Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

miniOrange 2FA · Version history

miniOrange 2FA changelog and version history

Latest version
6.6.0
Nov 2, 2026 (7 days ago)
Releases
205
since 2017
In the last year
15
about one every 24 days
Tested up to
WordPress 7.1.4
PHP 5.3.0 or later

Releases each year

  • 201716 releases
  • 201834 releases
  • 201916 releases
  • 202046 releases
  • 202122 releases
  • 202227 releases
  • 20238 releases
  • 20249 releases
  • 202514 releases
  • 202613 releases

202613 releases

  1. miniOrange 2FA 6.6.0Latest

    • New: Custom Login URL — change wp-login.php to a custom slug, with a loopback check before saving so a bad slug can’t lock you out. (Premium)
    • New: Country/Region (Geo) Blocking — block or allow logins by visitor country. (Premium, Starter plan+)
    • New: Slack Alerts — webhook notifications on successful/failed logins, IP blocks, geo-blocked visitors, and 2FA resets. (Premium, All-Inclusive plan)
    • New: Gravity Forms registration integration, alongside the existing WooCommerce/User Registration/Ultimate Member/Registration Magic tiles.
    • New: Automatic brute-force lockout — blocks an IP after a configurable number of failed login attempts within a time window, for a configurable duration, extending the existing IP Blocking feature.
    • New: CIDR notation support (e.g. 192.168.1.0/24) for IP Address Range Blocking, alongside the existing start-end range format.
    • Security: Fixed a regression where the Enterprise build’s “Disable XML-RPC” setting didn’t actually block XML-RPC requests the way the free build did.
    • Security: Fixed missing replay protection for Google Authenticator codes — a valid TOTP code could be reused multiple times within its 30-second window.
    • Security: Added rate limiting to the Enterprise build’s self-service 2FA account-recovery email, matching the limits already applied elsewhere.
    • Security: The Enterprise build’s session-expiry toggle didn’t actually gate anything — disabling it had no effect, and an unconfigured install got a flat 14-day login cookie regardless of Remember Me. Fixed to respect the toggle and fall back to WordPress’s own default.
    • Security: Removed a dead, crash-prone admin-notification option left over from an older product line; enabling it (possible via a migrated database) fataled the next time an IP was blocked.
    • Fixes: Corrected an Enterprise build outbound API call timeout that was set to ~2.8 hours instead of 10 seconds.
    • Improvement: Widened Google Authenticator’s clock-drift tolerance to +/-60 seconds in the Enterprise build, matching the free build.
    • Fixes: Removed stray PHP warnings logged by the self-service 2FA reset endpoint when handling a stale/orphaned reset token.
    • Fixes: Several internal classes (settings handlers, IP blocking, AJAX handling, and the 2FA reconfiguration-link handler) were being constructed twice per request due to a duplicate-initialization pattern, causing some of their actions to run twice; corrected across 8 classes.
    • Fixes: Corrected a UI spacing issue between the Geo Blocking “Countries” field and the row above it, and between the navbar’s “2FA + Website Security” toggle and the elements before it.
    • Fixes: Moved the “IP Blocking” sidebar menu item to sit above Reports instead of always appearing at the very end of the menu.
    • Fixes: Restyled the IP Blocking tab (Advanced Blocking / IP Blacklist) to match the rest of the redesigned admin UI, and fixed the AJAX-refreshed tables reverting to legacy styling immediately after blocking, unblocking, whitelisting, or removing an IP.
    • Fixes: The “2FA + Website Security” toggle in the admin header required a manual page refresh before the change (e.g. the IP Blocking menu item appearing/disappearing) was reflected.
    • Improvement: Visually separated the Advanced Features tab’s heading from its settings list, and grouped related settings — including the new automatic brute-force lockout setting — so each renders as its own distinct, separated block instead of blending together.
    • Security: Fixed a timing issue in the per-attempt 2FA lockout counter where it could silently expire mid-challenge — most noticeable with Passkey, since a fingerprint/security-key prompt often takes longer than the window allowed — locking an account out after only 2-3 tries instead of the intended…
    • Security: Neither the IP Blacklist nor the IP Range/CIDR blocking tools stopped you from blocking your own current IP, which locks you out of the entire site with no way back in. Both now refuse to save an entry that matches your own current IP.
    • Fixes: A missing user lookup during a failed login attempt could log a confusing error and silently skip the failed-login notification email.
    • Improvement: Passkey now appears directly after Authenticator App in the 2FA method list during setup, ahead of the OTP-based methods.

