Title: SecondGate Author: SecondGateWP Published: August 23, 2026 Last modified: August 23, 2026 --- Search plugins ![](https://ps.w.org/secondgate/assets/banner-772x250.png?rev=3661828) ![](https://ps.w.org/secondgate/assets/icon-256x256.png?rev=3661828) # SecondGate By [SecondGateWP](https://profiles.wordpress.org/secondgatewp/) [Download](https://downloads.wordpress.org/plugin/secondgate.1.1.7.zip) * [Details](https://mlt.wordpress.org/plugins/secondgate/#description) * [Reviews](https://mlt.wordpress.org/plugins/secondgate/#reviews) * [Installation](https://mlt.wordpress.org/plugins/secondgate/#installation) * [Development](https://mlt.wordpress.org/plugins/secondgate/#developers) [Support](https://wordpress.org/support/plugin/secondgate/) ## Description This plugin’s free tier is permanent: passkeys, 2FA, brute-force protection, and country blocking are all included, with no artificial limitation and no time-limited trial. #### At a glance * Passkeys (WebAuthn) — Face ID, Touch ID, Windows Hello, or a hardware key, bound to your exact domain so it can’t be phished * Standard TOTP two-factor authentication — works with Google Authenticator, Authy, 1Password, Bitwarden, and any other standard authenticator app * Trusted devices — skip the 2FA prompt on a recognised device for 30 days, one click to forget it * Brute-force login protection — automatic IP and username lockout after repeated failed attempts, never locking out the real account owner * Country blocking — blacklist or whitelist, 166 countries, IPv4 + IPv6, matched locally against downloaded range data, no third-party lookup at request time * Verified crawler exemption — Googlebot, Bingbot, and other real search crawlers are automatically exempt from every block, confirmed via reverse+forward DNS rather than a fakeable user-agent string, so a blocking rule doesn’t accidentally catch a genuine crawler #### Why it works differently under the hood Every check runs locally, on your own server. No API keys, no third-party accounts, no telemetry sent anywhere. Country IP range data is downloaded once a day from public sources and matched against visitors entirely on your own site — nothing about your traffic is ever sent to us or anyone else. Two-factor authentication is generated and verified entirely on your own server too. TOTP codes and passkey credentials never leave your site. #### The one thing worth knowing about crawler verification Blocking traffic by country is only safe if it can’t accidentally catch Google. Most plugins check this by trusting whatever a visitor’s browser claims to be — but any visitor can set their User-Agent to say “Googlebot,” which means that check can be bypassed by anyone, and doesn’t actually protect your SEO the way it looks like it does. This plugin verifies real crawlers properly instead: a reverse-DNS lookup on the connecting IP, confirming the hostname belongs to the crawler’s real network, then a forward-DNS lookup confirming that hostname resolves back to the same IP. That’s the method Google’s own documentation recommends for verifying a crawler is genuine— not a name anyone could fake. ### External Services This plugin connects to two external sources, both required for the plugin to function, both with no account or API key: **GitHub** (raw.githubusercontent.com) — for downloading country IP range data used by country blocking. A plain GET request for a static public file, fetched once daily and matched locally afterward. No data about your site or its visitors is sent as part of this request. **DNS lookups** (not an HTTP call to any specific company) — when a visitor’s browser claims to be a known search crawler (Googlebot, Bingbot, etc.), this plugin performs a standard reverse+forward DNS lookup on that visitor’s IP, using your server’s normal DNS resolver, to verify the claim is real before exempting it from blocking. This is the same kind of lookup any web server does routinely; no data about your site or its visitors is sent anywhere as part of it. Two-factor authentication makes **no external service calls whatsoever** — TOTP codes and passkey verification happen entirely on your own server. GitHub’s terms: https://docs.github.com/en/site-policy/github-terms/github-terms- of-service ## Installation 1. Upload the plugin files to `/wp-content/plugins/secondgate`, or install directly through the WordPress plugins screen. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Go to Settings IP Block to configure country blocking, and Settings 2FA & Login Security for two-factor authentication settings. 4. Each user sets up their own 2FA/passkey individually from their own profile page( Users your name Two-Factor Authentication). ## FAQ ### Is this actually free, or is there a premium version? The features listed above are free, permanently, with no artificial limitation. A separate paid product, SecondGate Pro, exists as its own standalone plugin sold independently — it is never required for this plugin to work, and nothing in this plugin is disabled, nagged, or time-limited to push you toward it. ### Does this need an API key or account, for anything? No. Nothing in this plugin requires an account, an API key, or any third-party sign- up. ### Is my server behind Cloudflare or a load balancer — will blocking still work correctly? By default this plugin only trusts your server’s real connecting IP address (REMOTE_ADDR), which a visitor cannot forge. If you’re behind a proxy or CDN that rewrites the visitor’s real IP into a header, you can explicitly enable and select that header in Advanced settings — off by default, since trusting the wrong header by default is a well-documented vulnerability class in software that does IP-based blocking. ### Will this affect SEO? No — blocking only affects visitors from blocked sources viewing the site. Real search crawlers (Googlebot, Bingbot, and others) are automatically exempt from every blocking mechanism in this plugin, verified via reverse+forward DNS rather than trusting a user-agent string that anyone could fake — so a country rule that would normally apply is designed not to catch a genuine crawler. ### What if I lose my phone and can’t get a 2FA code? Use one of the backup codes generated when you first set up two-factor authentication, then set up 2FA again on your new device. ### Is this a full security firewall, like Wordfence or Sucuri? No — this plugin covers authentication (passkeys, 2FA, brute-force protection) and geo-blocking. It is not a web application firewall and does not scan for malware. ### Does this work with WordPress Multisite? This has not been tested on Multisite. It’s built and tested against standard single- site WordPress installs. