Two-factor for WordPress, approved with a tap
After the password, WordPress holds the login open and the U2 Secured Authenticator app on the user’s phone asks them to approve it, matching the number on screen. No code to copy, and a push someone else started cannot be approved by reflex.
The plugin is free on wordpress.org. It needs a developer account at U2 Secured to send the pushes, and the free Developer plan covers a small site.
What the plugin does
Push with number matching
The login page shows a number; the user taps the same one in the app. Faster than typing a code and harder to trick than a bare Approve button.
Recovery codes that need no network
Ten single-use codes are issued when a user links their phone, checked against your own database, so a user can still sign in if U2 Secured cannot be reached.
Authenticator-app codes as a fallback
A standard six-digit code, checked on your own server against the secret the site holds encrypted, rate-limited per user.
Require it by role, with a grace period
Turn two-factor on for administrators or any role, and give each user a number of days to link their phone before they are blocked.
Step-up for sensitive actions
Installing plugins and other powerful capabilities can ask for a fresh tap even in the middle of a session.
Fails closed, with a rescue
An unreachable API, a missing key or a revoked key means ask again or refuse, never let through. An administrator with shell access can always run wp u2auth disable to let a locked-out user back in.
How it compares with the popular two-factor plugins
The most-installed two-factor plugins ask for a typed code. Push approval, where the user taps to approve, is the difference that matters day to day. Read from each plugin’s own page.
Set up in three steps
- 1
Install the plugin
Plugins → Add New, search for DollarMates U2 Secured Authenticator, install and activate.
- 2
Create an app and connect the site
In the U2 Secured developer portal, create an app for the site and an API key, paste the key into the plugin’s settings and press Test connection.
- 3
Link phones, then require it
Each user links the U2 Secured Authenticator app from their profile page. When everyone who needs it has linked, require two-factor for their roles.
What it costs
The plugin is free. Pushes are sent by a U2 Secured developer account, on the same plans as every integration.
| Plan | Price | Includes |
|---|---|---|
| Developer | Free | 1,000 active users and 100 push approvals a month, 1 app. Codes are unlimited. |
| Growth | $99/month | 25,000 active users and 100,000 push approvals a month, 5 apps. Codes are unlimited. |
| Team | $149/month | 75,000 active users and 300,000 push approvals a month, 20 apps. Codes are unlimited. |
| Scale | $199/month | 250,000 active users and 1,000,000 push approvals a month, unlimited apps. Codes are unlimited. |
One flat monthly price per developer account, not a price per user or per machine. A fleet of servers is one app; each person who signs in counts once a month however many machines they use. Codes from the app (TOTP) and backup codes are never metered on any plan.
Questions site owners ask
- Is the plugin free?
- Yes, on wordpress.org. The pushes come from a U2 Secured developer account; the free Developer plan includes 100 push approvals a month, and the paid plans are a flat monthly price with no per-user or per-site fee.
- What if my site cannot reach U2 Secured?
- A linked user signs in with a recovery code or an authenticator-app code, both checked on your own server. A user who must use two-factor but has no way to is refused, not let in.
- What if a user loses their phone and their recovery codes?
- An administrator runs wp u2auth disable with the user’s login, ID or email. That clears the two-factor link on the site and lets them in to link a new phone.
- Which roles have to use it?
- The ones you choose. Linking is opt-in until you require it for a role, and each user gets a grace period you set before they are blocked.
Sources for the other plugins
Read from each plugin’s wordpress.org page or its vendor’s pricing page on the date shown. Plugins change; their own pages are the authority.
- wordpress.org — Two Factor · read 2026-10-24
- wordpress.org — Wordfence Security · read 2026-10-24
- Melapress — WP 2FA pricing · read 2026-10-24
- miniOrange — WordPress 2FA pricing · read 2026-10-24