| 1 |
=== Two Factor Authentication === |
| 2 |
Tags: auth, two factor auth, login, security, authenticate, password, security, woocommerce, google authenticator, authy, two factor, 2fa |
| 3 |
Requires at least: 3.2 |
| 4 |
Tested up to: 4.7 |
| 5 |
Stable tag: 1.2.16 |
| 6 |
Author: DavidAnderson |
| 7 |
Contributors: DavidAnderson, DNutbourne |
| 8 |
Donate link: http://david.dw-perspective.org.uk/donate |
| 9 |
License: GPLv2 or later |
| 10 |
License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 11 |
|
| 12 |
Secure WordPress login with Two Factor Authentication - supports WP, Woo + other login forms, HOTP, TOTP (Google Authenticator, Authy, etc.) |
| 13 |
|
| 14 |
== Description == |
| 15 |
|
| 16 |
Secure WordPress login with this two factor authentication (TFA) plugin. Users for whom it is enabled will require a one-time code in order to log in. From the authors of <a href="https://updraftplus.com/">UpdraftPlus - WP's #1 backup/restore plugin</a>, with over 700,000 active installs. |
| 17 |
|
| 18 |
Are you completely new to TFA? <a href="https://wordpress.org/plugins/two-factor-authentication/faq/">If so, please see our FAQ</a>. |
| 19 |
|
| 20 |
Features (please see the "Screenshots" for more information): |
| 21 |
|
| 22 |
* Supports standard TOTP + HOTP protocols (and so supports Google Authenticator, Authy, and many others). |
| 23 |
* Displays graphical QR codes for easy scanning into apps on your phone/tablet |
| 24 |
* TFA can be made available on a per-role basis (e.g. available for admins, but not for subscribers) |
| 25 |
* TFA can be turned on or off by each user |
| 26 |
* TFA can be required for specified user levels, after a defined time period (e.g. require all admins to have TFA, once their accounts are a week old) (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/">Premium version</a>) |
| 27 |
* Supports front-end editing of settings, via [twofactor_user_settings] shortcode (i.e. users don't need access to the WP dashboard). (The <a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/">Premium version</a> allows custom designing of any layout you wish). |
| 28 |
* Works together with "Theme My Login" (https://wordpress.org/plugins/theme-my-login/) (both forms and widgets) |
| 29 |
* Includes support for the WooCommerce and Affiliates-WP login forms |
| 30 |
* Does not mention or request second factor until the user has been identified as one with TFA enabled (i.e. nothing is shown to users who do not have it enabled) |
| 31 |
* WP Multisite compatible (plugin should be network activated) |
| 32 |
* Simplified user interface and code base for ease of use and performance |
| 33 |
* Added a number of extra security checks to the original forked code |
| 34 |
* Emergency codes for when you lose your phone/tablet (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/">Premium version</a>) |
| 35 |
* Administrators can access other users' codes, and turn them on/off when needed (<a href="https://www.simbahosting.co.uk/s3/product/two-factor-authentication/">Premium version</a>) |
| 36 |
|
| 37 |
= Why? = |
| 38 |
|
| 39 |
Read this! http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ |
| 40 |
|
| 41 |
= How Does It Work? = |
| 42 |
|
| 43 |
This plugin uses the industry standard algorithm [TOTP](https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm) or [HOTP](https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm) for creating One Time Passwords. These are used by Google Authenticator, Authy, and many other OTP applications that you can deploy on your phone etc. |
| 44 |
|
| 45 |
A TOTP code is valid for a certain time. Whatever program you use (i.e. Google Authenticator, etc.) will show a different code every so often. |
| 46 |
|
| 47 |
= Plugin Notes = |
| 48 |
|
| 49 |
This plugin began life as a friendly fork and enhancement of Oscar Hane's https://wordpress.org/plugins/two-factor-auth/ |
| 50 |
|
| 51 |
== Installation == |
| 52 |
|
| 53 |
