Title: SecondGate Author: SecondGateWP Published: August 23, 2026 Last modified: September 3, 2026 --- Search plugins ![](https://ps.w.org/secondgate/assets/banner-772x250.png?rev=3661828) ![](https://ps.w.org/secondgate/assets/icon-256x256.png?rev=3661828) # SecondGate By [SecondGateWP](https://profiles.wordpress.org/secondgatewp/) [Download](https://downloads.wordpress.org/plugin/secondgate.1.1.8.1.zip) * [Details](https://syr.wordpress.org/plugins/secondgate/#description) * [Reviews](https://syr.wordpress.org/plugins/secondgate/#reviews) * [Installation](https://syr.wordpress.org/plugins/secondgate/#installation) * [Development](https://syr.wordpress.org/plugins/secondgate/#developers) [Support](https://wordpress.org/support/plugin/secondgate/) ## Description This plugin’s free tier is permanent: passkeys, 2FA, brute-force protection, and country blocking are all included, with no artificial limitation and no time-limited trial. #### At a glance * Passkeys (WebAuthn) — Face ID, Touch ID, Windows Hello, or a hardware key, bound to your exact domain so it can’t be phished * Standard TOTP two-factor authentication — works with Google Authenticator, Authy, 1Password, Bitwarden, and any other standard authenticator app * Trusted devices — skip the 2FA prompt on a recognised device for 30 days, one click to forget it * Brute-force login protection — automatic IP and username lockout after repeated failed attempts, never locking out the real account owner * Country blocking — blacklist or whitelist, 166 countries, IPv4 + IPv6, matched locally against downloaded range data, no third-party lookup at request time * Verified crawler exemption — Googlebot, Bingbot, and other real search crawlers are automatically exempt from every block, confirmed via reverse+forward DNS rather than a fakeable user-agent string, so a blocking rule doesn’t accidentally catch a genuine crawler #### Why it works differently under the hood Every check runs locally, on your own server. No API keys, no third-party accounts, no telemetry sent anywhere. Country IP range data is downloaded once a day from public sources and matched against visitors entirely on your own site — nothing about your traffic is ever sent to us or anyone else. Two-factor authentication is generated and verified entirely on your own server too. TOTP codes and passkey credentials never leave your site. #### The one thing worth knowing about crawler verification Blocking traffic by country is only safe if it can’t accidentally catch Google. Most plugins check this by trusting whatever a visitor’s browser claims to be — but any visitor can set their User-Agent to say “Googlebot,” which means that check can be bypassed by anyone, and doesn’t actually protect your SEO the way it looks like it does. This plugin verifies real crawlers properly instead: a reverse-DNS lookup on the connecting IP, confirming the hostname belongs to the crawler’s real network, then a forward-DNS lookup confirming that hostname resolves back to the same IP. That’s the method Google’s own documentation recommends for verifying a crawler is genuine— not a name anyone could fake. ### External Services This plugin connects to two external sources, both required for the plugin to function, both with no account or API key: **GitHub** (raw.githubusercontent.com) — for downloading country IP range data used by country blocking. A plain GET request for a static public file, fetched once daily and matched locally afterward. No data about your site or its visitors is sent as part of this request. **DNS lookups** (not an HTTP call to any specific company) — when a visitor’s browser claims to be a known search crawler (Googlebot, Bingbot, etc.), this plugin performs a standard reverse+forward DNS lookup on that visitor’s IP, using your server’s normal DNS resolver, to verify the claim is real before exempting it from blocking. This is the same kind of lookup any web server does routinely; no data about your site or its visitors is sent anywhere as part of it. Two-factor authentication makes **no external service calls whatsoever** — TOTP codes and passkey verification happen entirely on your own server. GitHub’s terms: https://docs.github.com/en/site-policy/github-terms/github-terms- of-service ## Installation 1. Upload the plugin files to `/wp-content/plugins/secondgate`, or install directly through the WordPress plugins screen. 2. Activate the plugin through the ‘Plugins’ screen in WordPress. 3. Go to Settings IP Block to configure country blocking, and Settings 2FA & Login Security for two-factor authentication settings. 4. Each user sets up their own 2FA/passkey individually from their own profile page( Users your name Two-Factor Authentication). ## FAQ ### Is this actually free, or is there a premium version? The features listed above are free, permanently, with no artificial limitation. A separate paid product, SecondGate Pro, exists as its own standalone plugin sold independently — it is never required for this plugin to work, and nothing in this plugin is disabled, nagged, or time-limited to push you toward it. ### Does this need an API key or account, for anything? No. Nothing in this plugin requires an account, an API key, or any third-party sign- up. ### Is my server behind Cloudflare or a load balancer — will blocking still work correctly? By default this plugin only trusts your server’s real connecting IP address (REMOTE_ADDR), which a visitor cannot forge. If you’re behind a proxy or CDN that rewrites the visitor’s real IP into a header, you can explicitly enable and select that header in Advanced settings — off by default, since