WordPress.org is committed to protecting accounts that play a crucial role in the WordPress ecosystem. Accounts with commit access can push updates and changes to plugins and themes used by millions of WordPress sites worldwide. Securing these accounts is essential to preventing unauthorized access and maintaining the security and trust of the WordPress.org community.
As part of this ongoing effort, we are introducing a new security requirement: mandatory two-factor authentication (2FA) for plugin and theme authors, starting on October 1st, 2024.
In addition to mandatory 2FA, we’re introducing SVN passwords, replacing your user account password with an SVN-specific password for committing changes.
Configuring 2FA on Your Account
You may have noticed prompts when logging in to WordPress.org encouraging you to configure 2FA. If you haven’t yet, visit this link to do so: https://profiles.wordpress.org/me/profile/security.
Please ensure you store your backup codes securely, if you lose access to your two-factor authentication method and your backup codes, the process to regain access to your account may not be easy.
Separating SVN Password from Your WordPress.org Account
We’ve introduced an SVN password feature to separate your commit access from your main WordPress.org account credentials. This password functions like an application or additional user account password. It protects your main password from exposure and allows you to easily revoke SVN access without having to change your WordPress.org credentials. Generate your SVN password in your WordPress.org profile.
If you’re using a deployment script, such as a GitHub Action, you’ll need to update your stored password with this SVN password as well.
Why not use 2FA with SVN?
Due to technical limitations, 2FA cannot be applied to our existing code repositories, that’s why we’ve chosen to secure WordPress.org code through a combination of account-level two-factor authentication, high-entropy SVN passwords, and other deploy-time security features (such as Release Confirmations).
Need Support?
If you encounter any difficulties while setting up 2FA, follow the steps outlined in Configuring Two-Factor Authentication.
Additional information for generating SVN passwords can be found in Subversion Access.
If you’re a plugin author and haven’t read @chriscct7’s post Keeping Your Plugin Committer Accounts Secure, now’s a great time to do so.
If you find any bugs, have feedback or need more support, please reach out in the #meta slack channel or follow up here (don’t share any private information though).