Title: Brain 2FA Author: Braintum Published: 2026년 10월 16일 Last modified: 2026년 10월 25일 --- 플러그인 검색 ![](https://ps.w.org/brain-2fa/assets/banner-772x250.png?rev=3752366) ![](https://ps.w.org/brain-2fa/assets/icon-256x256.png?rev=3751014) # Brain 2FA 작성자: [Braintum](https://profiles.wordpress.org/braintum/) [다운로드](https://downloads.wordpress.org/plugin/brain-2fa.1.2.0.zip) [실시간 미리보기](https://ko.wordpress.org/plugins/brain-2fa/?preview=1) * [세부사항](https://ko.wordpress.org/plugins/brain-2fa/#description) * [평가](https://ko.wordpress.org/plugins/brain-2fa/#reviews) * [설치](https://ko.wordpress.org/plugins/brain-2fa/#installation) * [개발](https://ko.wordpress.org/plugins/brain-2fa/#developers) [지원](https://wordpress.org/support/plugin/brain-2fa/) ## 설명 Brain 2FA protects WordPress accounts with a second authentication factor. After entering their password, users confirm their identity with a six-digit code from an authenticator app or from their email inbox. Users can also sign in without a password using a passkey. Codes are generated and passkeys are verified on your own server. Brain 2FA does not send any data to third-party services. #### Features * **Passkeys:** Sign in without a password using Face ID, Touch ID, Windows Hello, a phone or a security key. Passkeys are offered right in the username field, and a passkey sign-in counts as two-factor authentication. A passkey can also be the second step after a password, counts toward required two-factor setup, and users can optionally turn off password sign-in entirely. Requires HTTPS; turn it on under **Brain 2FA > Settings**. * **Authenticator apps (TOTP):** Works with Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden and any other TOTP-compatible app. Users set it up by scanning a QR code or entering the secret key manually. * **Email verification codes:** Sends a one-time code to the account email address, with a configurable expiry time. * **Recovery codes:** TOTP users receive one-time recovery codes they can download and regenerate in case they lose their phone. * **Role-based enforcement:** Require two-factor authentication for selected user roles, such as Administrator, Editor or Shop manager. * **Setup grace period:** Give users in required roles a set number of days to enable 2FA. After the deadline, they can sign in but only reach the setup page until 2FA is enabled. Administrators can see deadlines in the Users list and extend them from a user’s profile. * **Editable emails:** Change the subject and text of every email the plugin sends, from the sign-in code to setup reminders and security alerts, under **Brain 2FA > Settings > Emails**. Personalize them with placeholders such as `{user_display_name}`,`{ site_name}` and `{date_time}`, preview them as you type, send yourself a test, and reset any email to its default. You can also turn off individual alerts and set the sender name and address. * **Setup reminders:** Optionally email users in required roles before their setup deadline, 7 and 1 days ahead by default. Each user gets at most one reminder a day, and late reminders never pile up. * **Enrollment overview:** See at a glance how many users are protected, still have to set up two-factor authentication, or missed their deadline, for all roles or one role. Every number opens the matching filtered Users list, and the Users list can be filtered by 2FA status. * **Trusted devices:** Users can optionally skip the code on devices they trust, using expiring, password-hashed tokens. They see each trusted browser, when it was last used and when it expires on their Login Security page, and can forget one or all of them. * **Consistent enforcement:** The 2FA policy applies to every sign-in, including direct submissions of the login form, not only the JavaScript-assisted flow. The credential check before the code step is rate limited per IP address. * **WooCommerce support:** Works with the default WordPress login form and the WooCommerce My Account login form. Customers can set up and manage 2FA from a link on their My Account dashboard. * **Works without JavaScript:** If the login script cannot run, a verification code field is shown on the login form instead. * **Translation ready:** All user-facing text can be translated. #### Support Need help? Visit [Braintum Support](https://www.braintum.com/support/). ### Development The development source code and build tools for Brain 2FA are publicly available at: https://github.com/Braintum/brain-2fa The JavaScript files in `assets/js/` are generated from the source files in `src/ js/`. ## 스크린샷 [⌊Authentication Methods settings: turn on two-factor authentication, the authenticator app and email codes, with a status summary at the top.