Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Two Factor Authentication · Version history

Two Factor Authentication changelog and version history

Latest version
1.17.0
Oct 26, 2026 (13 days ago)
Releases
98
since 2015
In the last year
3
about one every 174 days
Tested up to
WordPress 7.1.4
PHP 5.6 or later

Releases each year

  • 201522 releases
  • 20164 releases
  • 201714 releases
  • 201811 releases
  • 201914 releases
  • 20206 releases
  • 20218 releases
  • 20227 releases
  • 20234 releases
  • 20244 releases
  • 20252 releases
  • 20262 releases

20262 releases

  1. Two Factor Authentication 1.17.0Latest

    • SECURITY: Do not allow WooCommerce to auto-login a user who has TFA active when they perform a password reset. i.e. On previous versions, if using WooCommerce’s “Lost password” facility, someone with access to the email account to which the password reset link was sent could login without providing…
    • SECURITY: On a site where users with lower privilege levels (e.g. subscriber) existed, a lower-privileged user could forge a request and thereby have his own TFA code accepted for someone else’s account. To complete login he would also need to know the password of the account he was logging into. T…
    • FIX: Error log entry for Beginning attempt to port private key encryption over to openssl when unnecessary.
    • FIX: Fixed warning “username” in notify_incorrect_tfa_code_attempts()
    • FIX: If TFA is compulsory for user roles (Premium), it remains required even after downgrading to the free version.
    • FIX: Resolve a PHP E_STRICT deprecation notice
    • FIX: QR code overflow on some resolutions
    • FIX: Two factor user settings block not appearing on new post creation.
    • FIX: Typo in Emergency Code Usage Email Notification Text.
    • TWEAK: Added PHPCS naming convention ignores for bundled Two Factor Authentication compatibility hooks to maintain upstream and backward compatibility.
    • TWEAK: Fixed typo in filter name to simbatfa_template_file from simatfa_template_file
    • TWEAK: Replace htmlspecialchars() with WordPress escaping functions where appropriate.
    • TWEAK: Require WordPress version 5.3.
    • TWEAK: Update ‘twofactor/user-settings’ block to use API v3

  2. Two Factor Authentication 1.16.0

    • FEATURE: Add support for Easy Digital Downloads(EDD) login form
    • TWEAK: Resolve a typo in the emergency code usage email notification text

20252 releases

  1. Two Factor Authentication 1.15.5

    • FIX: Function WP_Block_Type_Registry::register was called incorrectly
    • FIX: Fix regression in 1.15.1 which could result in displaying settings incorrectly, with checkboxes hidden
    • FEATURE: Add support for RegistrationMagic login forms

  2. Two Factor Authentication 1.14.27

    • FIX: 1.14.26 broke saving settings on a front-end page via the shortcode
    • TWEAK: Purge empty members of the tfa_incorrect_code_attempts list, to prevent unnecessary growth; and key by user ID, not user login

20244 releases

  1. Two Factor Authentication 1.14.26

    • TWEAK: Resolve a language deprecation notice on WP 6.7 and non-default language

  2. Two Factor Authentication 1.14.24

    • TWEAK: Redirection when TFA is compulsory (Premium feature) should exclude the logout link
    • FIX: An issue that prevented turning on TFA when the redirect user URL is set

  3. Two Factor Authentication 1.14.23

    • TWEAK: Do not require TFA codes for API requests authenticated via an application password
    • TWEAK: Improve formatting of “trust this device” checkbox

  4. Two Factor Authentication 1.14.17

    • FEATURE: Notify user if multiple wrong TFA codes used (which indicates someone has their password)
    • FEATURE: Add a Gutenberg block for the [twofactor_user_settings] shortcode.
    • TWEAK: Resolve PHP 8.2 deprecation notice introduced in 1.14.15
    • TWEAK: Do not look for a TFA code when validating an existing cookie
    • TWEAK: Tweak HTML structure where private key is printed to reduce likelihood of copy/paste introducing an unwanted space
    • TWEAK: Do not consider empty strings when turning on database encryption
    • TWEAK: Update updater library to current version (resolves some PHP 8.2 deprecation notices)

20234 releases

  1. Two Factor Authentication 1.14.16

    • FIX: Fix an error on PHP 7.2 introduced in 1.14.15 (PHP 7.2 was end-of-lifed by the PHP group in 2020, so please update! https://www.php.net/eol.php ).
    • TRANSLATIONS: Update French and Italian translations (thank you to the translators)
    • TWEAK: Correct string identifier for “TFA is configured to not be available for this role” text
    • TWEAK: Make role names translatable in one place where they were not

  2. Two Factor Authentication 1.14.15

    • FEATURE: Encrypt TFA secret keys that are stored in the database (extra protection in case of your database being hacked)
    • FIX: Fix handling of login forms on a page where Gravity Forms was loaded in the JavaScript environment but was not providing the login form
    • TWEAK: Make use of hash_equals function when comparing TOTP codes to prevent timing comparisons