This plugin requires PHP version 5.3 or higher and support for [PHP mcrypt](http://www.php.net/manual/en/mcrypt.installation.php). The vast majority of PHP setups will have these. If not, ask your hosting company. |
| 54 |
|
| 55 |
1. Search for 'Two Factor Authentication' in the 'Plugins' menu in WordPress. |
| 56 |
2. Click the 'Install' button. (Make sure you picks the right one) |
| 57 |
3. Activate the plugin through the 'Plugins' menu in WordPress |
| 58 |
4. Find site-wide settings in Settings -> Two Factor Authentication ; find your own user settings in the top-level menu entry "Two Factor Auth". |
| 59 |
|
| 60 |
If you want to add a section to the front-end of your site where users can configure their two-factor authentication settings, use this shortcode: [twofactor_user_settings] |
| 61 |
|
| 62 |
== Frequently Asked Questions == |
| 63 |
|
| 64 |
= What is two factor authentication? = |
| 65 |
|
| 66 |
Basically, it's to do with securing your logins, so that there's more than one link in the chain needing to be broken before an unwanted intruder can get in your website. |
| 67 |
|
| 68 |
By default, your WordPress accounts are protected by only one thing: your password. If that's broken, then everything's wide open. |
| 69 |
|
| 70 |
"Two factor" means adding a second requirement. Usually, this is a code that comes to a device you own (e.g. phone, tablet) - so, someone can't get into your website without getting hold of your device. <a href="https://en.wikipedia.org/wiki/Two_factor_authentication">You can get a longer answer from Wikipedia.</a> |
| 71 |
|
| 72 |
Sometimes it is also called multi-factor authentication instead of two-factor - because someone could secure their systems with as many factors as they like. |
| 73 |
|
| 74 |
= Why should I care? = |
| 75 |
|
| 76 |
Read this: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ |
| 77 |
|
| 78 |
= How does two factor authentication work? = |
| 79 |
|
| 80 |
Since "two factor authentication" just means "a second something is necessary to get in", this answer depends upon the particular set-up. In the most common case, a numeric code is shown on your phone, tablet or other device. This code be sent via an SMS; this then depends on the mobile phone network working. This plugin does not uses that method. Instead, it uses a standard mathematical algorithm to generate codes that are only valid once each, or for only for 30 seconds (depending on which algorithm you choose). Your phone or tablet can know the code after it has been set up once (often, by just scanning a bar-code off the screen). |
| 81 |
|
| 82 |
= What do I need to set up on my phone/tablet (etc.) in order to generate the codes? = |
| 83 |
|
| 84 |
This depends on your particular make of phone, and your preferences. Google have produced a popular app called "Google Authenticator", which is a preferred option for many people because it is easy to use and can be set up via just scanning a bar code off your screen - <a href="https://support.google.com/accounts/answer/1066447"> follow this link, and ignore the first paragraph that is talking about 2FA on your Google account</a> (rather than being relevant to this plugin). |
| 85 |
|
| 86 |
= What if I do not have a phone or tablet? = |
| 87 |
|
| 88 |
Many and various devices and programs can generate the codes. One option is an add-on for your web browser; for example, <a href="https://chrome.google.com/webstore/search/authenticator">here are some apps and add-ons for Google Chrome</a>. Wikipedia <a href="https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm#Client_implementations">lists various programs for different computers</a>. |
| 89 |
|
| 90 |
= I lost my device that has pass-codes - or, they don't work. What to do? = |
| 91 |
|
| 92 |
If your pass-code used to work, but no longer does, then check that the time on your device that generates them is accurate. |
| 93 |
|
| 94 |
If you cannot get in and need to disable two-factor authentication, then add this to your wp-config.php file, using FTP or the file manager in your hosting control panel: |
| 95 |
|
| 96 |
define('TWO_FACTOR_DISABLE', true); |
| 97 |
|
| 98 |