⌉⌊Authentication Methods settings: turn on two-factor authentication, the authenticator app and email codes, with a status summary at the top.⌉[ Authentication Methods settings: turn on two-factor authentication, the authenticator app and email codes, with a status summary at the top. [⌊Passkey settings: passkey sign-in, passkeys as a second factor, optional passkey- only accounts and the default code method.⌉⌊Passkey settings: passkey sign-in, passkeys as a second factor, optional passkey-only accounts and the default code method.⌉[ Passkey settings: passkey sign-in, passkeys as a second factor, optional passkey- only accounts and the default code method. [⌊Enrollment Requirements: choose the roles that must set up two-factor authentication, how many days they have to do it, and optional setup reminder emails.⌉⌊Enrollment Requirements: choose the roles that must set up two-factor authentication, how many days they have to do it, and optional setup reminder emails.⌉[ Enrollment Requirements: choose the roles that must set up two-factor authentication, how many days they have to do it, and optional setup reminder emails. [⌊Trusted Devices: let users skip the code on a trusted browser for a set number of days.⌉⌊Trusted Devices: let users skip the code on a trusted browser for a set number of days.⌉[ Trusted Devices: let users skip the code on a trusted browser for a set number of days. [⌊Emails: the sign-in code, the setup reminder and nine security alerts, each with editable text.⌉⌊Emails: the sign-in code, the setup reminder and nine security alerts, each with editable text.⌉[ Emails: the sign-in code, the setup reminder and nine security alerts, each with editable text. [⌊Editing an email: subject and text with placeholders, a live preview and a test email.⌉⌊Editing an email: subject and text with placeholders, a live preview and a test email.⌉[ Editing an email: subject and text with placeholders, a live preview and a test email. [⌊The Login Security page: a summary of your sign-in protection and your passkeys.⌉⌊ The Login Security page: a summary of your sign-in protection and your passkeys.⌉[ The Login Security page: a summary of your sign-in protection and your passkeys. [⌊Authenticator app setup: scan the QR code or enter the key manually, then confirm with a code.⌉⌊Authenticator app setup: scan the QR code or enter the key manually, then confirm with a code.⌉[ Authenticator app setup: scan the QR code or enter the key manually, then confirm with a code. [⌊Passkey-only sign-in: turn off password sign-in for your own account.⌉⌊Passkey- only sign-in: turn off password sign-in for your own account.⌉[ Passkey-only sign-in: turn off password sign-in for your own account. [⌊The WordPress login form with the "Sign in with a passkey" button.⌉⌊The WordPress login form with the "Sign in with a passkey" button.⌉[ The WordPress login form with the “Sign in with a passkey” button. [⌊A passkey as the second step after the password.⌉⌊A passkey as the second step after the password.⌉[ A passkey as the second step after the password. [⌊Authenticator app active, with one-time recovery codes to download and store safely.⌉⌊ Authenticator app active, with one-time recovery codes to download and store safely .⌉[ Authenticator app active, with one-time recovery codes to download and store safely. [⌊Overview: how many users are protected, have a setup deadline, missed it or have not started, for all roles or one role.⌉⌊Overview: how many users are protected, have a setup deadline, missed it or have not started, for all roles or one role.⌉[ Overview: how many users are protected, have a setup deadline, missed it or have not started, for all roles or one role. [⌊The Users list filtered by 2FA status, with each user's setup deadline.⌉⌊The Users list filtered by 2FA status, with each user's setup deadline.⌉[ The Users list filtered by 2FA status, with each user’s setup deadline. [⌊Trusted devices on the Login Security page: each browser that skips the second step, when it was last used, and a way to forget one or all.⌉⌊Trusted devices on the Login Security page: each browser that skips the second step, when it was last used, and a way to forget one or all.