0.18.0

Issues

• Add support for encrypting TOTP secrets

  Enhancement

  WordPress/two-factor#455 · Filter by author jeffpaul opened on Sep 9, 2022 · 0.18.0
  8

  

• Add ability to re-encrypt secrets

  Help Wanted
  Enhancement

  WordPress/two-factor#456 · Filter by author jeffpaul opened on Sep 9, 2022 · 0.18.0
  5

  

• Backup codes are saved before user intends

  Backup Codes
  Bug

  WordPress/two-factor#507 · Filter by author iandunn opened on Jan 25, 2023 · 0.18.0
  7

• Add hook to turn off auto-submission of 2FA form

  Enhancement

  WordPress/two-factor#723 · Filter by author eric-michel opened on Nov 13, 2025 · 0.18.0
  3

  

• Add: Site-wide Two-Factor enforcement per user role

  Unread
  WordPress/two-factor#845·masteradhoc opened Mar 21, 2026 · Updated Oct 3, 2026
  20

  

• Allow site administrators to enforce 2FA for specific user roles

  WordPress/two-factor#846 · Filter by author masteradhoc opened on Mar 21, 2026 · 0.18.0
  1

  

• Update email provider token-message hooks

  Unread
  WordPress/two-factor#897·joemaller opened Jun 7, 2026 · Updated Oct 5, 2026
  18

  

• add wp-config support to disable 2fa for a user

  Unread
  WordPress/two-factor#908·masteradhoc opened Jun 14, 2026 · Updated Sep 26, 2026
  6

  

• #953 - Email account owner when two-factor settings change

  Unread
  WordPress/two-factor#1001·masteradhoc opened Sep 27, 2026 · Updated Oct 4, 2026
  1

  

• Enrolling a second factor destroys the user's other sessions and sends no notification

  WordPress/two-factor#953 · Filter by author dknauss opened on Aug 9, 2026 · 0.18.0
  

• Add two_factor_auto_submit_authcode filter to disable authcode auto-submission

  Unread
  WordPress/two-factor#1005·kasparsd opened Sep 28, 2026 · Updated Sep 29, 2026
  2

  

• Phpcs reduce ignores

  Unread
  WordPress/two-factor#955·peterwilsoncc opened Aug 10, 2026 · Updated Sep 28, 2026·Draft
  3

  

• Add personal data exporter and eraser

  Unread
  WordPress/two-factor#997·faisalahammad opened Sep 25, 2026 · Updated Sep 28, 2026
  8

  

• Add unit tests for site-wide enabled providers settings

  Unread
  WordPress/two-factor#981·noruzzamans opened Sep 15, 2026 · Updated Sep 28, 2026
  7

  

• Add REST provider management and server-owned TOTP enrollment

  Unread
  WordPress/two-factor#935·chubes4 opened Jul 22, 2026 · Updated Sep 28, 2026
  6

  

• Persist third-party plugin $_POST fields across the 2FA login screen (Fixes #705)

  Unread
  WordPress/two-factor#925·chetanupare opened Jul 6, 2026 · Updated Sep 28, 2026
  9

  

• Fix #644: Expose existing 2FA revalidation flow to third-party plugins via action hook

  Unread
  WordPress/two-factor#924·chetanupare opened Jul 6, 2026 · Updated Sep 29, 2026
  6

  

• Store TOTP secrets with the WordPress Secrets API

  Unread
  WordPress/two-factor#1010·ericmann opened Sep 29, 2026 · Updated Oct 6, 2026
  28

  

• Email users about low recovery codes and redirect to regenerate after the last one

  Unread
  WordPress/two-factor#1015·masteradhoc opened Oct 2, 2026 · Updated Oct 2, 2026
  2