=== Two-Factor Authentication by PasswordGenerator.now ===
Contributors: passwordgeneratornow
Tags: two factor authentication, 2fa, totp, security, login security
Requires at least: 5.6
Tested up to: 6.7
Requires PHP: 7.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Add TOTP two-factor authentication to WordPress logins. Codes are verified on your own server - no API key, no external calls, no account needed.

== Description ==

A stolen or reused password is the most common way a WordPress site gets taken over. This plugin adds a second step to the login: after the password, WordPress asks for the 6-digit code from an authenticator app.

**Everything happens on your own server.** Code generation and verification use standard TOTP (RFC 6238) implemented in PHP. There is no API key to obtain, no account to create, and no request to any third party in the login path - including to us. If passwordgenerator.now disappeared tomorrow, your logins would be unaffected. That is a deliberate design decision: a site whose sign-ins depend on someone else's uptime is worse off than one with no 2FA at all.

= What you get =

* **Standard TOTP** - Works with Google Authenticator, Authy, 1Password, Microsoft Authenticator, Bitwarden, and any other RFC 6238 app.
* **QR enrollment** - Scan a code on your profile page. The QR is drawn in your browser, so the secret never travels anywhere.
* **Ten single-use backup codes** - Shown once at setup, stored only as hashes, regenerable at any time.
* **Encrypted secrets at rest** - Each TOTP seed is encrypted with a key derived from your site salts, so a database dump alone does not hand over working seeds.
* **Brute-force protection** - Five wrong codes trigger a 15-minute lockout, and a code cannot be replayed inside its 30-second window.
* **Role enforcement** - Optionally require 2FA for administrators, editors, or any other role.
* **Users list column** - See at a glance who has 2FA enabled.

= Privacy =

This plugin sends no data anywhere. It does not phone home, collect telemetry, or contact any external service - there is no network request in the plugin at all. The optional credit link on the login screen is a plain HTML link with no tracking parameters, and can be switched off in Settings without changing any behaviour.

= Building something that is not WordPress? =

The free 2FA API at [passwordgenerator.now/2fa-api](https://passwordgenerator.now/2fa-api) offers secret generation, QR codes and verification over HTTP for other stacks.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`, or install the ZIP through **Plugins → Add New → Upload Plugin**.
2. Activate it through the **Plugins** menu.
3. Go to **Users → Profile**, scroll to **Two-Factor Authentication**, scan the QR code with your authenticator app, and enter a code to switch it on.
4. Save your backup codes - They are shown only once.
5. Optionally visit **Settings → Two-Factor Auth** to require 2FA for specific roles.

== Frequently Asked Questions ==

= Do I need an account or API key? =

No. The plugin is entirely self-contained and works offline.

= What happens if I lose my phone? =

Use one of the ten backup codes issued at setup, in place of the 6-digit code. Each works once. If you have lost both your phone and your codes, any administrator can disable 2FA on your account from the user edit screen; a site owner locked out entirely can remove the `_pgn_2fa_enabled` user meta row directly in the database, or deactivate the plugin over FTP/SSH.

= Does this work with the block editor, WooCommerce, or custom login pages? =

Yes. The plugin hooks the standard WordPress authentication flow, so anything that logs in through `wp-login.php` is covered.

= Will this lock out my REST API or XML-RPC integrations? =

No. Application passwords and XML-RPC are not intercepted, since those flows cannot present an interactive code prompt. Disable XML-RPC separately if you do not use it.

= Is the login form a single step or two? =

Two. You enter your password first; only after it is correct does WordPress ask for the code. The password check and the code check are never combined, and no session exists until both pass.

== Screenshots ==

1. The 2FA prompt shown after a correct password.
2. Enrollment on the user profile screen, with QR code and manual key.
3. Settings screen with role enforcement.

== Changelog ==

= 1.0.0 =
* Initial release: TOTP enrollment with QR codes, two-step login, backup codes, encrypted secrets at rest, lockout after repeated failures, replay protection, and per-role enforcement.

== Upgrade Notice ==

= 1.0.0 =
First release.
