SPIDY 2FA LOGIN
SPIDY 2FA LOGIN adds a second layer of security to the WordPress login: after entering the correct password, the user is asked for a 6-digit code (email or SMS) or a biometric confirmation (fingerprint / Face ID via WebAuthn), depending on the method chosen for that account.
Why it’s different
Most two-factor plugins fall into one of two categories: dedicated 2FA plugins that rely on a separate authenticator app (Google Authenticator, Authy, and similar TOTP apps the user has to install and set up before they can even log in), or full security suites where 2FA is one small feature buried inside a much heavier toolkit of malware scanning, firewalls, and file monitoring — useful if you need all of that, overkill if you just want a second login step.
SPIDY 2FA LOGIN doesn’t ask the user to install anything. Email and SMS just work with a code. Biometric login uses the device’s own fingerprint sensor, Face ID, or a passkey already saved in the browser — the same technology behind passwordless sign-in on major websites — with automatic fallback to email if it’s ever unavailable, so nobody gets permanently locked out. Three methods, one plugin, nothing extra to install on either side.
What’s included
- Two-factor authentication via email code
- Optional SMS delivery via your own Twilio or Clickatell account (pay-as-you-go pricing set by the provider you choose)
- Biometric login (fingerprint / Face ID / passkey) via the WebAuthn/FIDO2 standard — requires PHP 8.2+ and an HTTPS site; falls back to email automatically if unavailable or no device is registered
- Simple, immediate user management panel with per-user method selection
- No user cap
- Translation-ready (all strings use the
spidy-2fa-logintext domain) — ready to receive community translations via translate.wordpress.org once listed
Testing environment
This plugin has always been developed and tested exclusively on live, publicly reachable WordPress and WooCommerce installations — never on a local or offline environment. Testing specifically took place on a subdomain (not the root/apex domain), which is relevant for the Biometric method: WebAuthn/FIDO2 scopes credentials to the Relying Party ID actually serving the page, so behavior on a subdomain reflects real-world multisite/staging-style setups rather than only the simplest single-root-domain case. This is stated here for accuracy, since local setups can hide issues (HTTPS, real SMTP delivery, actual mobile authenticators, real domain scoping) that only show up under real-world conditions.
External services
This plugin sends emails using WordPress’s native wp_mail() function: no data is transmitted to third parties for this feature.
The Biometric login method (WebAuthn/FIDO2) never sends any data to third parties: the cryptographic verification happens entirely on your own server and the user’s own device.
If you configure SMS delivery, the 6-digit login code and your site name are sent to your own Twilio or Clickatell account (whichever you choose) each time a user with SMS as their method and a saved phone number logs in. Message delivery, retention, and pricing are governed by the provider you choose — see Twilio’s privacy policy or Clickatell’s privacy policy.