Two Factor Authentication for WordPress

miniOrange-TFA

This passcode box appears after the user name and password screen with miniOrange 2-factor installed.

Hardening and securing WordPress websites is one of my specialties.  We have reported previously on three of the best WordPress security plugins, Sucuri, Bulletproof, and WordFence.  I can tell you that each of these plug-ins performed admirably against the continuous barrage of brute force and password reset attacks that my sites have endured.  Security appeared to be strong, but I wanted more.

I have been deploying two-factor authentication (TFA) everywhere I can, in order to overcome the inherent weakness of password only security.  The Dark Web is awash in stolen credentials, and I am sure mine are in the lists, too.  I have been using Google Authenticator primarily, and have been pretty happy with it.  Now, an attacker needs more than my password, they need my smartphone too, and if the attacker in in India or the Ukraine, that is not a likely scenario.

Could I add TFA to my WordPress site?  Something that worked with Authenticator, too?

I found miniOrange 2-Factor, by Krishna Murari Vijay, of miniOrange.  I set it up to work with Google Authenticator, but it can also provide two-factor via email verification, soft token, one time password (OTP) over SMS, QR code authentication via the miniOrange Authenticator smartphone app, Authy TFA, phone call verification, push notification to your phone, and security questions with knowledge based answers (KBA).  Somewhere in that extensive collection is a method that will work for you.

I have to say that it appears to be adding an extra layer of security, as my WordFence alerts for brute force and reset exploits has decreased considerably.  I am happy to give it a strong recommendation.  All of my WordPress clients will be getting miniOrange 2-Factor added to the WordFence security we already have in place.  If you own or manage a WordPress site, maybe you should add this too.

0

About the Author:

Cybersecurity guru to business owners in the St Paul, Minneapolis, and western Wisconsin area. Computer security and hacking have been a passion of mine since I entered the computer and networking business in 2000. In 2013 I completed a course of study and certification exam to become a Certified Ethical Hacker (CEH). In 2016 I was certified as a Certified Information Systems Security Professional (CISSP). As Senior Cybersecurity Engineer at Computer Integration Technologies, I help our clients experience high levels of computer security, network security, and web site security. In addition to consulting on security products and services, we also conduct security audits, vulnerability assessments and full penetration tests. We also provide Cybersecurity Awareness Training for clients and their employees. We also work with companies and organizations that need to certify compliance with regulations such as PCI-DSS (credit card processing), HIPAA/HITECH (medical records), and GLBA. The views expressed on this Web site are mine alone and do not necessarily represent the views of my employer.

Add a Comment