Title: Loqwall 2FA
Author: mohamedelaaouam99
Published: <strong>chulio 19, 2026</strong>
Last modified: chulio 19, 2026

---

Search plugins

![](https://s.w.org/plugins/geopattern-icon/oqwall-2fa.svg)

# Loqwall 2FA

 By [mohamedelaaouam99](https://profiles.wordpress.org/mohamedelaaouam99/)

[Download](https://downloads.wordpress.org/plugin/oqwall-2fa.1.0.0.zip)

 * [Details](https://arg.wordpress.org/plugins/oqwall-2fa/#description)
 * [Reviews](https://arg.wordpress.org/plugins/oqwall-2fa/#reviews)
 *  [Installation](https://arg.wordpress.org/plugins/oqwall-2fa/#installation)
 * [Development](https://arg.wordpress.org/plugins/oqwall-2fa/#developers)

 [Support](https://wordpress.org/support/plugin/oqwall-2fa/)

## Description

Loqwall 2FA adds a secure second authentication step after the standard WordPress
username/password login. After entering their credentials, users must verify their
identity with a one-time code before gaining access.

**Features**

 * **Email OTP** — a 6-digit code is sent to the user’s registered email address.
 * **Authenticator App (TOTP)** — time-based codes compatible with Google Authenticator,
   Authy, Bitwarden, and any RFC 6238 app.
 * **Backup codes** — 10 one-time recovery codes generated per user.
 * **Device trust** — optionally remember a trusted device for up to 30 days.
 * **Role enforcement** — admins can be required to use 2FA regardless of their 
   personal preference.
 * **Per-user control** — users enable and configure 2FA from their own profile 
   page.
 * **Rate limiting** — brute-force protection on OTP verification.
 * **Audit log** — every authentication event is recorded in a private database 
   table.
 * **No external dependencies** — all cryptographic operations use PHP’s built-in
   functions. No Composer, no remote APIs.
 * **Developer-friendly** — hooks and filters let you customise behaviour without
   modifying plugin files.

### For Developers: Hooks & Filters

**Filters**

    ```
    Loqwall_2FA_required_for_user
    ```

Runs on every login attempt. Return `false` to exempt a user, or `true` to force
2FA regardless of settings.

    ```
    add_filter( 'Loqwall_2FA_required_for_user', function( $required, $user ) {
        // Exempt the user with ID 5 from 2FA.
        if ( 5 === $user->ID ) {
            return false;
        }
        return $required;
    }, 10, 2 );

    Loqwall_2FA_otp_email_message
    ```

Filters the email body before the OTP is sent. Receives the body string, the `WP_User`
object, the plain-text 6-digit code, and a boolean indicating whether the email 
is HTML.

    ```
    add_filter( 'Loqwall_2FA_otp_email_message', function( $body, $user, $code, $html_mode ) {
        // Append a custom footer to every OTP email.
        return $body . '<p>Need help? Contact support@example.com</p>';
    }, 10, 4 );
    ```

**Actions**

    ```
    Loqwall_2FA_verified
    ```

Fires immediately after a user successfully passes 2FA. Receives the user ID and
the method used (`'email'`, `'totp'`, or `'backup_code'`).

    ```
    add_action( 'Loqwall_2FA_verified', function( $user_id, $method ) {
        // Log the successful verification to a custom audit system.
        my_audit_log( $user_id, 'login_verified', $method );
    }, 10, 2 );

    Loqwall_2FA_failed
    ```

Fires after each failed 2FA verification attempt. Receives the user ID and the method
attempted.

    ```
    add_action( 'Loqwall_2FA_failed', function( $user_id, $method ) {
        // Notify an admin after a failed attempt.
        wp_mail( get_option('admin_email'), 'Failed 2FA attempt', "User #$user_id failed via $method." );
    }, 10, 2 );<h3>Third Party Libraries</h3>
    ```

This plugin bundles the following third-party library:

**qrcodejs**
 * Author: Sangmin Shim (davidshimjs) * License: MIT * Source: https://
github.com/davidshimjs/qrcodejs * Files: `assets/js/qrcode.min.js`, `assets/js/qrcode.
js` * Purpose: Renders the QR code displayed during Authenticator App setup. Used
entirely client-side; makes no external network requests.

## Installation

 1. Upload the `oqwall-2fa` folder to the `/wp-content/plugins/` directory, or install
    the plugin through the **Plugins > Add New** screen in WordPress.
 2. Activate the plugin through the **Plugins** screen in WordPress.
 3. Navigate to **Loqwall 2FA > Settings** and enable Two-Factor Authentication.
 4. Each user can then visit their **Profile** page to set up their preferred 2FA method.

## FAQ

### What 2FA methods are supported?

Email OTP (a 6-digit code emailed on each login) and Authenticator App (TOTP, RFC
6238), compatible with Google Authenticator, Authy, Bitwarden, and Microsoft Authenticator.

### Can I force administrators to always use 2FA?

Yes. Enable the **Force Admins** option in **Loqwall 2FA > Settings**. Administrators
will be required to complete 2FA regardless of their personal preference.

### What happens if a user loses access to their 2FA method?

Each user has 10 one-time backup codes generated when they first set up 2FA. These
can be regenerated by the user or by an administrator from the user profile page.
An administrator can also disable 2FA for the user from their profile.

### Does this plugin phone home or send any data externally?

No. The plugin makes no outbound HTTP requests. All data (logs, OTP hashes, device
cookies) stays on your server.

### Is this plugin multisite compatible?

Yes. The plugin works on standard single-site and multisite WordPress installations.

### Which browsers are supported?

Any modern browser. The QR code for Authenticator App setup is rendered entirely
client-side using the bundled `qrcode.js` library.

### Where can I find the source code?

The full source code is available on the plugin’s WordPress.org repository page.
The unminified version of the bundled `qrcode.js` library is included in `assets/
js/qrcode.js`.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“Loqwall 2FA” is open source software. The following people have contributed to 
this plugin.

Contributors

 *   [ mohamedelaaouam99 ](https://profiles.wordpress.org/mohamedelaaouam99/)

[Translate “Loqwall 2FA” into your language.](https://translate.wordpress.org/projects/wp-plugins/oqwall-2fa)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/oqwall-2fa/), check
out the [SVN repository](https://plugins.svn.wordpress.org/oqwall-2fa/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/oqwall-2fa/) by 
[RSS](https://plugins.trac.wordpress.org/log/oqwall-2fa/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.0.0

 * Initial release.
 * Email OTP authentication.
 * Authenticator App (TOTP) authentication.
 * Backup recovery codes.
 * Device trust (remember this device).
 * Role-based 2FA enforcement.
 * Audit log with configurable retention.
 * Rate limiting on OTP verification.
 * Translatable — bundled French (fr_FR) translation.

## Meta

 *  Version **1.0.0**
 *  Last updated **3 días ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.0 or higher **
 *  Tested up to **7.0.2**
 *  PHP version ** 8.0 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/oqwall-2fa/)
 * Tags
 * [2FA](https://arg.wordpress.org/plugins/tags/2fa/)[authentication](https://arg.wordpress.org/plugins/tags/authentication/)
   [login](https://arg.wordpress.org/plugins/tags/login/)[security](https://arg.wordpress.org/plugins/tags/security/)
   [two factor](https://arg.wordpress.org/plugins/tags/two-factor/)
 *  [Advanced View](https://arg.wordpress.org/plugins/oqwall-2fa/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/oqwall-2fa/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/oqwall-2fa/reviews/)

## Contributors

 *   [ mohamedelaaouam99 ](https://profiles.wordpress.org/mohamedelaaouam99/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/oqwall-2fa/)