1. Home
  2. WordPress Plugin
  3. CM Secure Login Pro | Secure Two-Factor Authentication (2FA) WP Plugin
Secure Login and Two-Factor Authentication solution for WordPress

CM Secure Login Pro | Secure Two-Factor Authentication (2FA) WP Plugin

Secure Login and Two-Factor Authentication solution for WordPress main image

Provide two-factor authentication for your WordPress users via Google Authenticator, Mobile Phone SMS, and unique email code and email links.

Show more

This robust WordPress two-factor authentication plugin offers the best account security for your WordPress users

Choose a preferred method for each user or role

Show less

WordPress Two-Factor Authentication TFA Description

The password is the standard security implementation in the computer world. However, passwords can be guessed, hacked, or intercepted.

To combat these weaknesses you should install two-factor authentication methods, which provide a secret login key with one time passwords (OTP) that are not vulnerable to brute-force attacks.

Securing Users Accounts

Unlike passwords, two-factor authentication (2FA) is a two-step process that asks for an additional unique identification.

Examples are: sending OTP to your mobile phone, sending OTP to your email account, or by using an external service such as Google Authenticator

The Secure WordPress Login plugin from CreativeMinds offers a robust solution with multiple two-factor authentication methods.

It lets the WordPress administrator choose from four different options to secure their WordPress site login.

 The WordPress login screen which includes an additional step for email verification
The WordPress login screen which includes an additional step for email verification

Two-Factor Authentication Methods

The two-factor authentication (2FA) plugin from CreativeMinds can employ the following authentication methods:

  1. Google Authenticator – Require secret from Google’s secure app
  2. Mobile Phone SMS – Send a text message with a one-time key
  3. Email Code – Send a message with a one-time use code
  4. Email Link – Send a message with a one-time use link
  5. Email Code or SMS Code – Let the user a choice between sending a message with a one-time use code via email or SMS
Setting the Protection Method
Setting the Protection Method		 The WordPress Two-Factor Authentication plugin also lets the WordPress administrator define which user roles require two-factor login credentials. The admin can of course apply our enhanced security check for all users.

Google Authenticator

The Google Authenticator is a free application which can be used on iPhones or an Android-based smartphones.

It provides an extra security level for the login process.

The GA application constantly generates a one-time code which is valid for a short period of time.

The users has to enter that code in addition to his login and password in order to access his account.

 Example of OTP Codes in Google Authenticator App
Example of OTP Codes in Google Authenticator App

Limit Logins by Number of IPs and Devices

Login blocked from a new IP address
Login blocked from a new IP address		 Restrict how many IPs and/or devices can log in to each account and apply yet another security layer!

For example, only allow the admin to log in from a specific computer. If someone tries using another device or IP, the login won't work.

Learn how to use the feature.

Collecting Login Statistics

The plugin allows to collect statistics about all logins that were made using 2FA protection on your site.

The statistics dashboard shows the detailed information about the user, login method, device and browser info, user's IP address, status of the login and login attempt time. Login Statistics Dashboard
Login Statistics Dashboard

User and Admin Notifications

Each login protection method has it's own email template for notifying users, either it's a message about creating a GA secret for the user, or SMS & email verifications.

Notifying Users About New Security Feature
Notifying Users About New Security Feature		 Optionally, you can set additional email addresses which will receive a notification with login info (code or verification link) every time somebody tries to login.

And one more notification allows you to inform your users that you enabled new login security feature on your site.

Using One Time Passwords (OTP) and the User Registration Plugin

  • Improve WordPress site security – Add an additional unique level of security to each user account with a secret key, helping to block hackers, bots, malicious users and other unwanted intruders
  • Define which accounts need enhanced password security – Admin can define which account type needs OTP security access
  • Define 2FA Expiration time – Admin can define how long each verification option is valid until the user needs to generate a new one
  • Define time to logout – Admin can define how long each user can use their recent OTP login, in case they are not active for a defined amount of time

2FA Plugin Use Cases

  • Protect Admin Accounts – If your site has sensitive information, it’s a good idea to protect powerful user as much as possible. Add Google Authenticator as a secondary password and feel at ease
  • Only SMS – Allow users with the Subscriber role to log in only with the SMS link, so that they don’t have to remember and manage their passwords

WordPress Two-Factor Authentication Plugin Related Use Cases

WordPress Two-Factor Authentication Plugin Additional Resources

2FA-Related Blog Resources

WordPress Two Factor Authentication Features

2FA Methods

Google Authenticator – Require users to enter a unique code generated by their Google Authenticator app. Google uses Time-based One Time Passwords (TOTP) and HMAC-based One Time Passwords (HOTP) to protect your website. Learn more
Mobile Phone SMS – Send a SMS to users with the one-time password when they try to log in. The plugin uses the reliable Amazon SMS service (AWS SNS). Learn more
Email Verification – Send a unique link to the users’ email each time they try to log in. Learn more
Email Code – Send a unique code to the users’ email each time try to log in. Learn more