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SecondGate” is open source software. The following people have contributed to this plugin. Contributors * [ SecondGateWP ](https://profiles.wordpress.org/secondgatewp/) [Translate “SecondGate” into your language.](https://translate.wordpress.org/projects/wp-plugins/secondgate) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/secondgate/), check out the [SVN repository](https://plugins.svn.wordpress.org/secondgate/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/secondgate/) by [RSS](https://plugins.trac.wordpress.org/log/secondgate/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.7 * Added a step-by-step modal wizard over the existing 2FA setup flow (Set Up 2FA scan QR confirm code save backup codes optional passkey), replacing the previous scroll-down form-table. The underlying setup logic, AJAX handlers, and nonces are unchanged; this is a UI redesign, not a security-relevant change. Three real bugs found and fixed through hands-on testing: a false “leave without saving?” browser prompt firing on an already-safe intentional reload, stale cached JS/ CSS after an update caused by static asset versioning (now versioned by file- modified time instead), and a one-time setup flag not being cleared on the faster, no-reload path, which could show the passkey prompt a second time after it was already completed. * Also confirmed: the CBOR decoder in this exact file was previously known to be byte-identical to Pro’s own already-differentially-tested version, but a claim resting on “identical to something tested” is weaker than “actually tested,” so it was run directly against this file too. Two independent passes, 4,609 structures cross-checked against a real, independent CBOR implementation, zero disagreements. No code changed. #### 1.1.6 * Fixed the new-country login alert comparing against the country-blocking selected list instead of a login’s real country, meaning it silently never fired on the overwhelming majority of real logins on any site without a broad country-blocking list configured. This mirrors a Pro fix, but the underlying detection mechanism it depends on didn’t exist in this plugin at all until now: a dedicated, gradually- synced local country dataset, built the same trusted way and from the same source this plugin already uses for its blocking-list data, and entirely decoupled from it, so a country having local detection data has no effect whatsoever on blocking decisions. A safety-net check added too, so sites already running an earlier version pick up the new background sync automatically rather than needing a fresh plugin activation to get it. 10 checks. Zero regressions. #### 1.1.5 * Ported this plugin’s own hardening pass forward from a larger, parallel security testing effort on the Pro codebase, every fix checked directly against this plugin’s real code first, not assumed to carry over. Fixed a real gap: the 2FA security- notification email reported the wrong IP on any site behind a CDN with trust- proxy-headers enabled, using raw REMOTE_ADDR instead of this plugin’s own shared, validated resolver, even though it was genuinely available. Ran real static analysis( PHPStan) against this plugin’s own actual codebase specifically, not assumed clean from Pro’s separate analysis; every finding checked against real behavior, two confirmed as genuine tool-stub limitations, two safe type-cleanliness casts applied. Zero regressions. #### 1.1.4 * Moved the optional per-request log from a predictable, unprotected file path to options storage. Converted 11 inline script/style blocks to WordPress’s own enqueue APIs. Removed unsupported comparative/absolute claims from the readme and description. #### 1.1.3 * Fixed brute-force lockout using its own proxy-unaware IP resolution instead of the shared, trust-proxy-aware resolver, which could let one attacker’s failed logins lock out every visitor sharing a CDN/proxy. Audited every other secret- comparison and rate-limiting path for the same issue: none found. #### 1.1.2 * Fixed a critical CIDR/IP-matching bug: a malformed prefix length previously decoded silently as “/0” (the entire address space) instead of being rejected, present independently in three places. Fixed at the source; two duplicates refactored to share the tested code. #### 1.1.1 * Hardened the WebAuthn CBOR decoder: whitelist-only constructs, nesting-depth/ input-size limits, exception handling broadened to Throwable. Fixed several parsing edge cases. Verified against RFC 8949 vectors, real passkey data, 200,000 fuzzed inputs. Parsing-layer fixes only, never an exploitable auth bypass. #### 1.1.0 * Added two dismissible dashboard notices: a pointer to SecondGate Pro (after 7 days of use) and a review request (after 14 days). Both dismiss permanently in one click; no functionality is gated by either. #### 1.0.0 * Initial release. Passkeys (WebAuthn), standard TOTP two-factor authentication, trusted devices, brute-force login protection, and country blocking across 166 countries (IPv4 + IPv6), with verified search-crawler exemption via reverse+forward DNS. ## Meta * Version **1.1.7** * Last updated **5 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 7.2 or higher ** * Language * [English (US)](https://wordpress.org/plugins/secondgate/) * Tags * [2FA](https://mlt.wordpress.org/plugins/tags/2fa/)[geo block](https://mlt.wordpress.org/plugins/tags/geo-block/) [passkeys](https://mlt.wordpress.org/plugins/tags/passkeys/)[security](https://mlt.wordpress.org/plugins/tags/security/) [two factor authentication](https://mlt.wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://mlt.wordpress.org/plugins/secondgate/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/secondgate/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/secondgate/reviews/) ## Contributors * [ SecondGateWP ](https://profiles.wordpress.org/secondgatewp/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/secondgate/)