Two-factor & SSO Authentication for WordPress

The WordPress login screen is the most attacked URL on your site, and a password alone stopped being an acceptable defense years ago.

The good news is that securing wp-login.php doesn’t require a bloated security suite. Depending on whether you need two-factor codes for a small team or full single sign-on against a corporate identity provider, there’s a focused, well-built plugin for every major approach. These are the options I recommend and deploy for clients, with an honest read on the state of each as of late 2026, because a few of the plugins people still link to shouldn’t go anywhere near a production login.

Two-Factor: The Core-Contributor Plugin

For straightforward 2FA, the ideal option is Two-Factor, the official WordPress feature plugin developed by core contributors under the WordPress GitHub organization. It ships TOTP (Google Authenticator and every compatible app), email codes and backup codes, lives in the plugin directory with 100,000+ installs, and is actively maintained with releases through this fall. Because it’s built as a candidate for core merge, the code quality and upgrade path are about as safe a bet as WordPress plugins get.

Enforce it rather than suggest it. A single constant-free filter requires two-factor for privileged roles:

// Require 2FA for anyone who can publish or administer.
add_filter( 'two_factor_providers', function( $providers ) {
  return $providers; // keep defaults: TOTP, email, backup codes
});

add_action( 'admin_init', function() {
  $user = wp_get_current_user();
  if ( array_intersect( [ 'administrator', 'editor' ], $user->roles )
    && ! Two_Factor_Core::is_user_using_two_factor( $user->ID ) ) {
    wp_safe_redirect( admin_url( 'profile.php#two-factor-options' ) );
  }
});

Two caveats worth knowing. Hardware key support via the old U2F standard was removed in early 2026 when browsers dropped it, and native WebAuthn/passkey support still hasn’t landed in the plugin itself; if you want phishing-resistant passkeys with it, add the companion WebAuthn Provider for Two Factor plugin. And despite years of anticipation, 2FA has still not merged into WordPress core as of 7.1, so the plugin remains the way to get it.

Google Authenticator MFA

The classic Google Authenticator plugin is the simple, effective veteran of this space: TOTP codes only, 20,000+ installs, dating back to 2011. It changed hands from its original author and the new maintainer has kept it current, including an August 2026 release that fixed a CSRF issue, and it’s tested against the latest WordPress. It still works well for a simple approach, but with the core-contributor Two-Factor plugin offering TOTP plus email and backup codes under more eyes, the classic plugin is now the choice only when you specifically want its minimal single-method footprint. Skip its optional “app password” feature, which its own readme warns weakens security.

Duo Universal MFA

For teams already on Cisco’s Duo, the first-party Duo Universal plugin redirects logins through Duo’s Universal Prompt, which brings the strongest factor list of anything here: passkeys, biometrics and hardware tokens alongside push and phone methods. It’s the only option in this roundup with first-party passkey support today. Duo is free up to 10 users and $3 per user per month after that, which makes it a legitimately cheap way to give a small team phishing-resistant login. Note the old “Duo Two-Factor” plugin reached end of support in September 2024 and still has more installs than its replacement; make sure you’re on duo-universal, not duo-wordpress.

SAML SSO: Pantheon’s wp-saml-auth

For SAML and SAML 2.0 single sign-on, WP SAML Auth by Pantheon is the rock-solid, clean implementation of the bunch, and it’s what I’ve used for enterprise SSO builds including SAML 2.0 against corporate identity providers at TripAdvisor scale. It bundles the OneLogin php-saml library (or can delegate to SimpleSAMLphp), configures entirely through a filter rather than a settings sprawl, and works with any SAML IdP: Okta, Entra, Google Workspace, OneLogin, Shibboleth.

add_filter( 'wp_saml_auth_option', function( $value, $option_name ) {
  $defaults = [
    'connection_type' => 'internal',
    'auto_provision'  => true,
    'permit_wp_login' => false, // SSO only; no password fallback
    'default_role'    => 'subscriber',
  ];
  return $defaults[ $option_name ] ?? $value;
}, 10, 2 );

It’s GPL, free, and maintained by a serious host. One practical note: pin to 2.3.4 or later, as 2.3.3 shipped broken, and if you use the SimpleSAMLphp mode keep that library on 2.4+.

