Loved by store owners in 158+ countries
Add WooCommerce two factor authentication to My Account, checkout and wp-admin. After the password, customers and staff enter a 6-digit code from Google Authenticator or any authenticator app.
Rated 4.9/5 across Trustpilot, Google and Envato
Featured across the WordPress community
WooCommerce two factor authentication asks for a second proof after the password. Here that proof is a 6-digit code from an authenticator app on the user's phone.
The code changes every 30 seconds and follows the RFC 6238 time-based standard. A stolen password alone can no longer open the account.
WooCommerce has no two factor login of its own. This plugin adds it to the store's login forms, and it is part of our WooCommerce extensions range.
Bots try passwords leaked from other sites on your login form. Credential stuffing made up a median 19% of all sign in attempts in Verizon's 2025 research, and 12% at small businesses.
A second factor stops most of it. A 2023 study of Azure AD accounts found MFA cut the risk of compromise by 99.22%.
See how 2FA fixes itA customer scans a QR code once. After that, every sign in asks for the password and then a code from the app.
From the Two-Factor Authentication page in My Account. The app saves a secret only that phone and your store know.
On My Account, the checkout login or wp-login.php. The password is checked first, as always.
A code screen opens. The customer types the 6-digit code their app shows right now.
The code must match the current 30-second window and cannot be used twice. Then the customer is signed in.
A real code step for customers and staff, backup ways in for a lost phone, and the tools to see and control it all.
After a correct password, customers land on a code screen and enter the 6-digit code from their app. Six digits submit the form on their own.
Remember me and the page they came from are kept. A wrong password never reaches the code screen.
Returning customers who sign in from "Returning customer?" at checkout get the same code step. After the code, they go straight back to checkout.
The Checkout block has no login form of its own. Its login link opens the My Account login, which asks for the code.
The wp-login.php screen asks for a code too. Admins and shop managers protect wp-admin with the same authenticator app.
The WordPress Users screen gets a 2FA column, and every user profile gets a two-factor section. Admins can reset anyone's 2FA from there.
Customers get an authenticator app, scan the QR code and enter one code to confirm. 2FA turns on only after that code is right.
Cannot scan? A setup key with a Copy button works too. The QR code is drawn in the browser, and the secret is never sent to an outside service.
Phones get lost, broken and left at home. In Google's 2019 research, 38% of users did not have their phone when asked for a code.
Customers save ten one-time recovery codes when they turn 2FA on, with Copy, Download and Print. One code gets them back in without a support ticket.
Customers tick "Trust this device" on the code screen and skip the code on that browser for 30 days. You set the number of days.
The browser keeps a random cookie that scripts cannot read, and only its hash is saved on your store. Customers can remove all trusted devices at once.
Turn on email codes and the code screen gets an "Email code" tab. The customer gets a 6-digit code that works for 10 minutes.
Sending is limited to one code a minute and three per sign in. The setting is off by default, and you can keep it off for staff.
Pick the roles that must use 2FA, such as administrators and shop managers. They get reminders during a grace period, seven days by default.
After it ends, they can only use the setup page until 2FA is on, and they cannot turn it off. Customers stay free to choose.
One page in My Account shows the app, unused recovery codes and trusted devices. Customers create new codes or turn 2FA off with an app code.
A small card on the My Account dashboard invites customers without 2FA to set it up. A shortcode puts the same page anywhere.
Someone who knows a password could keep guessing codes. After five wrong codes, sign in to that account is blocked for 15 minutes.
You set both numbers, and the customer gets an email. Password guessing needs its own limit, covered in our guide to WordPress brute force protection.
Customers get an email when 2FA is turned on, turned off or reset. They also hear when a recovery code signs in or wrong codes lock the account.
You can get an alert when an account is locked out. The password was right in that case, which usually means it has leaked.
The Users screen lists everyone with their 2FA status, codes left, trusted devices and last verified login. Filter by 2FA On, 2FA Off or Setup Required.
A customer with no phone and no codes? Reset their 2FA from the list, alone or in bulk. They get an email and sign in with their password until they set it up again.
Eight cards show users with 2FA, adoption rate, verified logins, new setups, wrong codes, lockouts and recovery codes used. Each compares with the period before.
A chart plots verified logins, new setups and wrong codes per day. Coverage by Role shows how many people in each role have 2FA on.
Every setup, verified login, wrong code, lockout and reset is logged with the method, the login form and the IP address. Eleven event types in all.
Filter by event and date, search by IP or email, and export to CSV. Entries older than 90 days are deleted, or you keep them all.
No SMS fees, no third-party account and no theme edits. Your customers need a phone they already own.
The code step runs on the standard WordPress login check. It covers WooCommerce, WordPress and most custom login forms.
Most 2FA plugins are built for the WordPress admin, or charge extra for WooCommerce. This one is built around the store customer.
Customers turn on 2FA from their account page. They never see wp-admin.
My Account, the checkout login and wp-login.php, with a shortcode for any page.
Recovery codes, email codes and trusted devices are all included.
Enforce 2FA for the roles that matter with a grace period. Customers choose.
Code guessing stops after five tries, and you hear about it.
Emails for 2FA changes, resets, recovery codes and lockouts.
Adoption, verified logins, wrong codes and lockouts for any date range.
Each user's secret is encrypted with libsodium, and used codes are refused.
A six-step setup wizard turns it on, sets the backups and picks required roles.
We are official WooCommerce core contributors, and this plugin sits beside our other WooCommerce plugins.
More than 20 accepted contributions to WooCommerce core. The same care goes into how this plugin signs people in.
More than $125,000 in sales and 500+ five-star reviews across Trustpilot, Google and Envato.
