Two Factor · Version history
Two Factor changelog and version history
- Latest version
- 0.17.0
- Sep 28, 2026 (1 month ago)
- Releases
- 30
- since 2022
- In the last year
- 6
- about one every 58 days
- Tested up to
- WordPress 7.1.4
- PHP 7.4 or later
Releases each year
- 202214 releases
- 20233 releases
- 20243 releases
- 20256 releases
- 20264 releases
20264 releases
Two Factor 0.17.0Latest
- Security Fixes: Ensure that regular passwords can’t bypass the two-factor requirement for REST API and XML-RPC requests by @faisalahammad in #989. Thanks mqrble for responsibly reporting the issue.
- Security Fixes: Add diagnostics for failed login nonce verification by @georgestephanis in #973. Thanks Ananda Dhakal (Patchstack) for responsibly reporting the issue.
- New Features: Add WP-CLI support with wp two-factor commands by @masteradhoc in #905
- New Features: Respect intentional bypass via the two_factor_is_required_for_user filter by @masteradhoc in #882
- New Features: Add a two_factor_fallback_provider_for_user filter for when a user’s stored providers are no longer registered by @masteradhoc in #882
- New Features: Add early notice for soon exhausting recovery codes by @masteradhoc in #907
- New Features: Add privacy policy content registration by @masteradhoc in #869
- Bug Fixes: Fail closed when CSPRNG is unavailable during nonce generation by @dknauss in #877
- Bug Fixes: Only clear the login nonce once it has expired by @georgestephanis in #980
- Bug Fixes: Fix unslashed REMOTE_ADDR warning in email provider by @masteradhoc in #975
- Bug Fixes: Fix TOTP verify button after resetting authenticator app by @lakrisgubben in #979
- Bug Fixes: Remove two_factor_enabled_providers option on uninstall by @faisalahammad in #903
- Bug Fixes: Fix misleading notice by @masteradhoc in #858
- Bug Fixes: Reword mixed-audience login failure notice to be informational by @dknauss in #922
- Bug Fixes: Rework fail-safe by @masteradhoc in #927
- Bug Fixes: Add coverage for provider-specific fallback notices by @dknauss in #923
- Bug Fixes: Fix HTML5 validation issues by @masteradhoc in #910
- Bug Fixes: Fix users list table fatals (wp_die) when a user’s 2FA provider is deregistered by @masteradhoc in #933
- Development Updates: Prepare for the WordPress 7.0 release by @masteradhoc in #834
- Development Updates: Prepare for the WordPress 7.1 release by @masteradhoc in #900
- Development Updates: Sync login_header() and login_footer() with WP 7.1 by @masteradhoc in #963
- Development Updates: Update PHPStan to 2.x and exclude includes/ from analysis by @masteradhoc in #972
- Development Updates: Validate against PHPStan version 3, 4 and 5 by @masteradhoc in #948
- Development Updates: Update wp-coding-standards/wpcs to 3.4.1 by @obenland in #947
- Development Updates: Fix PHPCS and PHPStan issues across multiple files by @aslamdoctor in #818
- Development Updates: Remove ReflectionProperty::setAccessible() and ReflectionMethod::setAccessible() calls in the test suite by @masteradhoc in #942
- Development Updates: Fix Codecov badge by adding OIDC permission for tokenless upload by @nimesh-xecurify in #856
- Development Updates: Update GitHub Actions workflows by @johnbillion in #892
- Development Updates: Update Playground PR preview action to v4 by @obenland in #985
- Development Updates: Add FAQ entries for Multisite, locked-out users, and role enforcement by @masteradhoc in #881
Two Factor 0.16.0
- Breaking Changes: Remove legacy FIDO U2F provider support by #439.
- New Features: Add a dedicated settings page for plugin configuration in wp-admin by #764.
- New Features: Add a support links filter so consumers can customize contextual recovery/help links by #615.
- New Features: Refresh backup codes UI styling and behavior by #804.
- Bug Fixes: Delete stored TOTP secrets when the TOTP provider is disabled by #802.
- Bug Fixes: Harden provider handling so login/settings checks do not fail open when expected providers disappear by #586.
- Bug Fixes: Ensure only configured providers are saved and enabled in user settings by #798.
- Bug Fixes: Improve settings-page accessibility and fix profile settings link behavior by #828 and #830.
- Bug Fixes: Resolve PHPCS violations in provider files by #851.
- Development Updates: Move login styles and provider scripts from inline output to enqueued/external assets by #807 and #814.
- Development Updates: Improve inline docs and static-analysis compatibility (WPCS/phpstan) by #810, #815, and #817.
- Development Updates: Improve unit test reliability and integrate CI code coverage reporting by #825, #841, and #842.
- Development Updates: Update readme docs and modernize CI workflow infrastructure by #835, #837, #843, and #849.
- Dependency Updates: Bump qs from 6.14.1 to 6.14.2 by #794.
- Dependency Updates: Bump basic-ftp from 5.0.5 to 5.2.0 by #816.
- Dependency Updates: Apply automatic lint/format updates and associated Composer package refreshes by #799.
Two Factor 0.16.0-beta.1
Two Factor 0.15.0
- Breaking Changes: Trigger two-factor flow only when expected by @kasparsd in #660 and #793.
