=== 2FA (by ROBOTSTXT) ===
Contributors: robotstxt
Tags: security, two-factor authentication, login, otp
Requires at least: 6.4
Tested up to: 7.0
Requires PHP: 8.0
Stable tag: 1.2.0
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Security plugin that adds per-role two-factor authentication to the WordPress login flow.

== Description ==

2FA (by ROBOTSTXT) enforces two-factor authentication on the WordPress login screen. Administrators configure a per-role matrix that specifies exactly which verification methods are required for each role: email codes, authenticator apps (TOTP), or recovery codes.

After the username and password are validated, the login screen redirects to a dedicated verification step. The screen hides the username and password controls, prioritises authenticator apps when enabled, and offers links to switch between methods without restarting the login. Email users can request a fresh code from the same screen.

Users manage their preferences from their profile page. Every method starts unchecked until explicitly confirmed. Activating the authenticator app requires scanning the QR code and entering a valid six-digit code. Recovery codes must be saved and confirmed with one code before activation. Codes are shown in a two-column grid and automatically refresh when the batch is exhausted.

Administrators can remember successful verifications for a configurable duration — per login, daily, weekly, or every 28 days — and lock the schedule so all users follow the global setting. Device and IP fingerprints are stored securely to decide when a fresh challenge is needed.

Multisite is fully supported: network administrators can set and lock enforcement settings across all sites.

== Installation ==

1. Upload the `robotstxt-2fa` directory to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" menu in WordPress (or network-activate it for multisite).
3. Open the **2FA** top-level menu in the dashboard and configure which methods are required per role.
4. Users can set up their preferred methods from their profile page.

== Frequently Asked Questions ==

= Is this plugin production ready? =

Yes. Email codes, authenticator apps with on-site QR codes, and recovery codes are all available and tested.

= How do I enable the authenticator QR code? =

Install the optional QR library inside this plugin directory with `composer require bacon/bacon-qr-code:^3.0`. The plugin loads the Composer autoloader automatically when present.

= Can I enforce 2FA for specific roles only? =

Yes. The admin settings page shows a matrix of roles × methods. Check the methods you want to require for each role. Roles with no methods checked leave the choice to the user.

= What happens if a user loses all their verification methods? =

An administrator can edit the user's profile and generate a fresh batch of recovery codes, or disable the role enforcement temporarily while the user regains access.

= Is multisite supported? =

Yes. Activate the plugin at the network level. Network administrators can set and lock enforcement settings; per-site settings are overridden when network settings exist.

== Compatibility ==

* WordPress: 6.4 – 7.0
* PHP: 8.0 – 8.5
* MariaDB: 11.4 or newer

== Changelog ==

= 1.1.0 =

_Release date: 2026-06-05_

* Added `[robotstxt_2fa_profile]` shortcode for frontend 2FA management without wp-admin.
* Added developer action/filter hooks: `robotstxt_2fa_skip_challenge`, `robotstxt_2fa_verification_success`, `robotstxt_2fa_verification_failed`, `robotstxt_2fa_code_length`, `robotstxt_2fa_code_ttl`, and more.
* Added "Regenerate codes" button on the profile when recovery codes are active.
* Added top-up mode for recovery codes: generates only the missing codes to refill the batch.

= 1.0.0 =

_Release date: 2026-06-05_

* Fixed: Enable 2FA checkbox now defaults to email method on first activation.
* Fixed: QR code now renders correctly (data URI was stripped by esc_url).
* Fixed: Resend link shows a 60-second live countdown to prevent email flooding.
* Changed: Recovery codes section redesigned — plain list, no green notice box.
* Changed: 2FA login links now a vertical list instead of inline bullets.
* Removed: Redundant "Generate new secret" button from OTP section.

= 0.3.0 =

_Release date: 2026-06-05_

* Added delete-on-uninstall option (data preserved by default per AGENTS.md).
* Security: email verification codes now use `random_int()` (CSPRNG) instead of `wp_rand()`.
* Security: recovery code preview transient now expires after 5 minutes.
* Fixed network admin settings page form submission.
* Fixed settings option set to `autoload=false` (not needed on every page load).

= 0.2.0 =

_Release date: 2026-06-05_

* Added per-role 2FA method matrix in admin settings with select-all row and column controls.
* Added authenticator app (TOTP) support with QR provisioning and manual setup key.
* Added recovery codes: 10 single-use 8-digit codes with confirmation workflow.
* Added configurable verification frequency remembered per device.
* Added network-wide multisite support.
* Changed profile method checkboxes to require explicit confirmation before activation.
* Fixed recovery-code preview persistence and QR generation error handling.

= 0.1.0 =

Initial release.

= Previous versions =

For the full changelog see the [changelog.txt](https://git.robotstxt.es/ROBOTSTXT/robotstxt-2fa/raw/branch/main/changelog.txt) file.

== Compliance ==

This plugin adheres to the following security measures and review protocols for each version:

* [WordPress Plugin Handbook](https://developer.wordpress.org/plugins/)
* [WordPress Plugin Security](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/)
* [WordPress APIs Security](https://developer.wordpress.org/apis/security/)
* [WordPress Coding Standards](https://github.com/WordPress/WordPress-Coding-Standards)
* [Plugin Check (PCP)](https://wordpress.org/plugins/plugin-check/)