How wordpress/two-factor works
Two-Factor is a WordPress plugin that adds a second verification step after password authentication. The main runtime path is WordPress login through the core authenticator, which selects an enabled provider, validates its code, then permits or rejects the login. Users can configure TOTP and recovery codes in their profile; email is another login method, and administrators can restrict providers site-wide or manage accounts with WP-CLI. The tree and excerpts support these principal subsystems, but not every hook or REST route, so uncertain wiring is omitted.
Main entry points: class-two-factor-core.php Authentication core · two-factor.php Plugin bootstrap · class-two-factor-totp.php TOTP provider · class-two-factor-backup-codes.php Backup codes
Components 19
Login authentication
- Authentication core
class-two-factor-core.php
Verification methods
- Provider base
providers/class-two-factor-provider.php - TOTP provider
providers/class-two-factor-totp.php - Email provider
providers/class-two-factor-email.php - Backup codes
providers/class-two-factor-backup-codes.php - Dummy provider
providers/class-two-factor-dummy.php
Configuration and management
- Profile settings UI
class-two-factor-core.php - TOTP setup UI
providers/js/totp-admin.js - Recovery code UI
providers/js/backup-codes-admin.js - Site provider settings
settings/class-two-factor-settings.php - WP-CLI commands
CLI/class-two-factor-cli-command.php
WordPress integration
- WordPress login
- Plugin bootstrap
two-factor.php - Compatibility hooks
class-two-factor-compat.php
Other components
- Login user
- WordPress mail
- Authenticator app
- User metadata
- Site administrator
Connections 25
- Login user → WordPress login: submits credentials
- WordPress login → Authentication core: invokes authentication
- Plugin bootstrap → Authentication core: loads
- Plugin bootstrap → Provider base: loads
- Plugin bootstrap → Site provider settings: loads
- Authentication core → TOTP provider: dispatches verification
- Authentication core → Email provider: dispatches verification
- Authentication core → Backup codes: dispatches verification
- Authentication core → Dummy provider: dispatches verification
- TOTP provider → User metadata: reads and writes
- Email provider → User metadata: reads and writes
- Backup codes → User metadata: reads and writes
- Email provider → WordPress mail: sends code
- Authenticator app → TOTP provider: provides code
- Site administrator → Profile settings UI: configures methods
- Profile settings UI → Authentication core: updates provider state
- TOTP setup UI → TOTP provider: submits setup
- Recovery code UI → Backup codes: requests codes
- Site administrator → Site provider settings: sets available methods
- Site provider settings → Authentication core: reads provider registry
- Site administrator → WP-CLI commands: runs commands
- WP-CLI commands → Authentication core: manages provider state
- WP-CLI commands → Backup codes: generates codes
- Plugin bootstrap → Compatibility hooks: initializes hooks
- Authentication core → WordPress login: returns login result