Duo Security provides two-factor authentication as a service to protect against account takeover and data theft. Using the Duo plugin you can easily add Duo two-factor authentication to your WordPress website in just a few minutes!
Rather than relying on a password alone, which can be phished or guessed, Duo’s authentication service adds a second layer of security to your WordPress accounts. Duo enables your admins or users to verify their identities using something they have—like their mobile phone or a hardware token—which provides strong authentication and dramatically enhances account security.
Duo is easy to setup and use. With Duo there’s no extra hardware or complicated software to install, just sign up for Duo’s service and install the plugin. Then you can set which user roles you want to enable two-factor authentication for—admins, editors, authors, contributors, and/or ’subscribers—without setting up user accounts, directory synchronization, servers, or hardware.
When they log in, your users have multiple ways they can authenticate, including:
- One-tap authentication using Duo’s mobile app (our fastest, easiest way to authenticate)
- One-time passcodes generated by Duo’s mobile app (works even with no cell coverage)
- One-time passcodes delivered to any SMS-enabled phone (works even with no cell coverage)
- Phone callback to any phone (mobile or landline!)
- One-time passcodes generated by an OATH-compliant hardware token (if you’re feeling all old school)
Protect your WordPress website in minutes with Duo.
Integrating Duo two-factor authentication with WordPress is a breeze.
See our instructions at duo.com
How do I get started with Duo?
Before installing the plugin, you’ll need to sign up for a free account at https://duo.com/.
Is Duo’s two-factor service really free?
Yes, Duo is free up to 10 users and no credit card is required to get started! Paid plans for more than 10 users start at only $1/user/month.
WordPress integration is great, but what if I want to protect my own web applications with two-factor?
If you’re interested in protecting other web applications with Duo’s two-factor authentication, check out all our online documentation to see all of our drop-in integrations and to access our APIs and web SDK.
Contributors & Developers
“Duo Two-Factor Authentication” is open source software. The following people have contributed to this plugin.Contributors
Interested in development?
- WordPress 5.6 ’support
- Bug fixes
- Bug fixes
- Update Duo WebSDK to version 2.6
- Update Duo-Web-v2.js
- WordPress 4.5 ’support
- Updated iframe style to be consistent with documentation
- WordPress 4.4 ’support
- Duo Web V2
- Adaptive iframe
- Duo PHP update
- Bug fixes
- WordPress 4.1 ’support
- Fix an IE9 compatibility is’sue
- WordPress 4.0 ’support
- Add a plugin icon
- Fix an is’sue that caused errors on some sites
- Add ’support for WordPress 3.9
- Update CA cert bundle
- Send user-agent with API requests
- Fix an is’sue that caused users to see ‘Access Denied’ when WordPress secret keys are not set correctly
- Fix an is’sue that forced users to log in multiple times when going to a non-secure page from an SSL page
- Minor fix for sites using a proxy
- Fix an is’sue that caused 503 errors for some users
- Add ’support for proxy servers
- Fix an is’sue where the “Remember Me” checkbox on the login page was being ignored
- Use an application-specific key when signing Duo requests
- Add debug mode which enables verbose logging
- Remove unnecessary assets to reduce package size
- Fix an is’sue that allowed some users to bypass 2FA on multisite networks
- Fix multi-site login is’sue
- Add ’support for modal login pages in wordpress 3.8
- Fix various single-site and multi-site compatability is’sues with WordPress instances running 3.0 and 3.2
- Support for WordPress 3.7.1
- Compatability with WP-Engine WordPress hosting service
- Fix some style is’sues on the settings page
- Fix a rare conflict with other plugins
- Add ’support for WordPress 3.6.1
- Fix an is’sue that prevented admins from enabling XMLRPC on multisite instances
- Remove Duo configurations when the plugin is uninstalled from a multisite wordpress instance
- Better ’support for some custom themes
- Make Duo skey setting a password field
- Add ’support for Duo’s new user enrollment frame
- Improve the way we ping Duo servers
- Included the root cert we validate agianst for better ssl certificate validation
- Add better SSL certificate validation when fetching server time
- Modify duo_web to remove the need for NTP
- Removed NTP sync requirement
- All duo options will now be removed when plugin is uninstalled
- Better compatibility with other plugins
- Added setting for enabling/disabling XML-RPC access
- Improved handling of enabling Duo for specific roles
- Improved WordPress Multisite compatibility
- Compatibility with >3.3
- Added additional error checking
- Verified compatibility with WordPress 3.2
- Fixed a bug with user roles
- Default all roles to enable Duo login for upgraded users (same as new installs).
- Require the API hostname setting
- Code cleanups
- Select which roles need to authenticate with Duo
- CSS fixes for IE 6, 7, and 8
- Minor tweaks
- Initial release!