Hardening and securing WordPress websites is one of my specialties. We have reported previously on three of the best WordPress security plugins, Sucuri, Bulletproof, and WordFence. I can tell you that each of these plug-ins performed admirably against the continuous barrage of brute force and password reset attacks that my sites have endured. Security appeared to be strong, but I wanted more.
I have been deploying two-factor authentication (TFA) everywhere I can, in order to overcome the inherent weakness of password only security. The Dark Web is awash in stolen credentials, and I am sure mine are in the lists, too. I have been using Google Authenticator primarily, and have been pretty happy with it. Now, an attacker needs more than my password, they need my smartphone too, and if the attacker in in India or the Ukraine, that is not a likely scenario.
Could I add TFA to my WordPress site? Something that worked with Authenticator, too?
I found miniOrange 2-Factor, by Krishna Murari Vijay, of miniOrange. I set it up to work with Google Authenticator, but it can also provide two-factor via email verification, soft token, one time password (OTP) over SMS, QR code authentication via the miniOrange Authenticator smartphone app, Authy TFA, phone call verification, push notification to your phone, and security questions with knowledge based answers (KBA). Somewhere in that extensive collection is a method that will work for you.
I have to say that it appears to be adding an extra layer of security, as my WordFence alerts for brute force and reset exploits has decreased considerably. I am happy to give it a strong recommendation. All of my WordPress clients will be getting miniOrange 2-Factor added to the WordFence security we already have in place. If you own or manage a WordPress site, maybe you should add this too.Share