  3. Two Factor Authentication 1.14.14

    • FIX: When on a multisite on a non-main site, the link shown to the network administration for the plugin was wrong
    • TWEAK: Cache whether a user is using TFA when moving from the username field, in order to reduce delay when presenting TFA field
    • TWEAK: Userlist related css file version to be based on its file’s time.
    • TWEAK: Add config utility methods and tweak registering settings.
    • TWEAK: Add a span with CSS class simba_tfa_otp_login_help to the “check your OTP app to get this password” text
    • TWEAK: Add support for CozmosLabs Profile Builder login forms
    • TWEAK: Fix some minor problems related to translation domain handling and untranslatable phrases
    • TWEAK: Suppress message that these are your personal settings for less-privileged users
    • TWEAK: Ensure that user roles are translated
    • TWEAK: Updated French translation, thanks to @madmax4ever

  4. Two Factor Authentication 1.14.11

    • TWEAK: Provide a link to the user’s TFA settings on the user profile page
    • TWEAK: Fix a typo (being/begin)
    • TWEAK: In the admin settings, show more clearly in the “Make two factor authentication compulsory” section the dependence upon the earlier “Make two factor authentication” section

20227 releases

  1. Two Factor Authentication 1.14.10

    • TWEAK: Only load Simba_TFA_Login_Form_Integrations class if not already present
    • TWEAK: Hide all HTML entities that have hide-when-displaying-tfa-input class when 2FA code prompt at login time.

  2. Two Factor Authentication 1.14.8

    • TWEAK: Move JavaScript for displaying QR codes and handling trusted devices into its own file, for better CSP compatibility

  3. Two Factor Authentication 1.14.7

    • TWEAK: Dynamic (non-explicitly declared) properties are deprecated as of PHP 8.2
    • TWEAK: Update bundled Select2 4.0 version to current release
    • TWEAK: Move JavaScript for administering other users into its own file, for better CSP compatibility
    • TWEAK: When a device is already trusted, show this information as plain text, not in the TFA field
    • TWEAK: When the TFA input field is shown, hide error messages from previous logins
    • TWEAK: If the AJAX call to check on OTP status fails, show a user-visible message
    • TWEAK: Add .localdomain hostnames to those permitted to have trusted devices
    • TWEAK: Relabel “Get codes” button
    • TWEAK: Add some filters allowing easier customisation of messages displayed
    • TWEAK: Show only the base32 encoding of the private key (unless the shortcode explicitly specified otherwise), since for a long time now this is what all known apps accept

  4. Two Factor Authentication 1.14.5

    • TWEAK: Gave Premium mentions their own CSS class

  5. Two Factor Authentication 1.14.4

    • FIX: Multisite Plugin Settings link to work in particular site plugins page for main site admin
    • REFACTOR: Make the Simba Two Factor Authentication library more re-usable
    • REFACTOR: Place premium auto-update code in the main file
    • TWEAK: Introduce simba_tfa_get_option_site_id and simba_tfa_skip_adding_options_menu_entry filters

  6. Two Factor Authentication 1.14.3

    • TWEAK: Change internal translation building and loading mechanism
    • TWEAK: “https://” is not a translatable string
    • TWEAK: Load translations even if aborting due to incompatible PHP version
    • TWEAK: Update updater libraries to current versions

  7. Two Factor Authentication 1.13.0

    • REFACTOR: Complete re-organisation of all Premium code. If you had hand-coded any code which interacted with it, you will want to review and test your customisations carefully first. This applies for all refactoring items and internal changes mentioned below.
    • REFACTOR: Abolished the class Simba_TFA_Plugin_Admin_Dashboard_Integration
    • REFACTOR: Moved some TOTP/HOTP-specific methods out of Simba_Two_Factor_Authentication into Simba_TFA_Provider_TOTP
    • TWEAK: Class TFA_Frontend renamed to Simba_TFA_Frontend
    • TWEAK: The constant SIMBA_TFA_PLUGIN_FILE is no longer used internally and has been abolished
    • TWEAK: Move Premium plugin update loader into the main Premium class
    • TWEAK: Factor out all Premium features into individual classes
    • TWEAK: The method tfa_is_available_and_active() has been removed.
    • TWEAK: The method Simba_TFA_Provider_TOTP::getPanicCodesString() has been renamed to Simba_TFA_Provider_TOTP::get_emergency_codes_as_string()

20218 releases

  1. Two Factor Authentication 1.12.2

    • FIX: Prevent load-order related fatal error (regression since 1.12.0) on sites that did not have AUTH_KEY defined in wp-config.php
    • TWEAK: Update updater library in Premium version to latest version
    • TWEAK: Introduce templating method for better code organisation

