Two-Factor Authentication Addon for Luxa Users Pro

A strong password isn’t enough anymore. Two-Factor Authentication adds a second, independent step to login — a 6-digit code from an authenticator app like Google Authenticator or Authy — so a stolen password alone can’t get anyone into an account. Secrets are encrypted at rest with authenticated encryption, not just base64’d and hoped for.

Features:

• TOTP codes compatible with Google Authenticator, Authy, Microsoft Authenticator, and any standard authenticator app
• One-time backup codes for account recovery, hashed the same way WordPress hashes passwords
• Secrets encrypted at rest with AES-256-GCM (authenticated encryption) — upgraded from AES-256-CBC with full backward compatibility for existing accounts
• Rate-limited code verification (max 5 attempts per login) to prevent brute-forcing the 6-digit code
• Requires the current password to disable 2FA — a hijacked session alone can’t turn protection off
• Enforced through every login path in Luxa Users (password, social login, mobile login) via the shared LoginGuard — no add-on can accidentally bypass it

Changelog:

= 1.0.2 =
* Fix: modules.js now uses localized strings instead of hardcoded English text
= 1.0.1 =
* Security: added per-token rate limiting to the code verification endpoint
= 1.0.0 =
* Security: upgraded secret encryption from AES-256-CBC to AES-256-GCM
* Fix: social login and mobile login could previously bypass the 2FA gate — now routed through LoginGuard
* Initial public release