Login & Authentication

The Confirm Risky Actions feature adds an extra layer of protection to your WordPress dashboard.

2 min read

Add a second authentication step using email OTP, authenticator apps, SMS, or backup codes.

2 min read

Enable authenticator app 2FA for chosen roles, pick TOTP or HOTP, decide whether XML-RPC needs 2FA, and set up an app by QR code or private key.

4 min read

Turn on email one-time codes for chosen roles, set up the method from a user profile, and test the login before your users rely on it.

2 min read

Send 6-digit login codes by SMS through Twilio: choose roles, enter your Account SID, token and sender, and check sender ID rules by country.

3 min read

Enable single-use 2FA backup codes for chosen roles, track how many users hold codes or are running low, and see how often codes are used.

2 min read

Turn on trusted devices, set trust duration and a per-user device limit, enable new-device emails, and revoke devices from the site-wide list.

2 min read

Check which of your devices can skip the 2FA step, when each one was last used and expires, and revoke any device you do not recognize.

2 min read

See who has 2FA set up and which method they use, track active sessions and devices, and revoke or clean up sessions across the site.

2 min read

Record every 2FA event, review success and failure stats, filter logs by event type or date, export them to CSV or JSON, and delete old logs.

4 min read

Passwordless sign-in built on WebAuthn, using a fingerprint, FaceID, or a hardware key.

2 min read

Search and filter every registered passkey, see its user, authenticator and last use, switch it on or off, or delete it to revoke access.

2 min read

Turn on passkeys, cap how many each user can register, choose allowed roles, and set registration and login timeouts and user verification.

3 min read

Add passkey login to WooCommerce, MemberPress and Easy Digital Downloads, embed login or register shortcodes, and show passkeys in user screens.

2 min read

Search and filter the passkey activity log by user, event type and date to review registrations, sign-ins and status changes.

2 min read

Enable passwordless login by emailed link, set expiry, roles and request limits, choose where the option appears, and customize the email.

3 min read

Review magic link activity counters, filter and search the event log, export it to CSV, and delete entries you no longer need.

2 min read

Let administrators sign in to lower-level user accounts with their own admin password, and choose which roles this policy covers.

1 min read

Require a minimum length and character types for passwords, apply a preset, block reuse of old passwords, and set expiry, warning and grace days.

6 min read

Change your login URL, redirect the old one, add a consent message, and put an HTTP auth gate in front of wp-admin and wp-login.php.

3 min read

See every logged-in user with device, browser and login time, filter the list by role, and log out one session or several at once.

2 min read

Delete users in bulk by role, active-session status and registration date, and back up your database first because deletion is permanent.

1 min read

Harden login cookies, bind sessions to the browser that created them, limit concurrent logins per user, and log out inactive users.

5 min read

Create a time-limited login for a developer or support contact, with role, redirect, expiry and language, then copy or delete the link.

2 min read

Set which roles temporary logins can use, the default role and redirect, and how long temporary access lasts before it expires.

2 min read