=== 2FA (by ROBOTSTXT) ===
Contributors: robotstxt, javiercasares
Tags: security, two-factor authentication, login, otp
Requires at least: 5.6
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.6.4
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Security plugin that adds per-role two-factor authentication to the WordPress login flow.

== Description ==

2FA (by ROBOTSTXT) enforces two-factor authentication on the WordPress login screen. Administrators configure a per-role matrix that specifies exactly which verification methods are required for each role: email codes, authenticator apps (TOTP), or recovery codes.

After the username and password are validated, the login screen redirects to a dedicated verification step. The screen hides the username and password controls, prioritises authenticator apps when enabled, and offers links to switch between methods without restarting the login. Email users can request a fresh code from the same screen.

Users manage their preferences from their profile page. Every method starts unchecked until explicitly confirmed. Activating the authenticator app requires scanning the QR code and entering a valid six-digit code. Recovery codes must be saved and confirmed with one code before activation. Codes are shown in a two-column grid and automatically refresh when the batch is exhausted.

Administrators can remember successful verifications for a configurable duration — per login, daily, weekly, or every 28 days — and lock the schedule so all users follow the global setting. Device and IP fingerprints are stored securely to decide when a fresh challenge is needed.

Multisite is fully supported: network administrators can set and lock enforcement settings across all sites.

== Installation ==

1. Upload the `robotstxt-2fa` directory to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" menu in WordPress (or network-activate it for multisite).
3. Open the **2FA** top-level menu in the dashboard and configure which methods are required per role.
4. Users can set up their preferred methods from their profile page.

== Frequently Asked Questions ==

= Is this plugin production ready? =

Yes. Email codes, authenticator apps with on-site QR codes, and recovery codes are all available and tested.

= How do I enable the authenticator QR code? =

Install the optional QR library inside this plugin directory with `composer require bacon/bacon-qr-code:^3.0`. The plugin loads the Composer autoloader automatically when present.

= Can I enforce 2FA for specific roles only? =

Yes. The admin settings page shows a matrix of roles × methods. Check the methods you want to require for each role. Roles with no methods checked leave the choice to the user.

= What happens if a user loses all their verification methods? =

An administrator can edit the user's profile and generate a fresh batch of recovery codes, or disable the role enforcement temporarily while the user regains access.

= Is multisite supported? =

Yes. Activate the plugin at the network level. Network administrators can set and lock enforcement settings; per-site settings are overridden when network settings exist.

== Compatibility ==

* WordPress: 5.6 – 7.0
* PHP: 8.0 – 8.5
* MariaDB: 11.4 or newer

== Changelog ==

= 1.6.4 =

_Release date: 2026-09-11_

**Fixed**

* Compatibility with Restrict Content Pro's "Hijack Login URL" option: RCP's `login_url` filter made every `wp_login_url()` call return a membership page, so the 2FA verification redirect landed on a restricted page where the verification form cannot render, and the visitor was bounced to the registration page. Verification-stage URLs are now built from the canonical `wp-login.php`, mirroring WordPress core's URL construction before the filterable output. The "Back to login" link keeps the site-configured login URL.

= 1.6.3 =

_Release date: 2026-08-24_

**Changed**

* Manager detection now uses the ecosystem presence constant (`ROBOTSTXT_MANAGER_NOTICED`, defined by Manager 1.6.2+) with a fallback to the plugin-list scan for older Manager versions.

**Fixed**

* Compatibility with the ALTCHA Spam Protection plugin: when "Protect login" was enabled, submitting the 2FA verification code failed with "[ALTCHA] Sorry, your request could not be processed.". The ALTCHA interceptor is now disabled while the verification screen is shown; the first login step keeps its ALTCHA check.

= 1.6.2 =

_Release date: 2026-08-17_

**Added**

* Recommendation notice for the Manager (by ROBOTSTXT) plugin: when it is not installed and active, a dismissible notice appears on the Plugins screen and a permanent notice is shown on the plugin settings page, since updates are delivered through the Manager plugin.

**Changed**

* Updates are now handled by the Manager (by ROBOTSTXT) plugin. The bundled self-updater (`robotstxt-updater.php` and `update.json`) has been removed.
* Plugin and update URLs moved to `robotstxt.software`.
* Minimum WordPress version lowered from 6.4 to 5.6 after a full compatibility review (the code only requires WordPress 5.3+ functions, and WordPress 5.6 is the first release that runs on the required PHP 8.0).

= Previous versions =

For the full changelog see the [changelog](https://www.robotstxt.software/plugins/robotstxt-2fa/) page.

== Compliance ==

This plugin adheres to the following security measures and review protocols for each version:

* [WordPress Plugin Handbook](https://developer.wordpress.org/plugins/)
* [WordPress Plugin Security](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/)
* [WordPress APIs Security](https://developer.wordpress.org/apis/security/)
* [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards)
* [Plugin Check (PCP)](https://wordpress.org/plugins/plugin-check/)