=== SecureAuth Authenticator 2FA ===
Contributors: helmimubarak  
Tags: two-factor-authentication, 2fa, login-security, wordpress-security, totp 
Requires at least: 5.0  
Tested up to: 6.8  
Stable tag: 1.0.0  
License: GPLv2 or later  
License URI: http://www.gnu.org/licenses/gpl-2.0.html  
Plugin URI: https://yourpluginwebsite.com/  
Author URI: https://yourwebsite.com/

Adds TOTP-based two-factor authentication (2FA) via SecureAuth Authenticator to your WordPress login page.

== Description ==

**SecureAuth Authenticator 2FA** enhances your WordPress login security by requiring a time-based one-time password (TOTP) in addition to the regular username and password. The TOTP code is generated by an authenticator app on your mobile device, adding an extra layer of protection even if your password is compromised.

This plugin is lightweight, secure, and easy to use. It integrates directly into the user profile page to allow users to set up and manage their two-factor authentication with ease.

**Features:**

- Adds a TOTP (Time-Based One-Time Password) field to the login form.
- User-friendly 2FA setup available on each user's profile page.
- Generates secret keys and displays QR codes for scanning with mobile apps.
- Compatible with apps like Google Authenticator, Microsoft Authenticator, and Authy.
- Secure handling with nonce verification and input sanitization.
- No external libraries required (except Google Chart API for QR code).

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/secureauth-authenticator-2fa` directory or install the plugin through the WordPress plugin screen.
2. Activate the plugin via the **Plugins** menu in WordPress.
3. Navigate to **Users > Your Profile** and scroll to the **SecureAuth Authenticator 2FA** section.
4. Scan the QR code using your mobile authenticator app and enable 2FA.
5. On your next login, you’ll be prompted to enter the TOTP code from your app along with your password.

== Frequently Asked Questions ==

= What if I lose access to my authenticator app? =  
You should always save the secret key provided during setup in a secure location. If you lose access, a site administrator can disable 2FA for your account directly through the database or your user profile.

= Does this plugin support recovery codes or backup options? =  
Not yet. This plugin is intentionally kept minimal to reduce complexity. However, recovery features may be added in future updates based on user feedback.

= Which user roles can enable 2FA? =  
Currently, any logged-in user with access to their profile page can enable 2FA individually.

= Is 2FA mandatory for all users? =  
No. As of version 1.0.0, 2FA is optional and must be enabled manually by each user.

== Screenshots ==

1. 2FA setup fields on the user profile page.
2. QR code display for scanning with an authenticator app.
3. Additional 2FA code input field on the WordPress login form.

== Changelog ==

= 1.0.0 =
* Initial release.
* Add TOTP-based 2FA support for WordPress login.
* QR code generation using Google Chart API.
* Secure nonce verification and input sanitization.

== Upgrade Notice ==

= 1.0.0 =
First stable release. Please test the plugin in a staging environment before deploying to production. Always ensure you have backup access to admin accounts.