  2. miniOrange 2FA 6.5.0

    • New: Optional daily/weekly Activity Digest email summarizing new logins, failed login attempts, and 2FA resets, sent to configured recipients or all administrators by default.
    • New: Optional CAPTCHA (Google reCAPTCHA v2 or Cloudflare Turnstile) on the wp-login.php login form, to slow down automated brute-force login attempts.
    • Security: Added a “Disable XML-RPC” option under 2FA Configurations > Advanced Features, to close off xmlrpc.php as a brute-force and DDoS-amplification vector on sites that don’t need it. Off by default so existing Jetpack/mobile-app integrations keep working after upgrade.
    • New: Self-service 2FA account recovery can now be restricted to specific roles, and the site admin can optionally get an email whenever a user resets their own 2FA this way. Also now recorded in the Compliance Log alongside admin-initiated resets.
    • Improvement: The miniOrange account creation screen now explains what the account is used for (SMS/WhatsApp delivery, plan management), with a “Skip for now” option.
    • Improvement: Modernized the admin sidebar navigation — refreshed icons and hover/active states.

  3. miniOrange 2FA 6.4.0

    • New: Magic Link Login — a passwordless “email me a login link” option at wp-login.php, with Off / Optional / Mandatory modes.
    • New: Trusted Devices (free) — a recognized browser skips repeat 2FA prompts for 7 days after a successful challenge.
    • New: Recent Logins panel — self-service login history (date, IP, success/failure) on each user’s own profile.
    • New: 2FA Adoption dashboard widget showing how many required users have 2FA configured.
    • New: Optional 2FA setup reminder emails for users who are required to set up 2FA but haven’t yet.
    • New: Security alert email sent to a user when their 2FA method is changed, or reset by an admin.
    • New: “Protect Staff, Not Shoppers” one-click WooCommerce role preset on the Quick Setup screen (Administrator, Editor, Author, Shop Manager; Customer left unchecked).
    • New: Optional security note on the WooCommerce My Account dashboard, shown only when WooCommerce is active.
    • New: Per-role grace periods, and a per-role action (enforce vs. block) for when a role’s grace period expires, in addition to the existing site-wide default.
    • New: Compliance Log report under Reports — records admin-initiated 2FA resets (who, whom, when) for PCI DSS / GDPR / cyber-insurance documentation. Export is a Premium feature.
    • Improvement: Plugin emails (OTP, verification links, backup codes, setup reminders, and more) now send through miniOrange’s cloud relay instead of the site’s local SMTP, so delivery no longer depends on the site having SMTP configured.
    • Improvement: Redesigned admin UI — the 2FA Configurations screen is now split into focused Access Rules, Login Experience, Methods, Notifications, and Advanced pages with WordPress-native styling.
    • Improvement: Backup codes are now generated and validated locally instead of via a remote service call.
    • Security: Closed a gap where the free plugin’s SMS and Email-Verification-Link methods could be used on the backend despite being premium-locked in the UI.
    • Security: Fixed missing rate limiting on backup-code validation, which allowed unlimited guesses; it now uses the same account lockout as every other 2FA method.
    • Security: Added rate limiting (a short per-request cooldown, an hourly cap per user/IP/destination, and a site-wide daily cap) to every email the plugin sends on demand — OTP over email, backup-code resends, and account-recovery link resends — so none of them can be used to spam a user’s inbox or e…
    • Security: Fixed a sanitization-ordering bug where a request URL was written to the audit log before, not after, being passed through esc_url_raw().
    • Security: Added a missing capability check on the setup-wizard “skip” action, which was reachable by an unauthenticated visitor via the nonce embedded in the public login-challenge popup.
    • Security: Removed a minor information disclosure where the account-recovery email failure message differed depending on whether the target account could manage_options.

