75
Google Authenticator
A simple security tool that might actually let everyone in.
HealthyGrowing
75/100
Critical security flaws and compatibility issues make this simple plugin a major risk.
Active installs
~25,000
our estimate · wp.org shows 20k+
Rating
4.3★
135 ratings
Trend · vs a year ago
+506%
Growing fast
41 → 246 installs/day
Downloads over time
real new installs per day · release spikes shown separately from the trend2025-04-302025-08-082025-11-162026-02-232026-06-03
organicrelease spikerelease tailorganic trend · 14d rolling median
Growing fast · +506% in the last year
41/day a year ago→246/day today
Reviews
what people actually sayGoogle Authenticator is appreciated for its simplicity and ease of setup, but carries serious credibility concerns including a reported bug where any 6-digit code is accepted, recurring compatibility failures with newer PHP versions and third-party login forms, and a history of apparent abandonment.
What people like
- +Simple, lightweight setup with no unnecessary extras×4
- +Works reliably on supported/older PHP and WordPress versions×3
- +Easy to deploy across multiple sites and user roles×2
Common complaints
- −Critical security defect: any 6-digit code is accepted, rendering 2FA non-functional×2
- −Compatibility failures with PHP 8.0+, causing authentication errors and requiring manual database intervention to recover×2
- −Plugin can lock users out of the WordPress admin entirely, with no easy way to deactivate from the UI×2
- −Breaks login for users when third-party forms are used (e.g. WooCommerce login form)
- −Incompatible with WPS Hide Login plugin when using the Two Screen Signin option
- −Unhandled fatal JWT token timing error with no graceful error handling
- −GitHub repository went without updates for an extended period, raising abandonment concerns
Review trustMostly organic
- 4.18★Verified rating — holds steady vs the raw 4.30★
- 9%One-shot reviewers — most reviewers are active community members
- past spikeReview timing — up to 50% of all reviews landed in a single month
Reviews per month · 5★ vs lower
2024-04-152025-05-102026-06-04
5★ reviews1–4★ reviews
All-time ratings · 135 total
Latest reviews · 90 analyzed
- 2026-04-07★★★★★So glad to see this updated – been using it for years!Paul
- 2024-03-30★★★★★GreatTrần Quân
- 2023-05-04★★★★★Simply a missing feature in .ORGBart Bak
- 2023-04-30★★★★★errorntalam
- 2022-12-22★★★★★Works as expectedjjbbrr
- 2022-10-29★★★★★Plugin stopped workingsianvdheide
- 2022-10-29★★★★★Barely worksicedterminal
- 2022-08-30★★★★★Cannot reset after re-installElenbaas
- 2022-02-12★★★★★One on few my first-to-install pluginMarcin Pietrzak
- 2021-11-10★★★★★Works and gives me a better feeling with my siteMartin Richter1-shot
Releases
recent versions from WordPress.org SVNFor developers & the curious
the raw signals behind the grade — none of this is on the friendly summary aboveDownload signals
Baselines are computed on organic days only — release spikes and their tails are excluded, so they're not inflated by the auto-update wave.
189
Baseline · median of last 7 organic days
120
Prior 7-day baseline
137
Floor · 25th percentile over 14 days
468
Mean release-day peak (30d)
252
Latest day · 2026-06-03(organic)
+57.5%
Week-over-week organic trend
Review signals
Concentration and drive-by metrics drive the review-burst and fake-review flags. 30–40% solo reviewers is normal; we only flag the extremes.
50%
Max month share · biggest single 30-day window
3.54
Distribution CV · <0.6 even, >1.5 bursty
76%
5★ share in analyzed sample
9%
Solo reviewers · only this one wp.org activity
—
Volume velocity · last 6mo vs prior 6mo
4.21 → 4.18★
Sample avg · raw → solo-filtered