diff --git a/inc/spbc-auth.php b/inc/spbc-auth.php
index 1c60b3a99..9ecb2e58b 100644
--- a/inc/spbc-auth.php
+++ b/inc/spbc-auth.php
@@ -1,12 +1,14 @@
 <?php
 
 use CleantalkSP\Common\TT;
+use CleantalkSP\Common\TextPlateStatic;
 use CleantalkSP\Common\RateLimit\RateLimiterConfig;
 use CleantalkSP\SpbctWP\Counters\SecurityCounter;
 use CleantalkSP\SpbctWP\Firewall\WafBlocker;
 use CleantalkSP\SpbctWP\G2FA\GoogleAuthenticator;
 use CleantalkSP\SpbctWP\G2FA\QRCode;
 use CleantalkSP\SpbctWP\SpbcRateLimit\SpbcRateLimiter;
+use CleantalkSP\SpbctWP\SpbcRateLimit\SpbcUserRateLimiter;
 use CleantalkSP\SpbctWP\UsersPassCheckModule\UsersPassCheckModel;
 use CleantalkSP\SpbctWP\Variables\Cookie;
 use CleantalkSP\SpbctWP\Helpers\IP;
@@ -50,12 +52,16 @@
 add_filter('manage_users_custom_column', 'spbc_user_last_login_column_content', 10, 3);
 