  2. Two Factor Authentication 1.10.4

    • TWEAK: Fix a couple of minor visual regressions in the WooCommerce login form TFA field layout

  3. Two Factor Authentication 1.10.3

    • FIX: Incorrect object reference in Affiliate WP integration (regression in 1.10.0)

  4. Two Factor Authentication 1.10.2

    • TWEAK: The script tfa_frontend.php now uses an external JavaScript file (better compatibility with with content security policies)

  5. Two Factor Authentication 1.10.0

    • REFACTOR: Integrate the previously-separate WooCommerce/Affiliates-WP handlers in the main handler, eliminating redundant/duplicate code. Eliminate the internal concept of different form types by re-coding the few “type one”s as type twos. Separate login-form specific data from code.

  6. Two Factor Authentication 1.9.4

    • FIX: Prevent an issue identifying the username field when on a page with both Affiliates WP login and registration forms, when the login form displayed second

  7. Two Factor Authentication 1.9.2

  8. Two Factor Authentication 1.8.7

20206 releases

  1. Two Factor Authentication 1.8.6

  2. Two Factor Authentication 1.8.5

  3. Two Factor Authentication 1.8.2

  4. Two Factor Authentication 1.7.2

  5. Two Factor Authentication 1.7.1

  6. Two Factor Authentication 1.7.0

201914 releases

  1. Two Factor Authentication 1.6.4

  2. Two Factor Authentication 1.6.2

  3. Two Factor Authentication 1.6.0

  4. Two Factor Authentication 1.5.6

  5. Two Factor Authentication 1.4.12

  6. Two Factor Authentication 1.5.5

  7. Two Factor Authentication 1.5.2

  8. Two Factor Authentication 1.5.1

  9. Two Factor Authentication 1.4.10

  10. Two Factor Authentication 1.4.9

  11. Two Factor Authentication 1.4.7

  12. Two Factor Authentication 1.4.2

  13. Two Factor Authentication 1.4.1

  14. Two Factor Authentication 1.4.0

201811 releases

  1. Two Factor Authentication 1.3.13

  2. Two Factor Authentication 1.3.12

  3. Two Factor Authentication 1.3.11

  4. Two Factor Authentication 1.3.10

  5. Two Factor Authentication 1.3.9

  6. Two Factor Authentication 1.3.7

  7. Two Factor Authentication 1.3.5

  8. Two Factor Authentication 1.3.4

  9. Two Factor Authentication 1.3.3

  10. Two Factor Authentication 1.3.2

  11. Two Factor Authentication 1.3.1

201714 releases

  1. Two Factor Authentication 1.2.35

  2. Two Factor Authentication 1.2.34

  3. Two Factor Authentication 1.2.29

  4. Two Factor Authentication 1.2.30

  5. Two Factor Authentication 1.2.28

  6. Two Factor Authentication 1.2.27

  7. Two Factor Authentication 1.2.26

  8. Two Factor Authentication 1.2.22

  9. Two Factor Authentication 1.2.21

  10. Two Factor Authentication 1.2.20

  11. Two Factor Authentication 1.2.17

  12. Two Factor Authentication 1.2.16

  13. Two Factor Authentication 1.2.15

  14. Two Factor Authentication 1.2.14

20164 releases

  1. Two Factor Authentication 1.2.13

  2. Two Factor Authentication 1.2.12

  3. Two Factor Authentication 1.2.10

  4. Two Factor Authentication 1.2.9

201522 releases

  1. Two Factor Authentication 1.2.8

  2. Two Factor Authentication 1.2.7

  3. Two Factor Authentication 1.2.6

  4. Two Factor Authentication 1.2.3

  5. Two Factor Authentication 1.2.2

  6. Two Factor Authentication 1.1.19

  7. Two Factor Authentication 1.1.18

  8. Two Factor Authentication 1.1.15

  9. Two Factor Authentication 1.1.14

  10. Two Factor Authentication 1.1.13

  11. Two Factor Authentication 1.1.11

  12. Two Factor Authentication 1.1.10

  13. Two Factor Authentication 1.1.9

  14. Two Factor Authentication 1.1.8

  15. Two Factor Authentication 1.1.7

  16. Two Factor Authentication 1.1.6

  17. Two Factor Authentication 1.1.5

  18. Two Factor Authentication 1.1.3

  19. Two Factor Authentication 1.1.2

  20. Two Factor Authentication 1.1.1

  21. Two Factor Authentication 1.1

  22. Two Factor Authentication 1.0

Questions about Two Factor Authentication’s releases

What is the latest version of Two Factor Authentication?

1.17.0, released on Oct 26, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 5.6 or later.

How often is Two Factor Authentication updated?

3 releases in the last year, about one every 174 days. Its first release on WordPress.org dates from March 2015.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Two Factor Authentication’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.