wp-content/plugins/hasp/hasp.php
Hasp
Two-factor authentication that does not lock out your whole team on the day you enable it.
== Description ==
Every two-factor rollout has the same failure: enforcement is switched on, half the team has not enrolled, and support spends a day issuing recovery codes. Hasp enforces after a grace period, prompts during it, and shows you enrolment progress so you know when it is safe.
Recovery is one-time codes plus an administrator-granted temporary bypass that expires in fifteen minutes and is logged. Email-based recovery is not offered, because it reduces two factors to one.
TOTP only. SMS is not supported and will not be: it is the weakest common second factor and offering it invites people to choose it.
== Screenshots ==
Numbered the way they ship in /assets/. Click any one to see it full width.
== Installation ==
- Install and activate the plugin.
- Enrol your own account first.
- Set a grace period and enable enforcement per role, watching the enrolment count.
Enforcement without a grace period is possible and the interface asks you twice.
== Frequently asked questions ==
Why no SMS?
SIM swapping. It is a second factor in name and the readme links to three write-ups of it failing.
Application passwords?
Unaffected, which is why they exist. The readme explains when that is a gap.
What if everyone is locked out?
A WP-CLI command grants a bypass. It requires shell access, which is the correct bar.
== Changelog ==
= 2.6.0 =
- Enrolment progress view per role, so enforcement is a decision with a number behind it.
- Administrator-granted temporary bypass, expiring and logged.
= 2.4.0 =
- Grace periods with in-admin prompts.
= 2.0.0 =
- Removed email-based recovery. Sites using it are migrated to one-time codes with a forced re-enrolment.