 if ( isset($spbc) && ($spbc instanceof \CleantalkSP\SpbctWP\State ) && $spbc->settings['2fa__enable'] ) {
-    if (Server::inUriCanonical('wp-login.php') && !empty($_POST)) {
+    // Registered by the POST field, not by URI: the login page could be renamed
+    if (isset($_POST['spbc_2fa'])) {
         add_action('init', 'spbc_2fa_rate_limit', 10, 1);
     }
     add_action('login_form_login', 'spbc_2fa__authenticate', 1);     // Authenticate with Code
     add_action('login_form', 'spbc_2fa__show_field', 10);
     add_action('after_password_reset', 'spbc_2fa__2fa_app_replace_meta', 10, 1);
+    add_action('after_password_reset', 'spbc_2fa__user_rate_limiter_reset', 10, 1);
+    // A challenge issued for the old password must not complete the login
+    add_action('after_password_reset', 'spbc_2fa__challenge_revoke', 10, 1);
     // Profile page hook
     add_action('show_user_profile', 'spbc_2fa__SelfUserProfileEdit', 1);
     add_action('edit_user_profile', 'spbc_2fa__SelfUserProfileEdit', 1);
@@ -74,7 +80,300 @@
  */
 function spbc_2fa__2fa_app_replace_meta(\WP_User $user)
 {
-    return delete_user_meta($user->ID, 'spbc_2fa_type') && delete_user_meta($user->ID, 'spbc_2fa_app_token');
+    delete_user_meta($user->ID, 'spbc_2fa_type');
+    delete_user_meta($user->ID, 'spbc_2fa_app_token');
+    delete_user_meta($user->ID, 'spbc_2fa_last_step');
+
+    return get_user_meta($user->ID, 'spbc_2fa_type', true) === ''
+        && get_user_meta($user->ID, 'spbc_2fa_app_token', true) === '';
+}
+
+/**
+ * Issue a one-time token proving that the first factor (password) has been passed.
+ * Stored hashed in user meta (one record per user, overwritten on each login) and sent to the browser as HttpOnly cookie.
+ *
+ * @param \WP_User $user
+ *
+ * @return void
+ */
+function spbc_2fa__step_token_issue(\WP_User $user)
+{
+    $token   = bin2hex(random_bytes(32));
+    $expires = time() + SPBC_2FA_KEY_TTL;
+
+    update_user_meta(
+        $user->ID,
+        'spbc_2fa_step',
+        array(
+            'hash'    => hash('sha256', $token),
+            'expires' => $expires,
+            'fails'   => 0,
+        )
+    );
+
+    spbc_2fa__step_cookie_set($token, $expires);
+}
+
+/**
+ * @param string $value
+ * @param int    $expires
+ *
+ * @return void
+ */
+function spbc_2fa__step_cookie_set($value, $expires)
+{
+    if ( headers_sent() ) {
+        return;
+    }
+
+    /**
+     * COOKIE_DOMAIN is false by default in WordPress, despite Psalm's string type
+     * @psalm-suppress RedundantCast
+     */
+    $domain = defined('COOKIE_DOMAIN') ? (string) COOKIE_DOMAIN : '';
+
+    \CleantalkSP\Variables\Cookie::set(
+        'spbc_2fa_step',
+        $value,
+        $expires,
+        '/',
+        $domain,
+        is_ssl(),
+        true,
+        'Lax'
+    );
+}
+
+/**
+ * @return string Token from the request or empty string
+ */
+function spbc_2fa__step_token_get_from_request()
+{
+    /**
+     * $_COOKIE value may be an array (spbc_2fa_step[]=...), despite Psalm's string type
+     * @psalm-suppress RedundantCondition
+     */
+    $token = isset($_COOKIE['spbc_2fa_step']) && is_string($_COOKIE['spbc_2fa_step'])
+        ? $_COOKIE['spbc_2fa_step']
+        : '';
+
+    return preg_match('/^[a-f0-9]{64}$/', $token) ? $token : '';
+}
+
+/**
+ * Check that the current request carries a valid 2FA step token for the user.
+ *
+ * @param \WP_User $user
+ *
+ * @return bool
+ */
+function spbc_2fa__step_token_is_valid(\WP_User $user)
+{
+    $token = spbc_2fa__step_token_get_from_request();
+    if ( $token === '' ) {
+        return false;
+    }
+
+    $step = get_user_meta($user->ID, 'spbc_2fa_step', true);
+    if ( ! is_array($step) || empty($step['hash']) || empty($step['expires']) ) {
+        return false;
+    }
+
+    if ( (int) $step['expires'] < time() || (int) $step['fails'] >= SPBC_2FA_MAX_ATTEMPTS ) {
+        delete_user_meta($user->ID, 'spbc_2fa_step');
+        return false;
+    }
+
+    return hash_equals((string) $step['hash'], hash('sha256', $token));
+}
+
+/**
+ * Atomically replace (or delete) the stored step token record, only if it still equals $old.
+ * Of concurrent requests holding the same record exactly one succeeds.
+ *
+ * @param \WP_User   $user
+ * @param array      $old Record read by this request
+ * @param array|null $new New record or null to delete
+ *
+ * @return bool
+ */
+function spbc_2fa__step_token_swap(\WP_User $user, array $old, $new = null)
+{
+    global $wpdb;
+
+    if ( $new === null ) {
+        $result = $wpdb->query(
+            $wpdb->prepare(
+                "DELETE FROM {$wpdb->usermeta} WHERE user_id = %d AND meta_key = %s AND meta_value = %s",
+                $user->ID,
+                'spbc_2fa_step',
+                maybe_serialize($old)
+            )
+        );
+    } else {
+        $result = $wpdb->query(
+            $wpdb->prepare(
+                "UPDATE {$wpdb->usermeta} SET meta_value = %s WHERE user_id = %d AND meta_key = %s AND meta_value = %s",
+                maybe_serialize($new),
+                $user->ID,
+                'spbc_2fa_step',
+                maybe_serialize($old)
+            )
+        );
+    }
+
+    wp_cache_delete($user->ID, 'user_meta');
+
+    return (int) $result > 0;
+}
+
+/**
+ * Atomically count a code attempt before the code check, so parallel requests can't exceed the per-token limit.
+ *
+ * @param \WP_User $user
+ *
+ * @return array|false Reserved record or false if the token was changed by a concurrent request
+ */
+function spbc_2fa__step_token_reserve_attempt(\WP_User $user)
+{
+    $step = get_user_meta($user->ID, 'spbc_2fa_step', true);
+    if ( ! is_array($step) ) {
+        return false;
+    }
+
+    $reserved          = $step;
+    $reserved['fails'] = (int) $step['fails'] + 1;
+
+    return spbc_2fa__step_token_swap($user, $step, $reserved) ? $reserved : false;
+}
+
+/**
+ * Atomically consume the token on the correct code. Only one of concurrent requests may log in.
+ *
+ * @param \WP_User $user
+ * @param array    $reserved Record returned by spbc_2fa__step_token_reserve_attempt()
+ *
+ * @return bool
+ */
+function spbc_2fa__step_token_claim(\WP_User $user, array $reserved)
+{
+    return spbc_2fa__step_token_swap($user, $reserved, null);
+}
+
+/**
+ * Handle a wrong code. Destroys the step token when attempts are exhausted.
+ *
+ * @param \WP_User $user
+ * @param array    $reserved Record returned by spbc_2fa__step_token_reserve_attempt()
+ *
+ * @return bool True if the step token is still usable
+ */
+function spbc_2fa__step_token_after_fail(\WP_User $user, array $reserved)
+{
+    if ( (int) $reserved['fails'] < SPBC_2FA_MAX_ATTEMPTS ) {
+        return true;
+    }
+
+    spbc_2fa__challenge_revoke($user);
+    spbc_2fa__step_cookie_set('', time() - 3600);
+
+    return false;
+}
+
+/**
+ * Revoke the pending 2FA challenge: the step token and the e-mail code.
+ * The password has to be entered again to get a new one.
+ *
+ * @param \WP_User $user
+ *
+ * @return void
+ */
+function spbc_2fa__challenge_revoke(\WP_User $user)
+{
+    global $spbc;
+
+    delete_user_meta($user->ID, 'spbc_2fa_step');
+
+    if ( isset($spbc->data['2fa_keys'][ $user->user_login ]) ) {
+        unset($spbc->data['2fa_keys'][ $user->user_login ]);
+        $spbc->save('data');
+    }
+}
+
+/**
+ * Per-user limiter of 2FA code attempts. Not reset by a new password login and not bound to IP.
+ *
+ * @param \WP_User $user
+ *
+ * @return SpbcUserRateLimiter
+ */
+function spbc_2fa__user_rate_limiter(\WP_User $user)
+{
+    return new SpbcUserRateLimiter(
+        new RateLimiterConfig('2fa_user_attempts', SPBC_2FA_USER_MAX_ATTEMPTS, SPBC_2FA_USER_LOCK_PERIOD),
+        $user->ID
+    );
+}
+
+/**
+ * Unlock 2FA step after the password reset: the user has proved access to the account e-mail.
+ *
+ * @param \WP_User $user
+ *
+ * @return void
+ */
+function spbc_2fa__user_rate_limiter_reset(\WP_User $user)
+{
+    spbc_2fa__user_rate_limiter($user)->reset();
+}
+
+/**
+ * Check 2FA application (TOTP) code with replay protection.
+ *
+ * @param \WP_User $user
+ * @param string   $secret
+ * @param string   $code
+ * @param bool     $is_reused Set to true if the code is correct but its time step was already used
+ * @param bool     $mark_used Mark the time step as used right away. Pass false to call spbc_2fa__app_code_mark_used()
+ *                            later, after the step token is claimed
+ *
+ * @return bool
+ */
+function spbc_2fa__app_code_check(\WP_User $user, $secret, $code, &$is_reused = false, $mark_used = true)
+{
+    $ga        = new GoogleAuthenticator();
+    $time_step = (int) floor(time() / 30);
+    $is_reused = false;
+
+    if ( ! hash_equals((string) $ga->getCode($secret, $time_step), (string) $code) ) {
+        return false;
+    }
+
+    // Reject the code if it (or a newer one) was already used
+    $last_step = (int) get_user_meta($user->ID, 'spbc_2fa_last_step', true);
+    if ( $time_step <= $last_step ) {
+        $is_reused = true;
+        return false;
+    }
+
+    if ( $mark_used ) {
+        spbc_2fa__app_code_mark_used($user);
+    }
+
+    return true;
+}
+
+/**
+ * Mark the current time step as used. If the step has changed since the check, the newer one is marked,
+ * which rejects the checked code as well.
+ *
+ * @param \WP_User $user
+ *
+ * @return void
+ */
+function spbc_2fa__app_code_mark_used(\WP_User $user)
+{
+    update_user_meta($user->ID, 'spbc_2fa_last_step', (int) floor(time() / 30));
 }
 