  4. miniOrange 2FA 6.3.2

    • Security fixes and improvements.

  5. miniOrange 2FA 6.3.1

    • Fixed unauthenticated arbitrary WordPress option deletion via the email-verification link handler.
    • Fixed 2FA attempt-lockout bypass (client-controlled counter) and added missing rate limiting to the 2FA configuration-validation endpoint.

  6. miniOrange 2FA 6.3.0

    • Compatibility with WordPress 7.1

  7. miniOrange 2FA 6.2.9

    • Free 2FA now supports unlimited users completing two-factor authentication setup.
    • Introduced Passkey as a new 2FA method in the free version.
    • Introduced Push Notification as a new premium 2FA method.
    • Performance optimizations across the 2FA plugin.

  8. miniOrange 2FA 6.2.8

    • Bug fixes for TOTP method and KBA method
    • Minor bug fixes and improvements.

  9. miniOrange 2FA 6.2.7

    • Added rate limiting
    • other bug fixes

  10. miniOrange 2FA 6.2.6

    • Readme changes.
    • Security fixes.

  11. miniOrange 2FA 6.2.5

    • Increased the free 2FA setup limit so up to 5 users can complete two-factor authentication configuration.
    • Updated account recovery email behavior so the recovery link can be sent without checking remaining email transactions.
    • UI Improvements in 2FA plugin.
    • 2FA plugin readme changes.
    • Compatibility with WordPress 7.0

  12. miniOrange 2FA 6.2.4

    • Bug fixes in WP 2FA plugin
    • Readme updates in 2FA plugin

  13. miniOrange 2FA 6.2.3

    • Readme updates in 2FA plugin

202514 releases

  1. miniOrange 2FA 6.2.2

    • Readme updates in 2FA plugin

  2. miniOrange 2FA 6.2.1

    • Security fixes in 2FA plugin
    • Readme updates in 2FA plugin

  3. miniOrange 2FA 6.2.0

    • UI Updates – 2FA Settings

  4. miniOrange 2FA 6.1.7

    • Minor Fixes – 2FA User Profile

  5. miniOrange 2FA 6.1.5

    • Security fixes in 2FA plugin
    • Code optimization changes

  6. miniOrange 2FA 6.1.4

    • Bug fixes – 2FA login flow
    • Code optimization changes in WP 2FA

  7. miniOrange 2FA 6.1.3

    • Vulnerability fixes – Admin XSS/MITM risk via IP Lookup

  8. miniOrange 2FA 6.1.2

    • Vulnerability fixes – Broken Access Control

  9. miniOrange 2FA 6.1.1

    • Vulnerability fixes – Session Hijacking & Replay Attack (Google Authentication)

  10. miniOrange 2FA 6.1.0

    • UI/UX Improvements – 2FA popups
    • Vulnerability fixes – 2FA Bypass and Weak Question & Answer Validation (KBA)
    • Bug fixes – Low Transactions Notice
    • Added Debug Log Feature
    • Setup Guides Links added in Forms tab
    • Code optimization in 2FA plugin

  11. miniOrange 2FA 6.0.9

    • Bug fixes – 2FA Backup Code Validation

  12. miniOrange 2FA 6.0.8

    • Compatibility with WordPress 6.8
    • Bug fixes – 2FA Login Transaction Report

