Gupti 2FA

Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server — no third-party APIs, no account signup, no data leaves your site.

For users:

• Easy setup via QR code — scan and go, or enter the secret key manually.
• Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.
• 8 one-time recovery codes in case you lose your device.
• Verification code required when enabling, so you can never lock yourself out by mistake.
• Clean, distraction-free verification page at login.

For admins:

• Modern dashboard with 2FA coverage stats across your site.
• Role-based enforcement — require 2FA for administrators, editors, or any role.
• Optional grace period so enforced users get time to set up.
• Choose where users complete setup: right after login, or inside the dashboard.
• 2FA Status Report — see who has 2FA enabled and reset a user’s 2FA in one click.
• Login page branding — add your own logo to the verification pages.

Security hardening built in:

• TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site’s salts).
• Rate limiting on all verification steps — codes can’t be brute-forced.
• Replay protection — a used code is never accepted twice.
• Recovery codes are stored hashed and each works only once.
• QR codes are generated locally in pure PHP — nothing is sent to external services.
• No external fonts, scripts, or API calls anywhere.

Development

The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin’s app/ directory. To rebuild the compiled files in assets/dist/, run npm install followed by npm run build inside the app/ directory.