Loqwall 2FA

Loqwall 2FA adds a secure second authentication step after the standard WordPress username/password login. After entering their credentials, users must verify their identity with a one-time code before gaining access.

Features

• Email OTP — a 6-digit code is sent to the user’s registered email address.
• Authenticator App (TOTP) — time-based codes compatible with Google Authenticator, Authy, Bitwarden, and any RFC 6238 app.
• Backup codes — 10 one-time recovery codes generated per user.
• Device trust — optionally remember a trusted device for up to 30 days.
• Role enforcement — admins can be required to use 2FA regardless of their personal preference.
• Per-user control — users enable and configure 2FA from their own profile page.
• Rate limiting — brute-force protection on OTP verification.
• Audit log — every authentication event is recorded in a private database table.
• No external dependencies — all cryptographic operations use PHP’s built-in functions. No Composer, no remote APIs.
• Developer-friendly — hooks and filters let you customise behaviour without modifying plugin files.

For Developers: Hooks & Filters

Filters

Loqwall_2FA_required_for_user

Runs on every login attempt. Return false to exempt a user, or true to force 2FA regardless of settings.

add_filter( 'Loqwall_2FA_required_for_user', function( $required, $user ) {
    // Exempt the user with ID 5 from 2FA.
    if ( 5 === $user->ID ) {
        return false;
    }
    return $required;
}, 10, 2 );

Loqwall_2FA_otp_email_message

Filters the email body before the OTP is sent. Receives the body string, the WP_User object, the plain-text 6-digit code, and a boolean indicating whether the email is HTML.

add_filter( 'Loqwall_2FA_otp_email_message', function( $body, $user, $code, $html_mode ) {
    // Append a custom footer to every OTP email.
    return $body . '<p>Need help? Contact support@example.com</p>';
}, 10, 4 );

Actions

Loqwall_2FA_verified

Fires immediately after a user successfully passes 2FA. Receives the user ID and the method used ('email', 'totp', or 'backup_code').

add_action( 'Loqwall_2FA_verified', function( $user_id, $method ) {
    // Log the successful verification to a custom audit system.
    my_audit_log( $user_id, 'login_verified', $method );
}, 10, 2 );

Loqwall_2FA_failed

Fires after each failed 2FA verification attempt. Receives the user ID and the method attempted.

add_action( 'Loqwall_2FA_failed', function( $user_id, $method ) {
    // Notify an admin after a failed attempt.
    wp_mail( get_option('admin_email'), 'Failed 2FA attempt', "User #$user_id failed via $method." );
}, 10, 2 );<h3>Third Party Libraries</h3>

This plugin bundles the following third-party library:

qrcodejs
* Author: Sangmin Shim (davidshimjs)
* License: MIT
* Source: https://github.com/davidshimjs/qrcodejs
* Files: assets/js/qrcode.min.js, assets/js/qrcode.js
* Purpose: Renders the QR code displayed during Authenticator App setup. Used entirely client-side; makes no external network requests.