There’s no single right answer here, the honest one depends on what you actually need. Two Factor (the WordPress core-team plugin) is free, lightweight, and maintained by the people who write WordPress itself, but ships without passkey support out of the box, you need a separate companion plugin for that. WP 2FA by Melapress is the strongest pick specifically for role-based enforcement with a setup wizard. miniOrange has the widest method list (SMS, WhatsApp, Telegram) but caps the free tier at three users. Wordfence retired its standalone Login Security plugin in mid-2026, so if you were relying on that, 2FA now lives inside the full Wordfence plugin instead.
Here’s where SecondGate fits into that landscape, and where it genuinely doesn’t have the edge over a dedicated 2FA plugin.
Passkeys without a companion plugin
This is the most concrete technical difference. Two Factor, the WordPress.org core-team plugin, doesn’t include WebAuthn/passkey support natively, you install a separate Two-Factor Provider: WebAuthn plugin alongside it, which then shows up as an additional provider inside Two Factor’s profile screen. Two plugins, working together, by design.
SecondGate implements WebAuthn directly, no companion plugin, no third-party library, no Composer dependency. Challenge verification, origin binding, relying-party ID hash confirmation, and signature verification all run against the raw binary attestation and assertion data, with a custom CBOR decoder for the authenticator data structure. That decoder was checked against the official RFC 8949 conformance vectors, real attestation and assertion data captured from an actual MacOS TouchID authenticator, and 200,000 fuzzed adversarial inputs, which found and fixed four real edge cases (a CBOR map with a non-scalar key, truncated strings, truncated integers, trailing bytes after a complete structure) before any of it shipped.
Backup codes, hashed for what they actually are
Most 2FA plugins store backup codes as a hash, the detail worth checking is which hash. SecondGate hashes backup codes with wp_hash_password(), WordPress’s own bcrypt-based, deliberately slow hashing function, specifically because backup codes are short (48 bits of entropy, 12 hex characters, chosen to be typeable by hand) and a fast hash against a small space is a meaningfully more attackable target if a database ever leaks. Device tokens, by contrast, are high-entropy and never typed by a human, so those get plain SHA-256 instead, fast, and appropriate for that specific case. Two different secrets, two deliberately different algorithms.
Role-based enforcement, without a separate policy wizard
WP 2FA’s real strength is a dedicated setup wizard for rolling out mandatory 2FA across a team with grace periods, exactly the right tool if you’re onboarding 40 contributors and don’t want to lock everyone out on a Monday morning. SecondGate supports enforcing 2FA by role too, but it’s a straightforward settings checkbox, not a guided wizard with configurable grace periods. If a phased rollout with a countdown and reminder emails is specifically what you need, WP 2FA’s dedicated flow is built for that job in a way SecondGate currently isn’t.
A second signal under the passkey, for the question a passkey can’t answer
A passkey or a correct TOTP code proves someone holds the right device. It doesn’t prove it’s still the account owner holding it five minutes later on an unlocked laptop someone walked up to. SecondGate’s 2FA challenge screen quietly compares how a given login behaved, keystroke rhythm typing a code, or mouse movement and time-on-screen on a passkey login where there’s nothing to type, against that same account’s own established rhythm from past logins. This is deliberately a weak, noisy signal, not a verdict: it never blocks or alerts on its own, and it doesn’t start comparing until an account has at least five past logins to build a real baseline against. None of the plugins above do anything like this.
What happens after 2FA passes
A correct 2FA check happens once, at login. SecondGate’s Pro tier (£39.99/year) adds a session guard that runs afterward, monitoring for characteristics of a hijacked session post-authentication, with an option to force logout if one’s detected. That’s a genuinely different problem than 2FA itself, most 2FA plugins stop caring the moment the second factor is verified, and none of the plugins compared above extend protection past that point, whether free or paid.
CSRF protection for a gap that’s easy to get wrong
Between a correct password and a completed 2FA check, there’s no authenticated WordPress user context yet, which means the standard nonce system doesn’t apply. SecondGate issues a random 32-character token server-side, stored in a transient, set as an httponly, SameSite=Lax cookie, and checked against the POST body with hash_equals() (a timing-safe comparison, not ===, applied consistently everywhere a secret gets checked in the codebase, not just here). That specific design means knowing the token value alone, say from a referrer header or shared-computer browser history, isn’t enough on its own, an attacker would also need the actual cookie the legitimate browser was issued.
Where SecondGate doesn’t have the edge
Fair to be specific about this:
- No SMS, WhatsApp, or Telegram OTP. miniOrange supports all three. SecondGate deliberately doesn’t, email-delivered and SMS-delivered codes both have structural weaknesses (an attacker who controls the recovery email or pulls off a SIM swap can intercept the “second” factor), but if your users specifically need an SMS fallback, that’s a real gap.
- No dedicated enforcement wizard. Covered above, WP 2FA’s grace-period rollout flow is purpose-built in a way SecondGate’s simpler role checkbox isn’t.
- Newer, smaller install base. Two Factor is maintained by the WordPress core team itself and translated into 40+ languages. SecondGate doesn’t have that history yet.
Who SecondGate actually fits
If you want passkeys working immediately without installing and configuring two plugins together, that’s free on SecondGate, no separate companion plugin needed. If you’d also want 2FA as one integrated part of a broader security plugin’s Pro tier (file integrity, threat scoring, session hijacking detection) instead of stitching together several separate tools, that’s the specific gap the paid side is built for. If your priority is a guided team rollout with grace periods, or you need SMS/WhatsApp codes specifically, one of the dedicated plugins above is honestly the better fit for that job.
