miniOrange 2FA Premium for WordPress MFA

Choose how visitors verify a login

miniOrange 2FA Premium adds a second identity check to WordPress logins after a user enters a password. Administrators can set requirements for particular users or roles to cover administrator, customer and other accounts. The plugin can be used with WooCommerce stores, membership sites, learning platforms, enterprise portals, educational institutions, government websites and agency-managed environments.

The plugin works with WooCommerce, Elementor, Ultimate Member, BuddyPress, Theme My Login, LoginPress and custom login forms.

Compare the available methods

The free plan includes Google Authenticator (TOTP), Passkey, Email OTP and Security Questions. Premium adds SMS OTP, WhatsApp OTP, Telegram OTP, push notification authentication, email verification links, Microsoft Authenticator, Authy, LastPass Authenticator and hardware token authentication.

With push authentication, a login request goes to the user's phone for approval, so they can approve it without entering a six-digit code. Hardware tokens provide an option for sites that use physical authentication devices.

Passkeys are available in the free plan. They can use Face ID, Touch ID, Windows Hello, Android biometrics or security keys such as YubiKey, Titan and SoloKey. Users can use a passkey for passwordless login or as a second step, register multiple passkeys and keep backup codes for recovery. Passkey and Google Authenticator verification happen on the website without external calls. Some configured OTP, SMS, email, push and account-related requests require communication with miniOrange services.

Set requirements for users and roles

Administrators can apply role-based policies, configure user-specific MFA settings and manage enforcement. Other controls include trusted devices, grace periods, backup authentication methods, account recovery and custom redirects after login. Login reports and IP alerts provide information for reviewing authentication activity. A custom SMS gateway is available for websites that need to use their own gateway.

Premium also works with multisite 2FA, custom branding and white-labeling. For WooCommerce, additional login verification can help protect customer accounts, order information, payment details and shop management accounts. Role settings let administrators set different requirements for administrators, store teams and other user groups.

Install and configure the plugin

1. Install and activate miniOrange 2FA Premium on the WordPress website, then open its settings in the dashboard.
2. Select the authentication methods and policies the site needs. Configure requirements for users or roles, along with trusted devices, recovery options, redirects and any branding choices.
3. If a selected method uses SMS, email, push or another service-connected request, configure the required miniOrange service connection.
4. Test the selected login flow before applying enforcement policies to users. For WooCommerce, set the desired requirements for clients, store staff and administrators.