  13. miniOrange 2FA 6.0.7

  14. miniOrange 2FA 6.0.6

20249 releases

  1. miniOrange 2FA 6.0.5

  2. miniOrange 2FA 6.0.3

  3. miniOrange 2FA 6.0.2

  4. miniOrange 2FA 6.0.1

  5. miniOrange 2FA 6.0.0

  6. miniOrange 2FA 5.8.4

  7. miniOrange 2FA 5.8.3

  8. miniOrange 2FA 5.8.2

  9. miniOrange 2FA 5.8.1

20238 releases

  1. miniOrange 2FA 5.8

  2. miniOrange 2FA 5.7.5

  3. miniOrange 2FA 5.7.4

  4. miniOrange 2FA 5.7.3

  5. miniOrange 2FA 5.7.2

  6. miniOrange 2FA 5.7.1

  7. miniOrange 2FA 5.7.0

  8. miniOrange 2FA 5.6.6

202227 releases

  1. miniOrange 2FA 5.6.5

  2. miniOrange 2FA 5.6.4

  3. miniOrange 2FA 5.6.3

  4. miniOrange 2FA 5.4.40

  5. miniOrange 2FA 5.6.2

  6. miniOrange 2FA 5.6.1

  7. miniOrange 2FA 5.6.0

  8. miniOrange 2FA 5.5.82

  9. miniOrange 2FA 5.5.81

  10. miniOrange 2FA 5.5.80

  11. miniOrange 2FA 5.5.79

  12. miniOrange 2FA 5.5.78

  13. miniOrange 2FA 5.5.77

  14. miniOrange 2FA 5.5.76

  15. miniOrange 2FA 5.5.75

  16. miniOrange 2FA 5.5.7

  17. miniOrange 2FA 5.5.6

  18. miniOrange 2FA 5.5.5

  19. miniOrange 2FA 5.5.4

  20. miniOrange 2FA 5.5.3

  21. miniOrange 2FA 5.5.2

  22. miniOrange 2FA 5.5.1

  23. miniOrange 2FA 5.5

  24. miniOrange 2FA 5.4.52

  25. miniOrange 2FA 5.4.51

  26. miniOrange 2FA 5.4.50

  27. miniOrange 2FA 5.4.49

202122 releases

  1. miniOrange 2FA 5.4.48

  2. miniOrange 2FA 5.4.47

  3. miniOrange 2FA 5.4.46

  4. miniOrange 2FA 5.4.45

  5. miniOrange 2FA 5.4.44

  6. miniOrange 2FA 5.4.43

  7. miniOrange 2FA 5.4.42

  8. miniOrange 2FA 5.4.41

  9. miniOrange 2FA 5.4.39

  10. miniOrange 2FA 5.4.38

  11. miniOrange 2FA 5.4.37

  12. miniOrange 2FA 5.4.36

  13. miniOrange 2FA 5.4.35

  14. miniOrange 2FA 5.4.34

  15. miniOrange 2FA 5.4.4

  16. miniOrange 2FA 5.4.33

  17. miniOrange 2FA 5.4.32

  18. miniOrange 2FA 5.4.31

  19. miniOrange 2FA 5.4.30

  20. miniOrange 2FA 5.4.29

  21. miniOrange 2FA 5.4.28

  22. miniOrange 2FA 5.4.27

202046 releases

  1. miniOrange 2FA 5.4.26

  2. miniOrange 2FA 5.4.25

  3. miniOrange 2FA 5.4.24

  4. miniOrange 2FA 5.4.23

  5. miniOrange 2FA 5.4.22

  6. miniOrange 2FA 5.4.21

  7. miniOrange 2FA 5.4.20

  8. miniOrange 2FA 5.4.19

  9. miniOrange 2FA 5.4.18

  10. miniOrange 2FA 5.4.17

  11. miniOrange 2FA 5.4.16

  12. miniOrange 2FA 5.4.15

  13. miniOrange 2FA 5.4.14

  14. miniOrange 2FA 5.4.12

  15. miniOrange 2FA 5.4.9

  16. miniOrange 2FA 5.4.8

  17. miniOrange 2FA 5.4.5

  18. miniOrange 2FA 5.4.7

  19. miniOrange 2FA 5.4.6

  20. miniOrange 2FA 5.4.3

  21. miniOrange 2FA 5.4.2

  22. miniOrange 2FA 5.4.1

  23. miniOrange 2FA 5.4.0

  24. miniOrange 2FA 5.3.26

  25. miniOrange 2FA 5.3.25

  26. miniOrange 2FA 5.3.24

  27. miniOrange 2FA 5.3.23

  28. miniOrange 2FA 5.3.22

  29. miniOrange 2FA 5.3.21

  30. miniOrange 2FA 5.3.20

