Development work is in progress to implement two-factor authentication (2FA) for accounts on WordPress.org. (This is something we tried briefly once before, but it wasn’t ready for production use at the time).
To be absolutely clear: this is about rolling out 2FA for accounts on the WordPress.org web site itself – that is, for people like plugin and theme developers, WordCamp organizers, forum participants, Make site commenters, core developers, and contributors to the WordPress project in general. It will have no effect on the wider world of WordPress sites, except in the sense that we hope to set a good example and encourage others to use 2FA plugins.
The 2FA implementation that we’re using is provided by the Two Factor plugin, which is a well-established project with a long history that’s a candidate for eventual inclusion in WordPress core. It’s listed on the Beta page of the plugin directory.
Given the complexity of the Meta environment, and the large network of sites and customizations that powers the many parts of the WordPress.org web site, there is ongoing work needed to ensure the plugin integrates cleanly and securely everywhere it is needed.
Progress is happening on two fronts:
- On the Meta side, integrating 2FA into profile pages and other systems. This work is in the wporg-two-factor repo on GitHub.
- Enhancing and improving the canonical Two Factor community plugin itself. This work is in the two-factor repo.
We haven’t yet set a time frame for rolling out 2FA availability on accounts, but hope to have something you’ll be able to opt-in to try out in the early part of 2023.
In the meantime, if you are interested in helping to improve the two-factor plugin generally, you can install it on your own WordPress site to test it out, and get involved in its development on GitHub.