See example in FAQs.

1.9

• The REST API (by default) has 2FA enabled. There are now new settings to disable it on an individual user basis by using the user edit screen.
• A new constant SS88_2FAVE_API_DISABLE_ALL was added to completely disable the 2FA on the REST API.

1.8

• Added 1.7.1 to trunk in WP Plugin Directory for rollback compatibility
• We are now using $priority 1 on the wp_login hook
• Added theme/folder compatibility. As of v1.4 developers could add ss88-2fa-page.php to their theme directory. We now support an additional directory ss88-2fa i.e. wp-content/themes/xxx/ss88-2fa/2fa-page.php. v1.4 functionality will be removed in a future release in favor for the new directory ss88-2fa.
• Added support for advanced developers to use a custom 2FA email. You can now override the 2FA email by copying assets/html/login-email.php to your theme’s directory. Upload this file to wp-content/themes/xxx/ss88-2fa/login-email.php to customize it!

1.7.1

• A new constant has been integrated which can be added in wp-config.php to override individual user settings to force 2FA to be enabled for Subscribers. Add SS88_2FAVE_ENABLE_SUBSCRIBERS to your wp-config.php i.e. define('SS88_2FAVE_ENABLE_SUBSCRIBERS', true);.

1.7

• Localization integration

1.6.4

• Integration with the default Remember Me checkbox from WordPress

1.6.3

• Integration with Ultimate Member

1.6.2

• Removed accidental code forcing everyone who logged in to receive a 2FA screen

1.6.1

• Deactivation fatal error fix

1.6

• New Features:
• Wording changed when SMTP is not enabled.
• The plugin now sends an email to the site admin if the plugin is deactivated. The email can be overridden by defining the constant SS88_2FAVE_NOTIFICATION_EMAIL in wp-config.php i.e. define('SS88_2FAVE_NOTIFICATION_EMAIL', 'john@doe.com');
• Three new constants added which can be added in wp-config.php to override individual user settings to force 2FA to be enabled. They are: SS88_2FAVE_ENABLE_ALL (to enable for every single account), SS88_2FAVE_ENABLE_ADMINS (to enable only for Administrators), and SS88_2FAVE_ENABLE_EDITORS (to enable for Editors) i.e. define('SS88_2FAVE_ENABLE_ALL', true);.

1.5.2

• Replaced sanitize_url in favor of esc_url
• Added a new constant SS88_2FAVE_LINK_EXPIRES_MINUTES so that users can define their own link expiry time in minutes
• Added a JavaScript countdown timer to the login page

1.5.1

• Email content fix

1.5

• ‘Fancy’ emails
• Moving files into appropriate folders
• Re-order of security features when logging in

1.4

• Added PHP_INT_MAX to wp_login hook
• Added support for advanced developers to use a custom 2FA template. You can now override the 2FA page by copying assets/2fa-page.php to your theme’s directory. Upload this file to wp-content/themes/xxx/ss88-2fa-page.php to customize it!

1.3

• Fixed ‘dismiss’ link on notification
• Added support for SMTP Mailer check

1.2

• Added support link to plugin page

1.1

• Fix openssl key
• Fix echo’ing

1.0

• Initial release.