Google Authenticator
Google Authenticator for your WordPress blog.
The facts
- Rating
- 4.3★ from 135
- Active installs
- 20k+
- Price
- Free
- Last updated
- 23 Aug 2026
- Added
- May 2011
- Requires WP
- 4.5
- Tested up to
- WP 7.1
- Downloads
- 751,187
Our analysis
AI-assistedThe Google Authenticator plugin for WordPress provides two-factor authentication by integrating with the Google Authenticator app available on various smartphones. This enhances the security of your WordPress login process, allowing you to enable it for specific users, such as administrators, while keeping it optional for others.
This plugin is suitable for users who are security conscious and already utilise the Google Authenticator app for other services. It also includes an App password feature for those needing to maintain their blog via external applications, though this may reduce overall security.
Best for: This plugin suits WordPress users looking to enhance their site's security with two-factor authentication.
What it does well
- ✓Enables two-factor authentication for WordPress logins
- ✓Integrates with the Google Authenticator app
- ✓Allows per-user activation of two-factor authentication
- ✓Free to use from the WordPress.org directory
Where it falls short
- •App password feature may compromise security
- •Limited feature information available
Verdict
The Google Authenticator plugin offers a straightforward solution for improving login security. However, users should consider the implications of enabling the App password feature.
From the developer
Ivan's own description of Google Authenticator, lightly tidied.
The Google Authenticator plugin for WordPress gives you two-factor authentication using the Google Authenticator app for Android/iPhone/Blackberry.
If you are security aware, you may already have the Google Authenticator app installed on your smartphone, using it for two-factor authentication on Gmail/Dropbox/Lastpass/Amazon etc.
The two-factor authentication requirement can be enabled on a per-user basis. You could enable it for your administrator account, but log in as usual with less privileged accounts.
If You need to maintain your blog using an Android/iPhone app, or any other software using the XMLRPC interface, you can enable the App password feature in this plugin,
but please note that enabling the App password feature will make your blog less secure.
Credits
Thanks to:
Miguel Mendez Z for responsibly disclosing a CSRF account lockout vulnerability.
Oleksiy for a bugfix in multisite.
Paweł Nowacki for the Polish translation
Fabio Zumbi for the Portuguese translation
Guido Schalkx for the Dutch translation.
Henrik.Schack for writing/maintaining versions 0.20 through 0.48
Tobias Bäthge for his code rewrite and German translation.
Pascal de Bruijn for his “relaxed mode” idea.
Daniel Werl for his usability tips.
Dion Hulse for his bugfixes.