# wordpress/two-factor architecture

> Architecture diagram of the GitHub repository wordpress/two-factor, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/wordpress/two-factor
- Repository: https://github.com/wordpress/two-factor

## Overview

Two-Factor is a WordPress plugin that adds a second verification step after password authentication. The main runtime path is WordPress login through the core authenticator, which selects an enabled provider, validates its code, then permits or rejects the login. Users can configure TOTP and recovery codes in their profile; email is another login method, and administrators can restrict providers site-wide or manage accounts with WP-CLI. The tree and excerpts support these principal subsystems, but not every hook or REST route, so uncertain wiring is omitted.

Main entry points: [`class-two-factor-core.php`](https://github.com/wordpress/two-factor/blob/master/class-two-factor-core.php) (Authentication core), [`two-factor.php`](https://github.com/wordpress/two-factor/blob/master/two-factor.php) (Plugin bootstrap), [`providers/class-two-factor-totp.php`](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-totp.php) (TOTP provider), [`providers/class-two-factor-backup-codes.php`](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-backup-codes.php) (Backup codes)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_login["Login authentication"]
  node_core["Authentication core"]
end

subgraph group_methods["Verification methods"]
  node_base["Provider base"]
  node_totp["TOTP provider"]
  node_email["Email provider"]
  node_backup["Backup codes"]
  node_dummy["Dummy provider"]
end

subgraph group_admin["Configuration and management"]
  node_profile["Profile settings UI"]
  node_totpjs["TOTP setup UI<br/>[totp-admin.js]"]
  node_codesjs["Recovery code UI"]
  node_siteconfig["Site provider settings"]
  node_cli["WP-CLI commands"]
end

subgraph group_platform["WordPress integration"]
  node_wp["WordPress login"]
  node_entry["Plugin bootstrap<br/>[two-factor.php]"]
  node_compat["Compatibility hooks"]
end

node_user(("Login user"))
node_mail["WordPress mail"]
node_authapp["Authenticator app"]
node_userstore[("User metadata")]
node_adminuser(("Site administrator"))

node_user -->|"submits credentials"| node_wp
node_wp -->|"invokes authentication"| node_core
node_entry -->|"loads"| node_core
node_entry -->|"loads"| node_base
node_entry -->|"loads"| node_siteconfig
node_core -->|"dispatches verification"| node_totp
node_core -->|"dispatches verification"| node_email
node_core -->|"dispatches verification"| node_backup
node_core -->|"dispatches verification"| node_dummy
node_totp -->|"reads and writes"| node_userstore
node_email -->|"reads and writes"| node_userstore
node_backup -->|"reads and writes"| node_userstore
node_email -->|"sends code"| node_mail
node_authapp -->|"provides code"| node_totp
node_adminuser -->|"configures methods"| node_profile
node_profile -->|"updates provider state"| node_core
node_totpjs -->|"submits setup"| node_totp
node_codesjs -->|"requests codes"| node_backup
node_adminuser -->|"sets available methods"| node_siteconfig
node_siteconfig -->|"reads provider registry"| node_core
node_adminuser -->|"runs commands"| node_cli
node_cli -->|"manages provider state"| node_core
node_cli -->|"generates codes"| node_backup
node_entry -->|"initializes hooks"| node_compat
node_core -->|"returns login result"| node_wp