Control Access

Access by User – Set a different two-factor authentication method for each user
Access by Role – Define which user roles need enhanced 2FA. Require an extra layer of security for users who are prone to using a weak or common password
User Roles Manager – Easily create, duplicate and delete user roles. Edit basic user capabilities with a simple and user-friendly interface.
IP Limit – Define how many IP address each user role can use to log in. Learn more.
Device Number – Choose how many devices each user can use to log in. Learn more.
Override Password – Choose users who will only need the secondary authentication method. They won’t require a password

Utilities

Define Expiration – Define the duration of each code sent to the user Once expired, the user will need to generate a new code
Customize Notifications – All notifications, including SMS and email templates, can be easily customized
External Login Form – Add external login forms using a simple shortcode
Statistics – Collect statistics about all login attempts which were made with the enabled protection method
Labels – All frontend labels can easily be changed to any language so the user interface will speak your language

WordPress Two Step Authentication Related Plugins

CM Free Pass Plugins Suite
99+ Free Pass Plugins Suite
Upgrade your WordPress site with any of CM 90+ WordPress plugins and upcoming modules. Offer includes unlimited updates and expert support.
[ Video]  [ Userguide]
$249More InfoAdd to Cart
CM Registration Pro
Registration and Invitation Codes
This plugin adds a registration and login popup to your WordPress site. This plugin supports invitation codes, email verification, reCaptcha and more. Wordpress login and email registration uses Ajax for on page support.
[ Video]  [ Userguide]
$39More InfoAdd to Cart
CM FAQ
FAQ Knowledge Base and Widget
This plugin builds a frequently asked question (FAQ) knowledge base on your WordPress site. The plugin allows your WordPress users to search the frequently asked questions (FAQ) and vote for the best answers. Categorize frequently asked questions or create a FAQ forum for users.
[ Video]  [ Userguide]
$39More InfoAdd to Cart
CM Table of Contents Pro
Table of Contents
Add a table of contents to any page or post on your WordPress site. Define the different sections of the user-generated table of contents with any tag or CSS class included in the page or post content.
[ Video]  [ Userguide]
$29More InfoAdd to Cart
Export User Data
Export User Data
Export user data and meta data into comprehensive CSV or Excel files. Export users by role and registration date range and use filters to select the user data you need. All functionalities of the plugin are in a single, slick, screen.
[ Video]  [ Userguide]
$29More InfoAdd to Cart
CM WordPress HTTPS Pro
WordPress HTTPS SSL Plugin
Automatically redirect from HTTP to HTTPS. Generate a free SSL certificate from the trusted Let's Encrypt service and force your entire website to support SSL.
[ Video]  [ Userguide]
$29More InfoAdd to Cart

WordPress Two Factor Authentication Frequently Asked Questions

Does the SMS two factor authentication work in any country?

Yes. You can use it in any country which is covered by Amazon SNS service. You can see the list of countries here

Does the SMS two factor authentication cost money?

Yes. You need to sign up to Amazon SNS and choose your plan. More information about pricing for the SMS notifications can be found here

Does the two factor service cost additional money?

Out of the 4 available options Google Authenticator, Email link verification and email code are free for unlimited use. The only service which costs money is the Amazon SNS. Pricing for the SNS service can be found here

How to use the Google Authenticator authentication?

The Google Authenticator app can be downloaded to an iPhone or an Android

It’s a free app. Once installed, you need to do an initial setup and after the setup it will produce a unique code to login to the site. Learn how to use it on Install Google Authenticator – Android – Google Account Help

How can the SMS service send a text if I don't have the user's mobile phone number?

Once you activate the SNS service, a new user field is added to the user profile with the user’s mobile phone number. The first time the user logs in, the system sends them an email asking them to enter their mobile phone number. Once they do this, the information is saved in their user profile.

Can I set the 2FA to only work for admin users?

Sure. You can define that only users with admin roles have to use the two factor authentication. All other users will be logged in normally.

Can each user use a different 2FA method?

No, this is not supported. Once the admin sets the preferred 2FA method, all users which are included in the 2FA setting will be using the set method. The admin can change the method which will also require all users to use the new method.

Will it work with WooCommerce Form?

Yes. Since version 1.4.5 we have added support to include the 2FA method in the WooCommerce form.

Secure Login and Two-Factor Authentication Image Gallery

Back-end Gallery

Customer Reviews for the 2FA Plugin

We Accept All Major Credit Cards
Accepted payment methods include all Credit Cards and PayPal