=== Gupti 2FA ===
Contributors: plexomedia
Tags: two-factor, 2fa, google authenticator, totp, login security
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Secure your WordPress login with two-factor authentication (2FA) using any TOTP authenticator app — no external services, no bloat.

== Description ==

Gupti 2FA adds an extra layer of security to your WordPress site by requiring a time-based one-time password (TOTP) from Google Authenticator (or any compatible app) at login. Everything runs locally on your server — no third-party APIs, no account signup, no data leaves your site.

**For users:**

* Easy setup via QR code — scan and go, or enter the secret key manually.
* Works with Google Authenticator, Authy, Microsoft Authenticator, 1Password, and any TOTP app.
* 8 one-time recovery codes in case you lose your device.
* Verification code required when enabling, so you can never lock yourself out by mistake.
* Clean, distraction-free verification page at login.

**For admins:**

* Modern dashboard with 2FA coverage stats across your site.
* Role-based enforcement — require 2FA for administrators, editors, or any role.
* Optional grace period so enforced users get time to set up.
* Choose where users complete setup: right after login, or inside the dashboard.
* 2FA Status Report — see who has 2FA enabled and reset a user's 2FA in one click.
* Login page branding — add your own logo to the verification pages.

**Security hardening built in:**

* TOTP secrets are encrypted at rest (AES-256-GCM keyed from your site's salts).
* Rate limiting on all verification steps — codes can't be brute-forced.
* Replay protection — a used code is never accepted twice.
* Recovery codes are stored hashed and each works only once.
* QR codes are generated locally in pure PHP — nothing is sent to external services.
* No external fonts, scripts, or API calls anywhere.

== Installation ==

1. Upload the `gupti-2fa` folder to `/wp-content/plugins/`, or install via **Plugins → Add New**.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. To enable 2FA for yourself: go to your **Profile** page, scan the QR code with your authenticator app, and enter the 6-digit code to verify.
4. To enforce 2FA for user roles: go to **Gupti 2FA → Configuration**, select the roles, and save.

== Frequently Asked Questions ==

= What if I lose my phone? =
Use one of your 8 recovery codes on the login screen to complete verification, then reconfigure 2FA from your profile. If you have lost the recovery codes too, a site administrator can reset your 2FA from the 2FA Status Report.

= Can I require 2FA only for administrators? =
Yes. Go to Gupti 2FA → Configuration and select only the roles you want to enforce — for example, just Administrators. Other users can still enable 2FA voluntarily from their profile page.

= Will this plugin slow down my site? =
No. The plugin makes no external API calls and loads its scripts and styles only on the login page and its own admin pages. Your site's front end is completely unaffected.

= Does this work with custom login pages? =
It hooks into WordPress core authentication, so it works with any theme or plugin that uses the standard `wp_authenticate` / `wp_login_url` flow.

= Does it send my data anywhere? =
No. Secrets are generated, stored (encrypted), and verified entirely on your own server. QR codes are rendered locally in PHP. The plugin makes no external requests.

= Will REST API or XML-RPC logins bypass 2FA? =
No. Password-based programmatic logins are blocked for 2FA-enabled accounts. Use WordPress application passwords for API access — they are unaffected.

= Where can I get support? =
Use the plugin support forum on WordPress.org, or email us at hello@plexomedia.com.

== Development ==

The admin dashboard is built with React and Vite. The uncompiled, human-readable source is included in the plugin's `app/` directory. To rebuild the compiled files in `assets/dist/`, run `npm install` followed by `npm run build` inside the `app/` directory.

== Changelog ==

= 1.0.0 =
* Initial release.