Add it next to where any other line beginning with "define" is. |
| 99 |
|
| 100 |
Alternatively, if you have FTP or cPanel access to your web hosting space, you can de-activate the plugin; see this article: https://updraftplus.com/understanding-wordpress-installs-plugins/ |
| 101 |
|
| 102 |
= What are HOTP and TOTP? = |
| 103 |
|
| 104 |
These are the names of the two mathematical algorithms that are used to create the special codes. These are industry-standard algorithms, devised by expert cryptographers. HOTP is less popular, but the device that generates the codes does not need to know the correct time (instead, the codes are generated in a precise sequence). TOTP is much more popular, and generates codes that are only valid for 30 seconds (and so your device needs to know the time). I'd recommend TOTP, as HOTP can be annoying if something causes the sequences to get out of sync. |
| 105 |
|
| 106 |
= What is the shortcode to use for front-end settings? = |
| 107 |
|
| 108 |
[twofactor_user_settings] |
| 109 |
|
| 110 |
== Screenshots == |
| 111 |
|
| 112 |
1. Site-wide settings |
| 113 |
|
| 114 |
2. User settings (dashboard) |
| 115 |
|
| 116 |
3. User settings (front-end, via shortcode) |
| 117 |
|
| 118 |
4. Regular WP login form requesting OTP code (after successful username/password entry) |
| 119 |
|
| 120 |
5. WooCommerce login form requesting OTP code (after successful username/password entry) |
| 121 |
|
| 122 |
6. What the user sees if opening a wrong OTP code on the regular WP login form |
| 123 |
|
| 124 |
7. What the user sees if opening a wrong OTP code on the WooCommerce login form |
| 125 |
|
| 126 |
8. Where to find the site-wide settings in the dashboard menu |
| 127 |
|
| 128 |
9. Where to find the user's personal settings in the dashboard menu |
| 129 |
|
| 130 |
10. Emergency codes (Premium version) |
| 131 |
|
| 132 |
11. Adjusting other users' settings as an admin (Premium version) |
| 133 |
|
| 134 |
12. Building your own design for the page with custom short-codes (Premium version) |
| 135 |
|
| 136 |
== Changelog == |
| 137 |
|
| 138 |
= 1.2.16 - 30/Jan/2016 = |
| 139 |
|
| 140 |
* FIX: Fix issue whereby if you were already logged in and managed to visit a login form, you would not be asked for a TFA code |
| 141 |
|
| 142 |
= 1.2.15 - 23/Jan/2017 = |
| 143 |
|
| 144 |
* FEATURE: Add support for login widgets from Theme My Login |
| 145 |
* UPDATER: (Premium version): update to the latest updater class, including the new ability to automatically update |
| 146 |
|
| 147 |
= 1.2.14 - 02/Jan/2017 = |
| 148 |
|
| 149 |
* TWEAK: Add missing internationalisation headers to the main plugin file |
| 150 |
|
| 151 |
= 1.2.13 - 31/Aug/2016 = |
| 152 |
|
| 153 |
* TWEAK: Internationalisation implementation was not previously compatible with wordpress.org's translation system |
| 154 |
|
| 155 |
= 1.2.12 - 20/May/2016 = |
| 156 |
|
| 157 |
* FEATURE: Compatibility with https://wordpress.org/plugins/use-administrator-password/ - when TFA is enabled on an account, the TFA credentials of the user whose password was supplied are allowed (and required) |
| 158 |
|
| 159 |
= 1.2.11 - 18/May/2016 = |
| 160 |
|
| 161 |
* TWEAK: Update bundled select2 to version 4.0.2 |
| 162 |
* FIX: If the [twofactor_user_qrcode] shortcode (Premium version) was used without other short-codes, then the code would not display |
| 163 |
|
| 164 |
= 1.2.10 - 31/Mar/2016 = |
| 165 |
|
| 166 |
* TWEAK: Prefer openssl, if present, to the deprecated mcrypt. Note that if you migrate a site from a server without openssl to a server without mcrypt, then because of mcrypt's non-compliant padding, you will need to either install php-mcrypt on the new server, or disable TFA (via define('TWO_FACTOR_DISABLE', true); in your wp-config.php) to allow users to be able to log in. This also applies if the source site did have openssl, but for users who hadn't logged in since installing this update. |
| 167 |
* TWEAK: Make the $simba_two_factor_authentication_premium object globally available |
| 168 |
* COMPATIBILITY: Mark as tested on WP 4.5 |
