FluentAuth
Will this cool plugin ever get TOTP-based authenticator support?
Are you thinking with an mobile app or with email, or both?
If you use Cloudflare for your DNS, you could do this with Zero Trust. When a visitor goes to your login page, Cloudflare intercepts and redirects you to a page it hosts. You enter your email address and Cloudflare compares that to approved accounts. If matches, it sends a code to your email. You enter on that page, and then it allows you to reach the login page on WordPress.
William Beem I'm looking for TOTP-based authenticator support (so i can use an app like Ente auth, or google authenticator. I don't want email codes. Email is not secure).
Jim G Neither is allowing unknown users to hit your login page.
William Beem I do use WAF rules and access policies on the login pages, but some sites i would like an additional layer that enforces TOTP. Similar plugins to FluentAuth have this feature. Inquiring if its planned here. Thanks for chiming in!
Plus-one to supporting TOTP, and even better for supporting passkeys. Much better than using email codes.
Blaine Moore Passkeys even better! After thinking this through more, and having William Beem challenge my thinking, I ended up keeping my Cloudflare WAF rules that block most everything with a challenge, but changed my Zero Trust settings to use two identity providers that only allow passkeys. This way, a passkey is required when someone calls /wp-admin or /wp-login.php before even hitting my server. Plus, I'm still using the main features in FluentAuth.