 /**
@@ -223,6 +522,7 @@ function spbc_authenticate($user, $username)
             if ( $type2fa !== '2fa_application' ) {
                 spbc_2fa__send_mail($user);
             }
+            spbc_2fa__step_token_issue($user);
             $woocommerce_additional_query_string = '';
             if (
                     spbc_is_plugin_active('woocommerce/woocommerce.php') &&
@@ -867,7 +1167,8 @@ function spbc_2fa__show_field()
         if ( $spbc_2fa_user ) {
             $user = spbc_get_user_by('login', rawurldecode($spbc_2fa_user));
 
-            if ( ! $user ) {
+            // The code form is shown only to the one who has just passed the password check
+            if ( ! $user || ! spbc_2fa__step_token_is_valid($user) ) {
                 return;
             }
 
@@ -887,7 +1188,30 @@ function spbc_2fa__show_field()
             }
 
             // Error displaying
-            if ( isset($_GET['spbc_2fa_error']) ) {
+            if ( Get::getString('spbc_2fa_error') === '2' && $type2fa === '2fa_application' ) {
+                // Correct code, but its time step is already used
+                $json_flags = JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT;
+                echo TextPlateStatic::render(
+                    '
+<script>
+    (function () {
+        const spbc_err = document.createElement("div");
+        spbc_err.id = "login_error";
+        const spbc_err_title = document.createElement("strong");
+        spbc_err_title.textContent = {{title}};
+        spbc_err.appendChild(spbc_err_title);
+        spbc_err.appendChild(document.createTextNode({{text}}));
+        const spbc_login = document.getElementById("login");
+        spbc_login.insertBefore(spbc_err, spbc_login.children[1]);
+    })();
+</script>
+                    ',
+                    array(
+                        'title' => wp_json_encode(__('CODE ALREADY USED: ', 'security-malware-firewall'), $json_flags),
+                        'text'  => wp_json_encode(__('Please, wait for the next code in your 2FA Code application and try again in 30 seconds.', 'security-malware-firewall'), $json_flags),
+                    )
+                );
+            } elseif ( isset($_GET['spbc_2fa_error']) ) {
                 echo '<script>'
                      . 'var spbc_err = document.createElement("div");'
                      . 'spbc_err.innerHTML = \'<div id="login_error">'
@@ -958,21 +1282,7 @@ function spbc_2fa__key_generate_and_store($user)
     global $spbc;
 