⌉[ Trusted devices on the Login Security page: each browser that skips the second step, when it was last used, and a way to forget one or all. ## 설치 1. Upload the `brain-2fa` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress Plugins screen. 2. Activate the plugin through the Plugins screen in WordPress. 3. Open **Brain 2FA > Settings** and enable two-factor authentication. 4. Configure authentication methods and role requirements as needed. ## FAQ ### How do users set up two-factor authentication? Users can open **Brain 2FA > Login Security** from the WordPress admin area and follow the setup instructions for the configured default method. ### Which authenticator apps are supported? Any app that supports time-based one-time passwords (TOTP), including Google Authenticator, Microsoft Authenticator, Authy, 1Password and Bitwarden. ### What happens if a user loses access to their authenticator app? TOTP users can use a recovery code. Site administrators can also manage setup grace periods from the user profile. ### Can I require two-factor authentication for specific roles? Yes. In **Brain 2FA > Settings**, select the roles that must use 2FA and set a grace period. Users in those roles get the configured number of days to complete setup. After that, or immediately with a grace period of 0, they can still sign in but are taken to the setup page and cannot use the rest of the site until 2FA is enabled. ### Does the plugin support WooCommerce login? Yes. The plugin supports the standard WooCommerce My Account login form. Customers can set up two-factor authentication from the link on their My Account dashboard. ### Can users sign in without a password? Yes, with passkeys. Enable **Passkeys** under **Brain 2FA > Settings**, then each user adds a passkey on their **Login Security** page (after confirming their password). On the login form they can pick their passkey from the username field or use the** Sign in with a passkey** button. Because a passkey checks the user’s fingerprint, face or device PIN, a passkey sign-in does not ask for a separate verification code. ### Do passkeys need HTTPS? Yes. Browsers only allow passkeys on secure (HTTPS) sites. On a site without HTTPS, the passkey options stay hidden. ### Can a passkey be used as the second factor after a password? Yes. After entering their password, users with a passkey can confirm with it instead of typing a code. A passkey also counts as two-factor authentication for roles that require it, so users can set up 2FA with a passkey alone. ### Can users turn off password sign-in? Yes, if you allow it under **Brain 2FA > Settings**. Users with a passkey can then turn off password sign-in on their Login Security page, so their account can only be accessed with a passkey. If they lose all their passkeys, an administrator can turn password sign-in back on from the user’s profile. ### What if a user loses the device with their passkey? Unless they turned off password sign-in, they can still sign in with their password( and a two-factor code, if they have one) and remove the lost passkey on their Login Security page. Administrators can remove all of a user’s passkeys from the user’s profile, which also turns password sign-in back on. ### Can I change the emails the plugin sends? Yes. Open **Brain 2FA > Settings > Emails** to edit the subject and text of the sign-in code email and of each security alert (for example “Two-factor authentication turned on” or “Passkey added”). Click a placeholder such as `{user_first_name}`,`{ site_name}` or `{login_security_url}` to insert it; the preview shows the result with sample values. Use **Send Test Email** to see it in your inbox, and **Reset to Default** to undo your changes. Emails you have not edited keep following the plugin’s translations. The sign-in code email cannot be turned off and must contain `{code}`, so users can always receive their code. The setup reminder is turned on and off under **Enrollment Requirements**. The security alerts can be turned off one by one, but we recommend keeping them: they tell users when someone changes their sign-in settings. Emails are sent as plain text. Under **Sender** you can set the From name and address; leave them empty to use your site’s normal mail settings. ### What happens to my data if I delete the plugin? Deactivating the plugin keeps all settings and every user’s setup. Deleting it from the Plugins screen removes everything Brain 2FA stored: settings, email templates, authenticator secrets, recovery codes, trusted devices and passkeys. Users then need to set up two-factor authentication again if you reinstall it. To keep the data when deleting the plugin, add `define( 'BRAIN2FA_KEEP_DATA_ON_UNINSTALL', true);` to `wp-config.php`. ### Does Brain 2FA connect to external services? No. Codes, QR codes and recovery codes are generated on your server, passkeys are verified on your server, and verification emails are sent through your site’s normal WordPress mail setup. ### Where can I get support? Visit [https://www.braintum.com/support/](https://www.braintum.com/support/). ## 후기 이 플러그인에 대한 평가가 없습니다. ## 기여자 & 개발자 “Brain 2FA”(은)는 오픈 소스 소프트웨어입니다. 