| 169 |
|
| 170 |
= 1.2.8 - 12/Dec/2015 = |
| 171 |
|
| 172 |
* FEATURE: Add support for the Affiliates-WP login form |
| 173 |
* TWEAK: Defeat WooCommerce loading an old version of the select2 script onto the TFA settings page, and breaking the user selector (should work this time) |
| 174 |
|
| 175 |
= 1.2.6 - 11/Nov/2015 = |
| 176 |
|
| 177 |
* TWEAK: Defeat WooCommerce loading an old version of the select2 script onto the TFA settings page, and breaking the user selector |
| 178 |
* TWEAK: Tested on WordPress 4.4 |
| 179 |
* TWEAK: Use h1 for heading style on admin page, not h2 |
| 180 |
* FIX: The "You'll need to use TFA to login in future" link for users for whom TFA is compulsory (Premium) was to the wrong page |
| 181 |
|
| 182 |
= 1.2.4 - 09/Nov/2015 = |
| 183 |
|
| 184 |
* TWEAK: Make window settings filterable |
| 185 |
|
| 186 |
= 1.2.3 - 19/Oct/2015 = |
| 187 |
|
| 188 |
* FIX: Fix bug in 1.2.2 that could lock out users without TFA settings |
| 189 |
|
| 190 |
= 1.2.2 - 16/Oct/2015 = |
| 191 |
|
| 192 |
* TWEAK: Display dashboard notice if TWO_FACTOR_DISABLE is defined in wp-config.php, to prevent time wasted wondering why nothing is happening |
| 193 |
|
| 194 |
= 1.2.1 - 08/Oct/2015 = |
| 195 |
|
| 196 |
* FEATURE: (Premium version) - Require users (of configured roles) to use TFA (optionally after a configurable amount of time) |
| 197 |
|
| 198 |
= 1.1.21 - 25/Aug/2015 = |
| 199 |
|
| 200 |
* TRANSLATIONS: Translation files can now be used (translators welcome!) |
| 201 |
* TRANSLATION: Swedish translation added, courtesy of Bo Sving |
| 202 |
|
| 203 |
= 1.1.19 - 20/Aug/2015 = |
| 204 |
|
| 205 |
* TWEAK: Remove a pointless nonce check |
| 206 |
|
| 207 |
= 1.1.18 - 01/Aug/2015 = |
| 208 |
|
| 209 |
* COMPATIBILITY: Tested with WP 4.3 (RC1) and WooCommerce 2.4 (RC1) - no issues found (i.e. previous releases believed to be already compatible) |
| 210 |
* FIX: When the admin is showing codes for other users, QR codes were not displaying correctly since 1.1.13 |
| 211 |
|
| 212 |
= 1.1.17 - 22/May/2015 = |
| 213 |
|
| 214 |
* TWEAK: Introduce convenience method for developers wanting to verify that TFA is active (Premium) |
| 215 |
* FIX: Fix operation of [twofactor_conditional] shortcode (Premium) |
| 216 |
* FIX: Fix fatal error introduced in convenience method in 1.1.16 |
| 217 |
|
| 218 |
= 1.1.15 - 13/May/2015 = |
| 219 |
|
| 220 |
* FIX: Fix conflict with 'reset password' form with "Theme My Login" plugin |
| 221 |
|
| 222 |
= 1.1.14 - 12/May/2015 = |
| 223 |
|
| 224 |
* FIX: Add TFA support to the WooCommerce login-on-checkout form (previously, TFA-enabled users could not log in using it) |
| 225 |
|
| 226 |
= 1.1.13 - 11/May/2015 = |
| 227 |
|
| 228 |
* TWEAK: Use jquery-qrcode to generate QR codes, replacing external dependency on Google |
| 229 |
* TWEAK: Update bundled select2 library to 4.0.0 release (was rc2) |
| 230 |
|
| 231 |
= 1.1.12 - 22/Apr/2015 = |
| 232 |
|
| 233 |
* FIX: Fix corner-case where the user's login looked like an email address, but wasn't the account address. In this case, a OTP password was always requested. |
| 234 |
* FIX: When the username does not exist, front-end should not request TFA code. |
| 235 |
|
| 236 |
= 1.1.11 - 21/Apr/2015 = |
| 237 |
|
| 238 |
* TWEAK: Prevent PHP notice if combining with bbPress |
| 239 |
* TWEAK: Added more console logging if TFA AJAX request fails |
| 240 |
* TWEAK: Add some measures to overcome extraneous PHP output breaking the AJAX conversation (e.g. when using strict debugging) |
| 241 |
|
| 242 |
= 1.1.10 - 20/Apr/2015 = |
| 243 |
|
| 244 |
* SECURITY: Fix possible non-persistent XSS issue in admin area (https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html) |
| 245 |
* FIX: Don't get involved on "lost password" forms (intermittent issue with "Theme My Login") |
| 246 |
|
| 247 |
= 1.1.9 - 15/Apr/2015 = |
| 248 |
|
| 249 |
* TESTING: Tested with "Theme My Login" - http://wordpress.org/plugins/theme-my-login/ - no issues |
| 250 |
