=== 2FA (by ROBOTSTXT) ===
Contributors: robotstxt
Tags: security, two-factor authentication, login, otp
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.5.2
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Security plugin that adds per-role two-factor authentication to the WordPress login flow.

== Description ==

2FA (by ROBOTSTXT) enforces two-factor authentication on the WordPress login screen. Administrators configure a per-role matrix that specifies exactly which verification methods are required for each role: email codes, authenticator apps (TOTP), or recovery codes.

After the username and password are validated, the login screen redirects to a dedicated verification step. The screen hides the username and password controls, prioritises authenticator apps when enabled, and offers links to switch between methods without restarting the login. Email users can request a fresh code from the same screen.

Users manage their preferences from their profile page. Every method starts unchecked until explicitly confirmed. Activating the authenticator app requires scanning the QR code and entering a valid six-digit code. Recovery codes must be saved and confirmed with one code before activation. Codes are shown in a two-column grid and automatically refresh when the batch is exhausted.

Administrators can remember successful verifications for a configurable duration — per login, daily, weekly, or every 28 days — and lock the schedule so all users follow the global setting. Device and IP fingerprints are stored securely to decide when a fresh challenge is needed.

Multisite is fully supported: network administrators can set and lock enforcement settings across all sites.

== Installation ==

1. Upload the `robotstxt-2fa` directory to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" menu in WordPress (or network-activate it for multisite).
3. Open the **2FA** top-level menu in the dashboard and configure which methods are required per role.
4. Users can set up their preferred methods from their profile page.

== Frequently Asked Questions ==

= Is this plugin production ready? =

Yes. Email codes, authenticator apps with on-site QR codes, and recovery codes are all available and tested.

= How do I enable the authenticator QR code? =

Install the optional QR library inside this plugin directory with `composer require bacon/bacon-qr-code:^3.0`. The plugin loads the Composer autoloader automatically when present.

= Can I enforce 2FA for specific roles only? =

Yes. The admin settings page shows a matrix of roles × methods. Check the methods you want to require for each role. Roles with no methods checked leave the choice to the user.

= What happens if a user loses all their verification methods? =

An administrator can edit the user's profile and generate a fresh batch of recovery codes, or disable the role enforcement temporarily while the user regains access.

= Is multisite supported? =

Yes. Activate the plugin at the network level. Network administrators can set and lock enforcement settings; per-site settings are overridden when network settings exist.

== Compatibility ==

* WordPress: 6.4 – 7.0
* PHP: 8.0 – 8.5
* MariaDB: 11.4 or newer

== Changelog ==

= 1.5.2 =

_Release date: 2026-06-06_

**Added**

* OTP secret import tool (2FA > Import) — detects authenticator app secrets from three supported plugins and lets administrators import them with one click, without users needing to reconfigure their authenticator app:
  * **Two Factor** (community plugin) — reads `_two_factor_totp_key` user meta (plain Base32, direct import).
  * **WP 2FA** (Melapress) — reads `wp_2fa_totp_key` user meta; decrypts if WP 2FA is still active, imports plain-text secrets otherwise.
  * **Wordfence Login Security** — reads from the `wfls_2fa_secrets` database table (raw binary, Base32-encoded on import).
* Import skips users who already have OTP actively configured in our plugin.
* Admin notice banner when importable secrets are detected — shows count and link to import tool; dismissible per-admin for 7 days or permanently via a setting on the Import page.

**Fixed**

* Deactivating the Authenticator App from the profile no longer immediately pre-generates a new OTP secret. The secret is now deleted cleanly, and a fresh QR code is generated lazily on the next profile view.

= 1.5.1 =

_Release date: 2026-06-06_

**Security**

* CSV exports (dashboard and WP-CLI) now use RFC 4180 encoding instead of `addslashes()` — fields with commas, double-quotes, or newlines are correctly quoted.
* GeoIP database path validated at read time with `is_file()` and `! is_link()` to prevent symlink traversal.
* `robotstxt_2fa_app_password_verification_window` filter return value validated as a positive integer before use.

**Fixed**

* Export CSV button is now only rendered to users with `manage_options` capability.

= 1.5.0 =

_Release date: 2026-06-05_

**Added**

* Full audit user table — WP_List_Table with sortable columns (user, last verified), role and status filters, and one-click CSV export.
* GeoIP country restrictions — optional MaxMind GeoLite2 integration: per-country allow list (bypass 2FA), deny list (block login), always-challenge list (override frequency). Disabled when no database file is configured.
* Require 2FA before creating Application Passwords — REST endpoint rejects requests unless 2FA was completed within the last 15 minutes (configurable via `robotstxt_2fa_app_password_verification_window` filter).
* WP-CLI `wp 2fa export` — outputs a full CSV report.
* New developer filter `robotstxt_2fa_force_challenge` — override frequency-based skip and always require a fresh challenge.

**Fixed**

* Email digest cron now correctly reschedules when the frequency is changed between weekly and monthly.

= 1.4.0 =

_Release date: 2026-06-05_

**Added**

* Audit Dashboard — top-level admin page with three summary cards (total users, 2FA-enabled count, recent failed attempts), a recent failed attempts table, and a 2FA status column in the Users list.
* Email notifications — four configurable event types: admin-enabled 2FA, login from unrecognised browser/IP, recovery code used (with optional admin copy), and a weekly or monthly activity digest for administrators.
* Application Passwords exemption — REST API and WP-CLI clients authenticated via Application Passwords skip the 2FA browser challenge by default. Configurable in Settings → Access control.
* IP allow list — IPs and CIDR ranges that bypass the 2FA challenge entirely (e.g. office networks).
* IP deny list — IPs and CIDR ranges that are blocked from logging in altogether.
* All IP matching supports both IPv4 and IPv6 CIDR notation.

= Previous versions =

For the full changelog see the [changelog.txt](https://git.robotstxt.es/ROBOTSTXT/robotstxt-2fa/raw/branch/main/changelog.txt) file.

== Compliance ==

This plugin adheres to the following security measures and review protocols for each version:

* [WordPress Plugin Handbook](https://developer.wordpress.org/plugins/)
* [WordPress Plugin Security](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/)
* [WordPress APIs Security](https://developer.wordpress.org/apis/security/)
* [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards)
* [Plugin Check (PCP)](https://wordpress.org/plugins/plugin-check/)