  31. miniOrange 2FA 5.3.19

  32. miniOrange 2FA 5.3.18

  33. miniOrange 2FA 5.3.17

  34. miniOrange 2FA 5.3.16

  35. miniOrange 2FA 5.3.15

  36. miniOrange 2FA 5.3.14

  37. miniOrange 2FA 5.3.13

  38. miniOrange 2FA 5.3.12

  39. miniOrange 2FA 5.3.11

  40. miniOrange 2FA 5.3.8

  41. miniOrange 2FA 5.3.7

  42. miniOrange 2FA 5.3.6

  43. miniOrange 2FA 5.3.5

  44. miniOrange 2FA 5.3.4

  45. miniOrange 2FA 5.3.3

  46. miniOrange 2FA 5.3.0

201916 releases

  1. miniOrange 2FA 5.2.6

  2. miniOrange 2FA 5.2.5

  3. miniOrange 2FA 5.2.4

  4. miniOrange 2FA 5.2.3

  5. miniOrange 2FA 5.2.2

  6. miniOrange 2FA 5.2.1

  7. miniOrange 2FA 5.2.0

  8. miniOrange 2FA 5.1.22

  9. miniOrange 2FA 5.1.21

  10. miniOrange 2FA 5.1.20

  11. miniOrange 2FA 5.1.19

  12. miniOrange 2FA 5.1.18

  13. miniOrange 2FA 5.1.17

  14. miniOrange 2FA 5.1.16

  15. miniOrange 2FA 5.1.15

  16. miniOrange 2FA 5.1.14

201834 releases

  1. miniOrange 2FA 5.1.11

  2. miniOrange 2FA 5.1.10

  3. miniOrange 2FA 5.1.9

  4. miniOrange 2FA 5.1.8

  5. miniOrange 2FA 5.1.7

  6. miniOrange 2FA 5.1.13

  7. miniOrange 2FA 5.1.12

  8. miniOrange 2FA 5.1.6

  9. miniOrange 2FA 5.1.5

  10. miniOrange 2FA 5.1.4

  11. miniOrange 2FA 5.1.3

  12. miniOrange 2FA 5.1.2

  13. miniOrange 2FA 5.1.0

  14. miniOrange 2FA 5.0.17

  15. miniOrange 2FA 5.0.16

  16. miniOrange 2FA 5.0.15

  17. miniOrange 2FA 5.0.12

  18. miniOrange 2FA 5.0.11

  19. miniOrange 2FA 5.0.10

  20. miniOrange 2FA 5.0.9

  21. miniOrange 2FA 5.0.8

  22. miniOrange 2FA 5.0.7

  23. miniOrange 2FA 5.0.6

  24. miniOrange 2FA 5.0.5

  25. miniOrange 2FA 5.0.4

  26. miniOrange 2FA 5.0.3

  27. miniOrange 2FA 5.0.2

  28. miniOrange 2FA 5.0.1

  29. miniOrange 2FA 5.0.0

  30. miniOrange 2FA 4.6.2

  31. miniOrange 2FA 4.6.1

  32. miniOrange 2FA 4.5.9

  33. miniOrange 2FA 4.5.8

  34. miniOrange 2FA 4.5.7

201716 releases

  1. miniOrange 2FA 4.5.5

  2. miniOrange 2FA 4.5.4

  3. miniOrange 2FA 4.5.3

  4. miniOrange 2FA 4.5.2

  5. miniOrange 2FA 4.5.1

  6. miniOrange 2FA 4.4.9

  7. miniOrange 2FA 4.4.8

  8. miniOrange 2FA 4.4.7

  9. miniOrange 2FA 4.4.6

  10. miniOrange 2FA 4.4.5

  11. miniOrange 2FA 4.4.4

  12. miniOrange 2FA 4.4.3

  13. miniOrange 2FA 4.4.2

  14. miniOrange 2FA 4.4.1

  15. miniOrange 2FA 4.4

  16. miniOrange 2FA 4.3.4

Questions about miniOrange 2FA’s releases

What is the latest version of miniOrange 2FA?

6.6.0, released on Nov 2, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 5.3.0 or later.

How often is miniOrange 2FA updated?

15 releases in the last year, about one every 24 days. Its first release on WordPress.org dates from April 2017.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in miniOrange 2FA’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.