- New Features: Include user IP address and contextual warning in two-factor code emails by @todeveni in #728
- New Features: Optimize email text for TOTP by @masteradhoc in #789
- New Features: Add “Settings” action link to plugin list for quick access to profile by @hardikRathi in #740
- New Features: Additional form hooks by @eric-michel in #742
- New Features: Full RFC6238 Compatibility by @ericmann in #656
- New Features: Consistent user experience for TOTP setup by @kasparsd in #792
- Documentation: @since docs by @masteradhoc in #781
- Documentation: Update user and admin docs, prepare for more screenshots by @jeffpaul in #701
- Documentation: Add changelog & credits, update release notes by @jeffpaul in #696
- Documentation: Clear readme.txt by @masteradhoc in #785
- Documentation: Add date and time information above TOTP setup instructions by @masteradhoc in #772
- Documentation: Clarify TOTP setup instructions by @masteradhoc in #763
- Documentation: Update RELEASING.md by @jeffpaul in #787
- Development Updates: Pause deploys to SVN trunk for merges to master by @kasparsd in #738
- Development Updates: Fix CI checks for PHP compatability by @kasparsd in #739
- Development Updates: Fix Playground refs by @kasparsd in #744
- Development Updates: Persist existing translations when introducing new helper text in emails by @kasparsd in #745
- Development Updates: Fix missing_direct_file_access_protection by @masteradhoc in #760
- Development Updates: Fix mismatched_plugin_name by @masteradhoc in #754
- Development Updates: Introduce Props Bot workflow by @jeffpaul in #749
- Development Updates: Plugin Check: Fix Missing $domain parameter by @masteradhoc in #753
- Development Updates: Tests: Update to supported WP version 6.8 by @masteradhoc in #770
- Development Updates: Fix PHP 8.5 deprecated message by @masteradhoc in #762
- Development Updates: Exclude 7.2 and 7.3 checks against trunk by @masteradhoc in #769
- Development Updates: Fix Plugin Check errors: MissingTranslatorsComment & MissingSingularPlaceholder by @masteradhoc in #758
- Development Updates: Add PHP 8.5 tests for latest and trunk version of WP by @masteradhoc in #771
- Development Updates: Add phpcs:ignore for falsepositives by @masteradhoc in #777
- Development Updates: Fix(totp): otpauth link in QR code URL by @sjinks in #784
- Development Updates: Update deploy.yml by @masteradhoc in #773
20256 releases
Two Factor 0.14.2
- New Features: Add filter for rest_api_can_edit_user_and_update_two_factor_options by @gutobenn in #689
- Development Updates: Remove Coveralls tooling and add inline coverage report by @kasparsd in #717
- Development Updates: Update blueprint path to pull from main branch instead of a deleted f… by @georgestephanis in #719
- Development Updates: Fix blueprint and wporg asset deploys by @kasparsd in #734
- Development Updates: Upload release only on tag releases by @kasparsd in #735
- Development Updates: Bump playwright and @playwright/test by @dependabot[bot] in #721
- Development Updates: Bump tar-fs from 3.1.0 to 3.1.1 by @dependabot[bot] in #720
- Development Updates: Bump node-forge from 1.3.1 to 1.3.2 by @dependabot[bot] in #724
- Development Updates: Bump js-yaml by @dependabot[bot] in #725
- Development Updates: Mark as tested with the latest WP core version by @kasparsd in #730
Two Factor 0.14.1
- Don’t URI encode the TOTP url for display. by @dd32 in #711
- Removed the duplicate Security.md by @slvignesh05 in #712
- Fixed linting issues by @sudar in #707
- Update development dependencies and fix failing QR unit test by @kasparsd in #714
- Trigger checkbox js change event by @gedeminas in #688
Two Factor 0.14.0
- Features: Enable Application Passwords for REST API and XML-RPC authentication (by default) by @joostdekeijzer in #697 and #698. Previously this required two_factor_user_api_login_enable filter to be set to true which is now the default during application password auth. XML-RPC login is still disab…
- Features: Label recommended methods to simplify the configuration by @kasparsd in #676 and #675
- Documentation: Add WP.org plugin demo by @kasparsd in #667
- Documentation: Document supported versions of WP core and PHP by @jeffpaul in #695
- Documentation: Document the release process by @jeffpaul in #684
- Tooling: Remove duplicate WP.org screenshots and graphics from SVN trunk by @jeffpaul in #683
Two Factor 0.13.0
- Add two_factor_providers_for_user filter to limit two-factor providers available to each user by @kasparsd in #669
- Update automated testing to cover PHP 8.4 and default to PHP 8.3 by @BrookeDot in #665
- View the complete changelog details here.
Two Factor 0.12.0
Two Factor 0.11.0
20243 releases
Two Factor 0.10.0
Two Factor 0.9.1
Two Factor 0.9.0
20233 releases
Two Factor 0.8.2
Two Factor 0.8.1
Two Factor 0.8.0
202214 releases
Two Factor 0.7.3
Two Factor 0.7.2
Two Factor 0.7.1
Two Factor 0.7.0
Two Factor 0.6.0
Two Factor 0.5.2
Two Factor 0.5.1
Two Factor 0.5.0
Two Factor 0.4.8
Two Factor 0.4.7
Two Factor 0.4.6
Two Factor 0.4.5
Two Factor 0.4.4
Two Factor 0.4.2
Questions about Two Factor’s releases
What is the latest version of Two Factor?
0.17.0, released on Sep 28, 2026 (1 month ago). It’s tested up to WordPress 7.1.4 and needs PHP 7.4 or later.
How often is Two Factor updated?
6 releases in the last year, about one every 58 days. Its first release on WordPress.org dates from September 2022.
Know when your rivals ship
Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.
Start freeRelease dates come from the day each version’s folder was made in Two Factor’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.