다음의 사람들이 이 플러그인에 기여하였습니다. 기여자 * [ Braintum ](https://profiles.wordpress.org/braintum/) [자국어로 “Brain 2FA”(을)를 번역하세요.](https://translate.wordpress.org/projects/wp-plugins/brain-2fa) ### 개발에 관심이 있으십니까? [코드 탐색하기](https://plugins.trac.wordpress.org/browser/brain-2fa/)는, [SVN 저장소](https://plugins.svn.wordpress.org/brain-2fa/) 를 확인하시거나, [개발 기록](https://plugins.trac.wordpress.org/log/brain-2fa/)을 [RSS](https://plugins.trac.wordpress.org/log/brain-2fa/?limit=100&mode=stop_on_copy&format=rss) 로 구독하세요. ## 변경이력 #### 1.2.0 * New: Users see their trusted devices on the Login Security page: the browser and system, when it was trusted and last used, and when the trust expires. They can forget one device or all of them; the browser they are using is marked. * New: Brain 2FA > Overview shows how your users are protected: how many have a method, still have a setup deadline, missed it or have not started, and which methods they use, for all roles or one role. Every number opens the matching filtered Users list. * New: The Users list can be filtered by 2FA status. * New: Optional setup reminder emails before a user’s setup deadline (7 and 1 days ahead by default), turned on under Enrollment Requirements and editable under Emails. Each user gets at most one reminder a day, and a late reminder never comes with a backlog. Off by default. * Security: An authenticator code or recovery code submitted several times at once is now accepted only once. * Security: Email sign-in codes are stored only as a keyed hash. A code emailed before the update no longer works; users simply request a new one. * Improvement: Viewing the Users list, the Overview or another user’s profile no longer starts that user’s setup deadline. It starts when they next sign in, and the Users list shows them as “Required, not started” until then. * Improvement: The verification step on the WooCommerce My Account login form now matches the WooCommerce login fields. * Improvement: Developers can react to passkey changes with the `brain2fa_passkeys_changed` action. #### 1.1.0 * New: Passkeys for passwordless sign-in (Face ID, Touch ID, Windows Hello, phones and security keys). Passkeys are offered in the username field’s autofill and through a “Sign in with a passkey” button on the WordPress and WooCommerce login forms. Off by default; requires HTTPS. * New: Users add, rename and remove passkeys on their Login Security page. Adding or removing a passkey requires the account password, and users are emailed about each change. * New: Administrators can remove all of a user’s passkeys from the user’s profile. * New: A passkey can be the second step after a password, as an alternative to a code or as the only second factor. * New: Passkeys count toward required two-factor setup: users in required roles can enroll with a passkey alone. * New: Optional passkey-only accounts. When allowed under Brain 2FA > Settings, users can turn off password sign-in; administrators can turn it back on from the user’s profile. * New: Every email the plugin sends is editable under Brain 2FA > Settings > Emails: the sign-in code email and nine security alerts. Personalize them with placeholders( user name, site name, sign-in links, date and time, passkey name and more), preview changes as you type, send a test to yourself and reset to the default at any time. * New: Security alerts can be turned off individually, and the sender name and address can be set for plugin emails. * New: Developers can add placeholders with the `brain2fa_email_placeholders` filter and change any email before it is sent with `brain2fa_email_content`. * Security: A passkey sign-in requires the device’s biometric or PIN check and counts as two-factor authentication. A passkey that appears to have been copied is blocked, and the owner is notified. * Improvement: Brain 