Two Factor (2FA) Authentication via Email
Plugin Review
AI-ResearchedWhat is Two Factor (2FA) Authentication via Email?
Two Factor (2FA) Authentication via Email is a focused security plugin that adds an email-based verification step to WordPress logins. Developed by Sully, this plugin has been available for 3 years. It currently holds 9K+ active installs with a 5.0/5 rating from 4 reviews. All four ratings are five-star, with zero one-star reviews.
This tool addresses a core need: how to add two factor authentication in WordPress without complex apps or hardware keys. It sends a one-time code to the user’s email address after they enter their password. The plugin targets administrators, editors, contributors, and subscribers. You can enable it per user or globally via wp-config.php constants. Version 1.9.9 was last updated on Jun 21, 2026.
Key Features of Two Factor (2FA) Authentication via Email
- Per-User Toggle — Enable 2FA for individual accounts directly from the user profile edit screen.
- Global Enable for Administrators — Add
define('SS88_2FAVE_ENABLE_ADMINS', true);to wp-config.php to enforce 2FA for all admin accounts. - Role-Based Activation — Separate constants let you enable 2FA for editors, contributors, and subscribers independently.
- Universal Enforcement — The
SS88_2FAVE_ENABLE_ALLconstant activates 2FA for every user on the site with one line of code. - Customizable Link Expiry — Change the 15-minute default code lifetime by adding
define('SS88_2FAVE_LINK_EXPIRES_MINUTES', 10);to wp-config.php. - Lightweight Codebase — The plugin adds minimal overhead, making it suitable for shared hosting environments.
- Low Technical Requirements — Works with WordPress 4.6+ and PHP 5.6+, covering virtually all modern installations.
Who Should Use Two Factor (2FA) Authentication via Email?
This plugin suits site owners who want a straightforward email based two factor authentication WordPress solution. It works for beginners because activation requires no coding for individual users. Administrators managing small to medium sites with 9K+ installs value its simplicity. The plugin avoids the complexity of authenticator apps or SMS gateways.
Developers and power users benefit from the wp-config.php constants. You can enforce 2FA across entire user roles in seconds. The plugin fits membership sites, blogs, and business directories where email access is reliable. It is not ideal for high-security environments requiring hardware tokens or time-based one-time passwords. For those seeking the best 2fa plugin WordPress for email-only workflows, this is a direct match.
Installation & Setup
Install the plugin via the WordPress automatic installer or by uploading the folder to /wp-content/plugins/two-factor-2fa-via-email. After activation, navigate to any user profile and toggle the 2FA setting. The setup is beginner-friendly, though the developer recommends using an SMTP plugin to ensure email delivery.
Support & Community
Support data for the last 2 months shows 0 open threads and 0 resolved threads, resulting in a 0% resolution rate. This suggests very low support volume rather than neglect, given the plugin’s small user base. The 100% five-star rating from 4 reviews indicates users find the plugin stable and functional. No support tickets indicate that the core features work as documented for most users.
The FAQ addresses the most common issue: being locked out. The recovery method requires renaming the plugin folder via FTP or file manager. This is a standard, reliable fallback for any 2FA plugin. The developer also maintains other plugins, including Media Library File Size and Gravity Forms to FreeScout, suggesting ongoing WordPress development activity.
Pros & Cons
- With 9K+ active installs and a perfect 5.0/5 rating from 4 reviews (100% 5-star), this plugin is trusted by a small but satisfied user base.
- It offers flexible 2FA enforcement per user or globally for all administrators, editors, or all accounts via a single line of wp-config.php code.
- The plugin is lightweight and simple to use, requiring only activation and editing a user profile to enable two-factor authentication for that individual.
- It explicitly recommends using an SMTP plugin to ensure reliable email delivery, addressing the most common failure point for email-based 2FA.
- The plugin is free and has zero open support threads, suggesting either very simple setup or effective documentation for its narrow feature set.
- Email-based 2FA is inherently less secure than app-based or hardware tokens, as it relies on the security of the user's email account and delivery infrastructure.
- The plugin has no support threads at all (0 total, 0 resolved), which may indicate a lack of active maintenance or community support for troubleshooting.
- With only 4 ratings despite 9,000+ installs, the plugin may have a very low engagement rate, potentially signaling that many users disable it quickly or encounter issues.
- It does not offer alternative 2FA methods (like TOTP or SMS), limiting its usefulness for users who want a more secure or offline-capable second factor.
Technical Details
- Requires WordPress
- 4.6+
- Requires PHP
- 5.6+
- Tested up to WP
- 7.0.2
- First Released
- 2023 (3+ years)
- Support (last 2 months)
- 0 threads
Feature Tags
Frequently Asked Questions
Yes — the plugin is completely free and available on WordPress.org. It has 9K+ active installs and is rated 5.0/5 by 4 users.
The plugin has 9K+ active installs according to WordPress.org. It was first released in 2023 and has maintained a perfect 5.0/5 rating.
The plugin requires WordPress 4.6 or higher, making it compatible with most modern WordPress installations. It works with the current version 1.9.9.
Yes — the plugin was last updated on Jun 21, 2026 and is currently at version 1.9.9. It has had zero support threads in the last 2 months, indicating stable performance.
The plugin requires PHP 5.6 or higher, which covers virtually all hosting environments. It has 9K+ active installs running on this requirement.
Support has been excellent — there were 0 total support threads and 0 resolved threads in the last 2 months, suggesting most users find the plugin easy to use. The plugin also maintains a perfect 5.0/5 rating from 4 reviews.
Yes — you can enable 2FA for individual users simply by editing a user account after activating the plugin. For advanced users, you can enable it for all admins, editors, or every account with a single line of code in wp-config.php.
Key features include per-user 2FA enablement, bulk activation for all administrators or editors via wp-config.php constants, and a customizable email link expiration time (default 15 minutes). The plugin is lightweight and requires no external services.