Add two-factor authentication to WordPress.
JUCRA 2FA adds lightweight, authenticator-app based two-factor authentication to WordPress, with flexible enforcement policies, recovery codes, IP whitelisting and administrator controls.
Passwords are only the first layer
A strong WordPress password is important, but a password alone can still be compromised. Two-factor authentication adds an additional security check after the password before access is granted.
JUCRA 2FA is a lightweight TOTP two-factor authentication plugin developed by JUCRA Digital. It is compatible with Google Authenticator and other standard RFC 6238 authenticator applications.
We developed it for practical use on WordPress websites where we wanted straightforward 2FA controls without relying on an external authentication or QR-code service. JUCRA 2FA is available as a free WordPress plugin.
Practical two-factor authentication controls
Standard TOTP authentication combined with the controls needed to deploy 2FA across real WordPress websites.
Authenticator App Support
Google Authenticator-compatible RFC 6238 TOTP, also suitable for other standard TOTP authenticator apps.
QR Code Enrolment
Configure an authenticator using a locally rendered QR code, with a manual setup key as a fallback.
Recovery Codes
Eight one-use recovery codes are generated for each user to store securely.
Flexible Enforcement
Make 2FA optional, require it for everyone, or require it only for selected WordPress roles.
Per-User Policies
Administrators can use the global policy, explicitly require 2FA for a user, or exempt a user.
Grace Periods
Give newly required users from 0 to 90 days to enrol before their WordPress access is restricted to setup.
IP Whitelisting
Trusted exact IPv4 or IPv6 addresses can bypass the second factor, with comments and administrator details stored for each entry.
Administrator Recovery
Administrators can reset another user’s 2FA and securely reset their own using their current WordPress password.
Additional Protection
Includes temporary lockout after repeated invalid codes and replay protection for previously accepted TOTP time windows.
WooCommerce Support
Supports standard WordPress logins and WooCommerce My Account logins.
JUCRA 2FA administrator settings and enforcement controls
Choose how 2FA is enforced
Not every WordPress website has the same requirements. JUCRA 2FA provides three global enforcement options.
Users can enable 2FA without making it mandatory for everyone.
Required for all users
Every user is required to configure two-factor authentication.
Required for selected roles
Require 2FA for roles such as Administrator or Editor while leaving other roles optional.
Individual users can also be explicitly marked as required or exempt.
Grace periods without immediately locking users out
When 2FA becomes mandatory, users may need time to configure their authenticator. JUCRA 2FA supports a configurable grace period from 0 to 90 days.
After expiry, a required user can authenticate with their WordPress password but is restricted to the dedicated JUCRA 2FA setup page until enrolment is complete. Administrators can also reset a user’s grace period when necessary.
Trusted IP address whitelisting
JUCRA 2FA includes administrator-managed IP whitelisting for environments where a trusted fixed IP should not require a second factor on every login.
The whitelist supports exact IPv4 and IPv6 addresses. Each entry records a comment, the administrator who added it and the date it was added.
REMOTE_ADDR and intentionally does not trust forwarded IP headers for whitelist decisions.When an address is whitelisted, the JUCRA 2FA field remains visible but disabled and the login screen explains that the current IP is whitelisted.
Login screen showing a whitelisted IP
Designed to keep authentication local
The bundled QR-code component renders the otpauth setup URI locally inside the browser. The TOTP secret is not sent to an external QR-code service.
Authenticator secrets are stored encrypted in WordPress user metadata, and replay protection prevents a previously accepted TOTP time window from simply being reused.
Getting started
Free WordPress two-factor authentication plugin
JUCRA 2FA is developed by JUCRA Digital and is available to download and use free of charge.
We develop WordPress plugins for our own websites and client projects. When we create something we believe will be useful to other WordPress users, we may make it publicly available through our WordPress Plugins collection.
Download JUCRA 2FA
Add authenticator-based two-factor authentication to your WordPress website with flexible enforcement, recovery options and administrator controls.
Free WordPress plugin developed by JUCRA Digital.