Missing features

First and foremost – this is definitely a great plugin. I absolutely love the fact that it allows me to use shortcodes and create a frontend for the user to configure the 2fa without going in the backend (which I forbid for subscribers). Still, there are some essential things missing. All of them were already mentioned by others, but since the themes are locked out, I want to second them hoping to see them soon implemented.

1. Ability to choose alternative method on the 2fa code page. This means, if the user has selected the TOTP as default auth method, he/she has to be able to switch to alternative methods (only e-mail authentication for the moment) on the fly on the page where the TOTP codes are entered. Very often I have users that have a device with email access (like laptops), but don’t have their phones where the 2fa is configured (dead batteries, device in other room etc.) and need a one time access via mail. This is essential.

2. “Trust this device for X days” – this is a major showstopper for me to use the plugin. If I don’t offer this, I’ll get many, many … many angry (lazy) clients :-).

3. As I said – I love the fact that the plugin allows to build custom experience using shortcodes. As you might imagine – the biggest “hole” in this is the fact the authentication page itself can’t be built with a shortcode. Again – major showstopper. I can style the default login to some extent, of course, but it’s not the same you know.

4. Inline 2fa setup shortcode. The way the 2fa setup shortcode works is fine, but I guess it also loads additional script for popups etc. I’d actually feel perfectly fine with a setup that is still ajax, but just uses an inline div as container, so I can just embed it in a page or form in a given position.

Hope I was helpful somehow. Keep up the good work.