click node_entry "https://github.com/wordpress/two-factor/blob/master/two-factor.php"
click node_core "https://github.com/wordpress/two-factor/blob/master/class-two-factor-core.php"
click node_base "https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-provider.php"
click node_totp "https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-totp.php"
click node_email "https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-email.php"
click node_backup "https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-backup-codes.php"
click node_dummy "https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-dummy.php"
click node_profile "https://github.com/wordpress/two-factor/blob/master/class-two-factor-core.php"
click node_totpjs "https://github.com/wordpress/two-factor/blob/master/providers/js/totp-admin.js"
click node_codesjs "https://github.com/wordpress/two-factor/blob/master/providers/js/backup-codes-admin.js"
click node_siteconfig "https://github.com/wordpress/two-factor/blob/master/settings/class-two-factor-settings.php"
click node_cli "https://github.com/wordpress/two-factor/blob/master/CLI/class-two-factor-cli-command.php"
click node_compat "https://github.com/wordpress/two-factor/blob/master/class-two-factor-compat.php"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_core,node_user toneBlue
class node_base,node_totp,node_email,node_backup,node_dummy,node_userstore toneAmber
class node_profile,node_totpjs,node_codesjs,node_siteconfig,node_cli toneMint
class node_wp,node_entry,node_compat toneRose
class node_mail,node_authapp,node_adminuser toneIndigo
```

## Components

### Login authentication

- [Authentication core](https://github.com/wordpress/two-factor/blob/master/class-two-factor-core.php): `class-two-factor-core.php`

### Verification methods

- [Provider base](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-provider.php): `providers/class-two-factor-provider.php`
- [TOTP provider](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-totp.php): `providers/class-two-factor-totp.php`
- [Email provider](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-email.php): `providers/class-two-factor-email.php`
- [Backup codes](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-backup-codes.php): `providers/class-two-factor-backup-codes.php`
- [Dummy provider](https://github.com/wordpress/two-factor/blob/master/providers/class-two-factor-dummy.php): `providers/class-two-factor-dummy.php`

### Configuration and management

- [Profile settings UI](https://github.com/wordpress/two-factor/blob/master/class-two-factor-core.php): `class-two-factor-core.php`
- [TOTP setup UI](https://github.com/wordpress/two-factor/blob/master/providers/js/totp-admin.js): `providers/js/totp-admin.js`
- [Recovery code UI](https://github.com/wordpress/two-factor/blob/master/providers/js/backup-codes-admin.js): `providers/js/backup-codes-admin.js`
- [Site provider settings](https://github.com/wordpress/two-factor/blob/master/settings/class-two-factor-settings.php): `settings/class-two-factor-settings.php`
- [WP-CLI commands](https://github.com/wordpress/two-factor/blob/master/CLI/class-two-factor-cli-command.php): `CLI/class-two-factor-cli-command.php`

### WordPress integration

- **WordPress login**
- [Plugin bootstrap](https://github.com/wordpress/two-factor/blob/master/two-factor.php): `two-factor.php`
- [Compatibility hooks](https://github.com/wordpress/two-factor/blob/master/class-two-factor-compat.php): `class-two-factor-compat.php`

### Other components

- **Login user**
- **WordPress mail**
- **Authenticator app**
- **User metadata**
- **Site administrator**

## Connections

- Login user → WordPress login: submits credentials
- WordPress login → Authentication core: invokes authentication
- Plugin bootstrap → Authentication core: loads
- Plugin bootstrap → Provider base: loads
- Plugin bootstrap → Site provider settings: loads
- Authentication core → TOTP provider: dispatches verification
- Authentication core → Email provider: dispatches verification
- Authentication core → Backup codes: dispatches verification
- Authentication core → Dummy provider: dispatches verification
- TOTP provider → User metadata: reads and writes
- Email provider → User metadata: reads and writes
- Backup codes → User metadata: reads and writes
- Email provider → WordPress mail: sends code
- Authenticator app → TOTP provider: provides code
- Site administrator → Profile settings UI: configures methods
- Profile settings UI → Authentication core: updates provider state
- TOTP setup UI → TOTP provider: submits setup
- Recovery code UI → Backup codes: requests codes
- Site administrator → Site provider settings: sets available methods
- Site provider settings → Authentication core: reads provider registry
- Site administrator → WP-CLI commands: runs commands
- WP-CLI commands → Authentication core: manages provider state
- WP-CLI commands → Backup codes: generates codes
- Plugin bootstrap → Compatibility hooks: initializes hooks
- Authentication core → WordPress login: returns login result