2FA > Settings is organized into tabs: Authentication Methods, Enrollment Requirements, Trusted Devices and Emails. Each tab saves on its own without changing the others, and a summary at the top shows whether two-factor authentication and passkeys are in effect. * Improvement: Passkey alerts now name the passkey that was added, removed or blocked. * Improvement: The settings page warns before you turn off the authenticator app or email codes while users rely on them, with the number of users who could no longer sign in with their password. * Improvement: The Login Security page starts with a summary of your sign-in protection, followed by separate sections for passkeys, two-factor codes, recovery codes and password sign-in. Errors appear next to the form that caused them. * Improvement: Deleting the plugin now removes all of its data (settings, email templates, user two-factor data and the passkeys table). Deactivating keeps everything; define `BRAIN2FA_KEEP_DATA_ON_UNINSTALL` to keep data on deletion. * Improvement: Compatibility with the next major version of the TOTP library (no more deprecation notice). * Improvement: A refreshed authenticator app QR code with rounded modules and the logo in a round badge. It stays sharp on high-resolution screens and no longer needs the GD extension. * Fix: Entering a wrong code while setting up an authenticator app no longer replaces the QR code you already scanned. #### 1.0.4 * New: Users who miss their setup deadline are no longer locked out. They can sign in, but only reach the setup page until two-factor authentication is enabled. A grace period of 0 now works as described: setup is required at the first sign- in. * New: WooCommerce customers can set up and manage two-factor authentication from a link on their My Account dashboard. * New: A verification code field is shown on login forms when JavaScript is unavailable. * Improvement: Email authentication is turned on only after you enter a code sent to your address, so broken site email cannot lock you out. * Improvement: Users whose role requires two-factor authentication must set up a new method right after deactivating, instead of getting a new grace period. * Security: Sessions started before a setup deadline are also restricted to the setup page once it passes. XML-RPC and REST logins stay blocked until setup is complete. #### 1.0.3 * Security: Limit failed verification attempts. After 5 failed codes, an account is locked out of verification for 15 minutes; repeated failures from one IP address are also limited. * Security: Turning off two-factor authentication and regenerating recovery codes now require your account password. * Security: A new authentication method can no longer be set up over an active one. * Security: Users receive an email when two-factor authentication is turned on or off, or recovery codes are regenerated. * Security: Trusted devices are revoked when a password is changed or reset. * Security: Email verification codes can only be used once, even with simultaneous requests. * Fix: The email code expiry setting is limited to 1–60 minutes. * Fix: The QR code area is hidden when the QR code cannot be generated; the secret key is still shown. #### 1.0.2 * Security: TOTP codes can no longer be reused within their validity window. * Fix: Clock-drift tolerance now correctly accepts the previous and next 30-second authenticator codes. #### 1.0.1 * Fix: PHP 8.4 deprecation notice in the TOTP fallback verification (explicit nullable` WP_User` parameter). #### 1.0.0 * Initial release. ## 기초 * 버전 **1.2.0** * 최근 업데이트: **1일 전** * 활성화된 설치 **10보다 적음** * 워드프레스 버전 ** 6.4 또는 그 이상 ** * 다음까지 시험됨: **7.1.3** * PHP 버전 ** 8.1 또는 그 이상 ** * 언어 * [English (US)](https://wordpress.org/plugins/brain-2fa/) * 태그: * [2FA](https://ko.wordpress.org/plugins/tags/2fa/)[Authenticator](https://ko.wordpress.org/plugins/tags/authenticator/) [security](https://ko.wordpress.org/plugins/tags/security/)[totp](https://ko.wordpress.org/plugins/tags/totp/) [two factor authentication](https://ko.wordpress.org/plugins/tags/two-factor-authentication/) * [고급 보기](https://ko.wordpress.org/plugins/brain-2fa/advanced/) ## 평점 아직 제출된 리뷰가 없습니다. [Your review](https://wordpress.org/support/plugin/brain-2fa/reviews/#new-post) [모든 리뷰 보기](https://wordpress.org/support/plugin/brain-2fa/reviews/) ## 기여자 * [ Braintum ](https://profiles.wordpress.org/braintum/) ## 지원 할 말 있으신가요? 도움이 필요하신가요? [지원 포럼 보기](https://wordpress.org/support/plugin/brain-2fa/)