trusting the wrong header by default is a well-documented vulnerability class in software that does IP-based blocking. ### Will this affect SEO? No — blocking only affects visitors from blocked sources viewing the site. Real search crawlers (Googlebot, Bingbot, and others) are automatically exempt from every blocking mechanism in this plugin, verified via reverse+forward DNS rather than trusting a user-agent string that anyone could fake — so a country rule that would normally apply is designed not to catch a genuine crawler. ### What if I lose my phone and can’t get a 2FA code? Use one of the backup codes generated when you first set up two-factor authentication, then set up 2FA again on your new device. ### Is this a full security firewall, like Wordfence or Sucuri? No — this plugin covers authentication (passkeys, 2FA, brute-force protection) and geo-blocking. It is not a web application firewall and does not scan for malware. ### Does this work with WordPress Multisite? This has not been tested on Multisite. It’s built and tested against standard single- site WordPress installs. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SecondGate” is open source software. The following people have contributed to this plugin. Contributors * [ SecondGateWP ](https://profiles.wordpress.org/secondgatewp/) [Translate “SecondGate” into your language.](https://translate.wordpress.org/projects/wp-plugins/secondgate) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/secondgate/), check out the [SVN repository](https://plugins.svn.wordpress.org/secondgate/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/secondgate/) by [RSS](https://plugins.trac.wordpress.org/log/secondgate/?limit=100&mode=stop_on_copy&format=rss). ## Changelog Every entry below is a real, dated, one-line summary. The full detail for each, exactly what was found, how it was confirmed, and what testing backs it, lives on Pro’s security testing methodology page (this plugin shares real, tested code with Pro, and most fixes here are direct ports of the same real bugs found and fixed there), which has no length limit and is the authoritative record. #### 1.1.8.1 Real, complete fix, closed at both layers, not just documented: a cached page could later be served, unchanged, to a visitor who should now be blocked, if the block list changed after the cache was created. Now sets DONOTCACHEPAGE (reaching WordPress- plugin-based caches) AND sends a real Cache-Control header via nocache_headers()( reaching CDNs, reverse proxies, and server-level caches too, since that’s genuine HTTP protocol semantics, not a WordPress-only convention), whenever any blocking mechanism is active, for every visitor, not just a blocked one. Confirmed with real tests. Worth the honest trade-off: no page can be cached by any layer as long as blocking is configured, a deliberate choice, since a stale, wrongly-served page is worse than a slower one. #### 1.1.8 Two real, confirmed race conditions ported from Pro (brute-force lockout and daily stats, both fixed with real file locking after a real multi-process test confirmed the original code lost increments under concurrent load); the deny-list capped for consistency. #### 1.1.7 A step-by-step modal wizard added over the existing 2FA setup flow. Three real bugs found and fixed through hands-on testing: a false unsaved-changes browser prompt, stale cached JS/CSS after an update, and a setup flag not clearing on the faster path. #### 1.1.6 Ported the new-country login alert fix from Pro’s Session Guard work; the underlying detection mechanism didn’t exist here at all until this version, a full port, not a redirected function call. #### 1.1.5 A real gap found and fixed: the 2FA security-notification email used the raw connecting IP instead of this plugin’s own trusted-proxy-aware resolver, even though it was available. Independent static analysis run against this plugin’s own code. #### 1.1.4 The optional per-request log moved from a predictable, unprotected file path to options storage. All inline script/style output converted to WordPress’s own enqueue APIs. #### 1.1.3 Ported the shared IP-resolution fix from Pro: brute-force lockout now uses the same trusted-proxy-aware resolver as the rest of the plugin, instead of its own separate copy. #### 1.1.2 Ported a real CIDR-parsing fix from Pro: a malformed prefix length was being silently treated as “block everyone” instead of being rejected. #### 1.1.1 Ported the WebAuthn/passkey hardening pass from Pro: a narrowed decode whitelist, input-size and nesting-depth limits, and broadened exception handling. #### 1.1.0 and 1.0.0 Initial free-tier feature set: passkeys, TOTP two-factor authentication, brute-force protection, country blocking, and verified search-crawler exemption. ## Meta * Version **1.1.8.1** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 7.2 or higher ** * Language * [English (US)](https://wordpress.org/plugins/secondgate/) * Tags * [2FA](https://syr.wordpress.org/plugins/tags/2fa/)[geo block](https://syr.wordpress.org/plugins/tags/geo-block/) [passkeys](https://syr.wordpress.org/plugins/tags/passkeys/)[security](https://syr.wordpress.org/plugins/tags/security/) [two factor authentication](https://syr.wordpress.org/plugins/tags/two-factor-authentication/) * [Advanced View](https://syr.wordpress.org/plugins/secondgate/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/secondgate/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/secondgate/reviews/) ## Contributors * [ SecondGateWP ](https://profiles.wordpress.org/secondgatewp/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/secondgate/)