Okta + WordPress

This one needs a correction to the usual advice. The plugin originally developed by Zillow for their WordPress blog, wp-okta-authentication, was a nice simple OIDC bridge in its day, but its day was 2018: it hasn’t seen a commit in eight years, has about 20 active installs, and the code disables TLS certificate verification on its token requests and skips ID-token validation entirely. Don’t deploy it in 2026.

The right ways to connect Okta now: point Pantheon’s WP SAML Auth at an Okta SAML app (my preference, since you keep a generic GPL plugin and Okta is just another IdP), or use the generic OpenID Connect plugin below against Okta’s OIDC authorization server. Okta itself ships no first-party WordPress plugin; everything in its integration catalog for WordPress is third-party. Budget note for small teams: Okta Workforce pricing starts at $6 per user per month with a $1,500 annual minimum.

Auth0 + WordPress

Auth0’s plugin is alive and actively developed, with one giant catch: the version in the WordPress.org directory is v4, which Auth0 stopped supporting in June 2023. The supported v5 line (with a 6.0 beta underway) installs via Composer only: composer require auth0/wordpress with PHP 8.1+. If you install Auth0 the WordPress way, you get the dead branch; if you install it the Composer way, you get a well-maintained bridge to everything Auth0 does: social logins, passkeys, MFA, enterprise federation.

Watch the pricing cliff: the free tier now covers 25,000 monthly active users and even includes one enterprise (SAML/AD) connection, but enterprise connections otherwise exist only on B2B plans starting at $150/month. Upgrading from Free to the cheaper B2C tiers actually removes enterprise connection support.

Microsoft Entra SSO + WordPress

The long-standing community plugin aad-sso-wordpress still gets occasional commits (most recently May 2026), speaks OIDC to Entra ID and reads users and groups via Microsoft Graph, but it’s a self-described as-is personal project: no release tag since 2019, no wordpress.org distribution so no auto-updates, and a hundred-plus open issues. It works, and I’ve seen it in production, but treat it as code you’re adopting, not a product.

The more durable pattern is the one Microsoft itself documents: register WordPress as a non-gallery enterprise application in Entra, configure SAML SSO there (no P1 license required for the SSO itself), and connect it with WP SAML Auth or the OpenID Connect plugin. You only need Entra P1 (now $7/user/month) when you want the extras like Conditional Access or group-based app assignment for role mapping.

OpenID Connect: The Generic Bridge

OpenID Connect Generic (daggerhart’s plugin, now under the oidc-wp organization) is the Swiss-army option: point it at any OIDC provider (Okta, Entra, Auth0, Keycloak, Google) and it handles the authorization code flow, auto-provisions users, and supports auto-login SSO. 10,000+ installs and genuinely useful, with one sharp edge: the 3.11.x line released in February 2026 was a security series fixing JWT signature bypass and SSRF issues, and the fix is only fully effective if you configure the JWKS endpoint in its settings after updating. Run 3.11.3+, set the JWKS URL, and it’s a solid choice.

LDAP Authentication

For intranets authenticating against a directory, authLdap is the healthiest small project in this space: MIT-licensed, maintained continuously since 2010 by the same author, already tested against WP 7.1, with a 100/100 directory rating. It binds against any LDAP backend (OpenLDAP, Active Directory, Open Directory), creates a local WP user on first login so access survives an LDAP outage, and maps WordPress roles from directory attributes. The honest caveats are the bus factor of a single maintainer and that modern cloud-first setups are usually better served going through Entra with OIDC/SAML than binding LDAP over the public internet.

Which One to Pick

Whatever you pick, pair it with the basics that make the login screen boring: disable password fallback once SSO works (permit_wp_login => false), rate-limit wp-login.php at the edge, and keep application passwords and XML-RPC closed unless something genuinely needs them. Authentication plugins protect the front door; those close the windows.