WP 2FA – uwierzytelnianie dwuskładnikowe dla WordPress

Rejestr zmian

4.0 (2027-07-07)

• Nowy interfejs użytkownika (UI)

  • A completely redesigned plugin interface, offering improved navigation, a more streamlined setup experience, better organization of settings, and a modern design.

Ważne: przejście na nowy interfejs jest procesem nieodwracalnym. Nowe instalacje domyślnie korzystają z nowego interfejsu, natomiast w przypadku aktualizacji zachowany zostaje obecny interfejs i można go zmienić w dowolnym momencie za pomocą nowego ustawienia Przejdź na nowy interfejs WP 2FA w sekcji Ustawienia ogólne.

• Nowe funkcje i możliwości

  • Added an Export table as CSV feature in the Reports, allowing administrators to export 2FA status data for analysis and reporting.

• Ulepszenia

  • The „learn more about backup codes” URL shown on the user profile is now editable via white labeling, allowing brands to replace or remove the default link.
  • Updated the bundled Select2 library to a more recent and secure version.
  • Hardened the shortcode return parameter handling to use proper URL validation instead of strip_tags(), preventing potential URL manipulation.
  • Updated the SSL check to use wp_die() instead of bare exit() calls for safer request termination.
  • Refreshed the install wizard copy across all four slides for clearer, more welcoming language and consistent use of the term „secondary 2FA method” instead of „alternative”.
  • Improved the libxml missing extension notice (required for TOTP method) with a clearer, more actionable message directing users to their hosting provider.
  • Moved the main **2FA code page text* * field to the top of the White Labeling → Customize 2FA code page tab,
  • Shortened the default SMS templates on fresh installs to stay under 160 characters, improving deliverability with strict carriers while remaining Twilio-compliant.
  • The verification code input on the 2FA login screen is now auto-focused, so users can start typing their code immediately without clicking into the field.
  • The {login_code} placeholder now also works in email subject lines, not only in the email body.
  • Improved feedback on the 3rd party integrations page: verification modals for Twilio, Clickatell, and all other providers are now consistently styled and show clear error messages when credentials are empty or invalid.
  • Verified 3rd party integration credentials are now automatically saved on successful validation, so they persist after a page refresh.
  • Declared WooCommerce compatibility with HPOS, Cart/Checkout Blocks, and the Product Block Editor, so WP 2FA no longer appears as „uncertain” in the WooCommerce compatibility dashboard.
  • Removed declare(strict_types=1) from all files to improve compatibility with WordPress hooks and prevent intermittent TypeError fatals when filters or actions pass loosely-typed values.
  • Removed a large block of commented-out legacy code from wp-2fa.php for cleaner code and easier maintenance.
  • Fixed inconsistent text domain usage in the deactivation class (was 'textdomain', now correctly uses 'wp-2fa'), ensuring all deactivation strings are translatable.
  • Updated the deactivation feedback form to version 1.1.
  • Refactored the plugin’s licensing architecture to improve maintainability and support future enhancements.
  • Removed the Quick Links feature from the plugin, along with its underlying code.
  • Removed the Survey and Changelog banners from the plugin UI.
  • Removed an obsolete white labeling option under Method selection.
  • Added a check when enabling the „Use custom logo” option: if no logo has been uploaded, a clear error message is now shown pointing to the 2FA code page design settings.
  • Removed the unecessary „Activate free version” button from Premium licensing prompt.
  • Improved custom CSS handling for buttons on the user profile area, so all WP 2FA buttons consistently pick up plugin styling (or the user’s custom CSS overrides) instead of falling back to WordPress defaults inconsistently.
  • Added help text under all subtitles on White Labeling → Customize 2FA code page → Edit content, providing a short description for each rich-text field.
  • Added missing hint help text on the Customize setup wizard page for the Email (HOTP), Yubico, Clickatell, Twilio, and Authy methods, explaining what the hint field controls during 2FA setup.
  • Added an upgrade modal that explains the benefits of full white labeling when users click locked white labeling options.
  • Passkeys can now be revoked only by the person who generated them instead of other site administrators.

• Poprawki błędów

  • Fixed: The WooCommerce /my-account/{2fa-endpoint}/ URL returned a 404 after any rewrite rules flush triggered from an admin request (e.g. saving Settings → Permalinks).
  • Optimized performance by removing unnecessary front-end checks for an expired event banner.
  • Fixed: wp_delete_post was being called with a post ID of 0 when saving settings under WordPress 6.9, triggering a _doing_it_wrong() notice and causing 500 errors on sites using Acorn / Sage.
  • Fixed: PHP Deprecated htmlspecialchars(): Passing null to parameter #1 shown inside the SMS template boxes on PHP 8.3 with WordPress 6.9.4+.
  • Fixed: PHP Deprecated Automatic conversion of false to array in the Authy and role settings controller extensions on PHP 8.3 multisite installations.
  • Fixed: PHP Notice Function WP_Scripts::add was called incorrectly. The script with the handle "wp_2fa_yubico" was enqueued with dependencies that are not registered: wp2fa-dialog in WordPress 6.9.1+.
  • Fixed: The Locked user status was not displayed next to a user after their grace period expired and they attempted to log in again.
  • Fixed: Users who configured 2FA voluntarily (without being enforced by a policy) were shown as Configured instead of the correct Configured (but not required) status.
  • Fixed: Users not covered by 2FA enforcement were shown as „User has not logged in yet, 2FA status is unknown” instead of „Not required”.
  • Naprawiono: na stronie „Raporty” liczba kluczy dostępu była zawsze wyświetlana jako 0, niezależnie od tego, ile kluczy faktycznie zarejestrowano.
  • Naprawiono: przewijanie w poziomie spowodowane powiadomieniami w kokpicie dotyczących szyfrowania i egzekwowania zabezpieczeń podczas przeglądania stron administracyjnych WP 2FA.
  • Naprawiono: Sselektory CSS zaczynające się od cyfry (np. #2fa-user-global-configuration) zostały przemianowane na poprawne selektory z prefiksem wp-2fa, żeby zachować spójność i zapewnić poprawną pracę z preprocesorami SCSS/LESS.
  • Naprawiono: pobieranie ustawień zdalnych przez FlyOut uwzględnia teraz preferencje użytkownika, co lepiej odpowiada oczekiwaniom dotyczącym zgodności z WordPress.org.

• Zmiany powodujące niekompatybilność

  • Eksporty ustawień w formacie JSON utworzone w wersjach starszych niż 4.0 nie mogą być zaimportowane do instalacji w wersji 4.0. Utwórz eksport ustawień od nowa, korzystając z wersji 4.0.
  • Dostosowywanie szablonów emaili jest teraz dostępne jako funkcja w pakiecie Enterprise. Dotychczasowe niestandardowe szablony emaili będą nadal działać bez żadnych zakłóceń.

Zapoznaj się z pełnym dziennikiem zmian wtyczki, aby uzyskać bardziej szczegółowe informacje o nowościach, ulepszeniach i poprawkach w poprzednich aktualizacjach wersji WP 2FA.