* TWEAK: Do a little bit of status logging to the browser's developer console on login forms, to help debugging any issues |
| 251 |
* TWEAK: Add a spinner on login forms whilst TFA status is being checked (WP 3.8+) |
| 252 |
* TWEAK: Make sure that scripts are versionned, to prevent updates not being immediately effective |
| 253 |
* TWEAK: Make sure OTP field on WooCommerce login form receives focus automatically |
| 254 |
|
| 255 |
= 1.1.8 - 14/Apr/2015 = |
| 256 |
|
| 257 |
* FIX: Fix an issue on sites that forced SSL access to admin area, but not to front-end, whereby AJAX functions could fail (e.g. showing latest code) |
| 258 |
* FIX: Version number was not shown correctly in admin screen since 1.1.5 |
| 259 |
* TWEAK: Show proper plugin URI |
| 260 |
|
| 261 |
= 1.1.7 - 10/Apr/2015 = |
| 262 |
|
| 263 |
* FIX: Fix plugin compatibility with PHP 5.6 |
| 264 |
* FIX: TFA was always made active on XMLRPC, even when the user turned it off |
| 265 |
|
| 266 |
= 1.1.6 - 09/Apr/2015 = |
| 267 |
|
| 268 |
* TWEAK: Change various wordings to make things clearer for new-comers to two-factor authentication. |
| 269 |
|
| 270 |
= 1.1.5 - 07/Apr/2015 = |
| 271 |
|
| 272 |
* FEATURE: Admin users (Premium version) can show codes belonging to other users, and activate or de-activate TFA for other users. |
| 273 |
* PREMIUM: Premium version has now been released: https://www.simbahosting.co.uk/s3/product/two-factor-authentication/. Features emergency codes, personal support, and more short-codes allowing you to custom-design your own front-end page for users. |
| 274 |
* TWEAK: Premium version now contains support link to the proper place (not to wordpress.org's free forum) |
| 275 |
* TWEAK: Added a constant, TWO_FACTOR_DISABLE. Define this in your wp-config.php to disable all TFA requirements. |
| 276 |
* FIX: Fix a bug introduced in version 1.1.2 that could prevent logins on SSL-enabled sites on the WooCommerce form when not accessed over SSL |
| 277 |
|
| 278 |
= 1.1.3 - 04/Apr/2015 = |
| 279 |
|
| 280 |
* TWEAK: Provide "Settings saved" notice when user's settings are saved in the admin area (otherwise the user may be wondering). |
| 281 |
|
| 282 |
= 1.1.2 - 03/Apr/2015 = |
| 283 |
|
| 284 |
* FIX: Include blockUI JavaScript (the lack of which caused front-end options not to save if you did not have WooCommerce or another plugin that already used blockUI installed) |
| 285 |
* FEATURE: Don't show anything on the WooCommerce login form unless user is using 2FA (i.e. behave like WP login form) |
| 286 |
* FEATURE: Added 9 new shortcodes for custom-designed front-end screens (Premium - forthcoming) |
| 287 |
|
| 288 |
= 1.1.1 - 30/Mar/2015 = |
| 289 |
|
| 290 |
* Support added for multisite installs. (Plugin should be network-activated). |
| 291 |
* Support added for super-admin role (it's not a normal WP role internally, so needs custom handling) |
| 292 |
* Tested + compatible on upcoming WP 4.2 (tested on Beta 3) |
| 293 |
* Re-add option to require 2FA over XMLRPC (without specific code, XMLRPC clients don't/can't use 2FA - but requiring it effectively blocks hackers who want to crack your password by using this weakness in XMLRPC) |
| 294 |
|
| 295 |
= 1.0 - 20/Mar/2015 = |
| 296 |
|
| 297 |
* First version, forked from Oskar Hane's https://wordpress.org/plugins/two-factor-auth/ |
| 298 |
* Support for email "two-factor" removed (email isn't really a second factor, unless you have multiple email accounts and guard where your "lost login" emails go to) |
| 299 |
* WooCommerce support added to the main plugin. Load WooCommerce JavaScript only on pages where it is needed. |
| 300 |
* Use AJAX to refresh current code (rather than reloading the whole page) |
| 301 |
* Added WordPress nonces and user permission checks in relevant places |
| 302 |
* Shortcode twofactor_user_settings added, for front-end settings |
| 303 |
* User interface simplified/de-cluttered |
| 304 |
|
| 305 |
|
| 306 |
== Upgrade Notice == |
| 307 |
* 1.2.16: Fix issue whereby if you were already logged in and managed to visit a login form, you would not be asked for a TFA code |
| 308 |
|
