=== Rad 2FA — Two-Factor Login (Email & Authenticator App) ===
Contributors: rad18
Tags: 2fa, two-factor, security, login, totp
Requires at least: 5.8
Tested up to: 7.1
Stable tag: 1.2.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Secure WordPress login with two-factor authentication: email one-time codes or a TOTP authenticator app, per role.

== Description ==

This plugin adds a second authentication factor for the user roles you choose. After a correct username and password, an extra code is required — the site admin picks the method:

* **Email** — a one-time numeric code sent to the user's email address.
* **Authenticator app (TOTP)** — a standard 6-digit code from an app such as Google Authenticator, Authy, or Microsoft Authenticator (this plugin is not affiliated with or endorsed by Google). Each user connects the app in their own profile: scan the QR code or enter the secret key manually.

If the site uses TOTP but a specific user hasn't connected the app yet, they temporarily get an email code at login instead — so nobody gets locked out.

Features:

* Enable 2FA per user role
* Two verification methods: email code or authenticator app (TOTP)
* Configurable email code length, lifetime, and attempt limit
* Admin screens and email codes follow each user's own WordPress language setting (Users → Profile → Language) — no site-wide language switch needed
* Email codes are stored only as a hash; the TOTP secret is stored encrypted (AES-256-CBC)
* The QR code is generated entirely in the browser — the secret is never sent to a third-party service

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`
2. Activate the plugin from the Plugins screen
3. Go to the Rad 2FA menu item, choose the roles and the verification method
4. If the authenticator app method is selected, each user sets it up in their own profile (Users → Your Profile)

== Frequently Asked Questions ==

= What if a user doesn't receive the code email? =

Check the site's outgoing mail (SMTP) setup. The plugin uses WordPress's standard `wp_mail()` function.

= Can I enable 2FA for specific roles only, not everyone? =

Yes — in the plugin settings, tick the roles that require 2FA.

= What happens if the authenticator app method is enabled but a user hasn't set it up yet? =

That user temporarily gets the code by email instead — it doesn't block login.

= Can an administrator set up the authenticator app for another user? =

No — for security, the secret is tied to one person and can only be set up by that person in their own profile.

= Does this protect Application Passwords / the REST API too? =

No. 2FA applies to the login form (wp-login.php). WordPress Application Passwords authenticate REST API requests through a separate mechanism that doesn't go through the login form, so they aren't covered. If this matters for your site, disable Application Passwords for accounts that require 2FA.

= Is this plugin affiliated with Google? =

No. "Google Authenticator" is mentioned only as an example of a compatible authenticator app; this plugin implements the standard, open TOTP algorithm (RFC 6238) and works with any compatible app.

== Credits ==

The QR code on the authenticator app setup screen is rendered client-side using QRCode.js by davidshimjs (MIT license). This plugin bundles the minified build; the unminified source is available at https://github.com/davidshimjs/qrcodejs

== Donate ==

If you find this plugin useful, please consider supporting its development.

https://buymeacoffee.com/rad181


== Screenshots ==

1. Settings — choose which roles require 2FA and the verification method (email code or authenticator app).
2. Connecting an authenticator app from your own profile — scan the QR code or enter the key manually.

== Upgrade Notice ==

= 1.2.0 =
Plugin renamed to Rad 2FA. Admin language now follows each user's own WordPress profile setting instead of a plugin-specific toggle.

= 1.1.1 =
Security hardening: TOTP replay protection, encrypted secret integrity check, login challenge rate limiting.

== Changelog ==

= 1.2.0 =
* Renamed to Rad 2FA (was OTP Sentinel)
* Removed the plugin-specific language toggle; admin screens and OTP emails now follow each user's own WordPress language setting (Users → Profile → Language)
* Inline admin scripts moved to properly enqueued files

= 1.1.1 =
* TOTP codes can no longer be reused across login attempts
* Encrypted TOTP secrets are now integrity-checked (HMAC)
* Rate-limited login challenge issuance to reduce email/brute-force abuse
* Fixed a redirect_to double-encoding bug affecting post-login redirects
* Added uninstall.php to remove plugin data on deletion
* Activation now checks for the required OpenSSL extension

= 1.1.0 =
* Added authenticator app (TOTP) support as an alternative to the email code
* Settings moved to their own top-level menu item

= 1.0.0 =
* Initial release