A short setup wizard turns on 2FA, recovery codes, trusted devices and required roles.
Real WooCommerce developers answer your tickets. Every plan includes priority support and a 14-day refund.
No outside service and no extra library for codes. The code check runs on your own server.
Every label is translation ready, and the My Account page takes your own slug and title.
Elite Author
Sold more than $125,000 on Envato Market.
Featured Author
Made it to the Authors' Hall of Fame.
Community Health
Took part in community research initiatives.
WP Compliant
Keeps items to current WordPress standards.
Copyright Ninja
Helped protect against copyright violations.
Feedback Guru
Joined a group to improve the experience.
Trendsetter
Had an item that was trending.
Featured Item
Had an item featured on Envato Market.
Saved addresses, order history and store credit stay safe even when a password leaks.
Require 2FA for shop managers and admins who can see every order and customer.
Paid accounts are worth stealing. A code step keeps members' access in their own hands.
Buyers with credit terms and special prices get a second lock, required for their role if you like.
Pair 2FA with our WooCommerce CAPTCHA plugin against bots, or offer WooCommerce biometric login with passkeys.
Set the same 2FA rules on every client store in a minute. Need more? Our WooCommerce development team builds the rest.
Upload the plugin and activate it. The setup wizard opens and asks for your license key.
Name your store in the app. Turn on recovery codes, trusted devices and the wrong code lockout.
Scan the QR code from your profile, save your recovery codes and sign in again with a code.
Pick roles such as shop managers and set a grace period. Watch adoption on the dashboard.
Store owners kept asking us for two factor authentication their customers could actually use. The usual answer sent shoppers into wp-admin, and most of them never got there.
The other half of the story was staff. One leaked shop manager password can open every order and address in the store.
Version 2 of Google Authenticator is built around both. Customers turn it on from My Account in three steps. You can require it for staff, and a lost phone has a way back in.
One yearly price with every feature in it. No add-ons, no SMS fees and no limits on customers or sign ins.
Every plan works as long as your subscription stays active. It renews yearly until you cancel, and you can cancel anytime from your account. Every plan is backed by our 14-day refund policy.
$19/year
Just $1.58/mo when billed annually
$79/year
Just $6.58/mo when billed annually
$129/year
Just $10.75/mo when billed annually
If the plugin does not work as promised on your site, you have the backup of our 14-day refund policy to ask for your money back.
Every screen below comes from the plugin running a real WooCommerce store. The live demo is the same build and needs no account.
5 releases Updated Oct 21, 2026
Latest Major release
25 changes
2 changes
2 changes
1 change
Major release
1 change
No changes of this type yet.
Answers to what store owners ask us most about 2FA and Google Authenticator on WooCommerce.
Ask a QuestionYes. WooCommerce Google Authenticator by DevDiggers adds two factor authentication to the My Account login, the checkout login and wp-login.php. Customers set it up themselves from My Account, from $19 a year.
After the right password, the store asks for a 6-digit code from an authenticator app. The app and the store share a secret, and the code changes every 30 seconds. A thief with only the password cannot sign in.
Google Authenticator, Microsoft Authenticator, Authy, 1Password and any other app that makes time-based codes (TOTP). Google Authenticator is a Google app, and this plugin works with all of them.
They open the Two-Factor Authentication page in My Account. The QR code is there with a setup key to type by hand. After they scan it, one correct code turns 2FA on.
Only if you say so. 2FA is optional for everyone by default, and a dashboard card invites customers to turn it on. You can require it for any role, including customers.
Yes. Pick the roles in Required 2FA and set a grace period, seven days by default. After it ends, those users can only reach the setup page until 2FA is on.
They sign in with one of the recovery codes they saved, or with an email code if you turned that on. If neither is left, you reset their 2FA from the Users screen.
The Checkout block has no login form of its own. Its login link goes to the My Account login, which asks for the code. The classic checkout asks for the code in its own login form.
Only a sign in asks for a code, and guest checkout does not change. Customers who trust their device skip the code there for 30 days.
It stops code guessing. After five wrong codes, sign in to that account is blocked for 15 minutes, and the customer gets an email.
The lockout starts after a correct password. Password guessing needs its own limit. See how to limit login attempts in WordPress.
TOTP is one kind of second factor. A password plus a TOTP code is multi-factor authentication. NIST SP 800-63B lists one-time password apps as an accepted authenticator.
Yes. The code is made on the phone and never travels over the phone network, where a SIM swap could steal it. You pay no SMS fees either.
Yes. The wp-login.php screen asks for the code, and staff set up 2FA from a button on their user profile. XML-RPC and REST password logins are refused for 2FA accounts.
Yes, through application passwords, which keep working. For service accounts that sign in with a password, add them to Excluded Users.
The code step runs on password sign ins. Social login, magic links and passkey sign ins skip it, because they never use the password. Test your login plugins on a staging site first.
In your own database. Each secret is encrypted with libsodium, and recovery codes and trusted devices are stored only as hashes. Nothing is sent to Google or any other service.
It is built for the WooCommerce account journey, with setup in My Account and recovery included. Compare the best WooCommerce two factor authentication plugins, or work through our WooCommerce security checklist.
No. Google Authenticator is a premium plugin with one edition. Try every screen on the live demo or read the setup docs.
Add WooCommerce two factor authentication with Google Authenticator to My Account, checkout and wp-admin, with recovery codes and alerts built in. Try the live demo and then pick a plan.
What you get the day you turn it on.
from 500+ reviews
Store owners in 158+ countries run on DevDiggers.
Elite Author with $125,000+ in sales.