     // Generate key
-    $left_part_for_pad = hexdec(substr(hash('sha256', $spbc->data['salt'] . rand(0, getrandmax())), 0, 6)) % 1000;
-    $right_part_for_pad = hexdec(substr(hash('sha256', $spbc->data['salt'] . rand(0, getrandmax())), 0, 6)) % 1000;
-    $left_part  = str_pad(
-        (string) $left_part_for_pad,
-        3,
-        '1',
-        STR_PAD_LEFT
-    );
-    $right_part = str_pad(
-        (string) $right_part_for_pad,
-        3,
-        '0',
-        STR_PAD_LEFT
-    );
-    $key        = $left_part . $right_part;
+    $key = (string) random_int(100000, 999999);
 
     $spbc->data['2fa_keys'][ $user->user_login ] = array(
         'generated' => time(),
@@ -1027,33 +1337,78 @@ function spbc_2fa__authenticate()
 
     if ( $spbc->settings['2fa__enable'] ) {
         if ( isset($_POST['spbc_2fa'], $_POST['log']) ) {
-            $user = get_user_by('login', $_POST['log']);
+            $login = is_string($_POST['log']) ? wp_unslash($_POST['log']) : '';
+            $code  = is_string($_POST['spbc_2fa']) ? trim(wp_unslash($_POST['spbc_2fa'])) : '';
+
+            $user = get_user_by('login', $login);
 
             if (!$user) {
-                $user = get_user_by('email', $_POST['log']);
+                $user = get_user_by('email', $login);
             }
 
             if ( $user instanceof WP_User ) {
+                // The code is accepted only as a continuation of the successful password check
+                if (
+                    ! spbc_is_user_role_in($spbc->settings['2fa__roles'], $user) ||
+                    ! spbc_2fa__step_token_is_valid($user)
+                ) {
+                    spbc_2fa__failed($user, true);
+                }
+
+                // Every attempt is counted atomically before the code check, so parallel requests can't exceed the limit
+                $user_rate_limiter = spbc_2fa__user_rate_limiter($user);
+                if ( ! $user_rate_limiter->checkPassed() ) {
+                    spbc_2fa__locked($user);
+                }
+
+                // Per-token attempt is reserved atomically too; a concurrent request holding the same token loses
+                $step = spbc_2fa__step_token_reserve_attempt($user);
+                if ( ! $step ) {
+                    spbc_2fa__failed($user, true);
+                }
+
                 spbc_2fa__key_remove_old();
 
-                $type2fa    = get_user_meta($user->ID, 'spbc_2fa_type', true);
+                $type2fa        = get_user_meta($user->ID, 'spbc_2fa_type', true);
                 $_2fa_app_token = get_user_meta($user->ID, 'spbc_2fa_app_token', true);
-                $ga         = new GoogleAuthenticator();
-
-                // 2fa passed
-                if ( isset($spbc->data['2fa_keys'][ $user->user_login ]) && $spbc->data['2fa_keys'][ $user->user_login ]['val'] == $_POST['spbc_2fa'] ) {
-                    // Delete it so no one could login via this code
-                    unset($spbc->data['2fa_keys'][ $user->user_login ]);
-                    $spbc->save('data');
-
-                    spbc_authenticate__write_log_login($user);
-                    spbc_2fa__success($user);
-                } elseif ( $type2fa === '2fa_application' && $_2fa_app_token && $_POST['spbc_2fa'] == $ga->getCode($_2fa_app_token) ) {
-                    spbc_authenticate__write_log_login($user);
-                    spbc_2fa__success($user);
-                } else {
-                    spbc_2fa__failed($user);
+                $is_code_reused = false;
+
+                if ( preg_match('/^\d{6}$/', $code) ) {
+                    // 2fa passed
+                    if (
+                        isset($spbc->data['2fa_keys'][ $user->user_login ]) &&
+                        hash_equals((string) $spbc->data['2fa_keys'][ $user->user_login ]['val'], $code)
+                    ) {
+                        // Only one of concurrent requests with the same token may log in
+                        if ( ! spbc_2fa__step_token_claim($user, $step) ) {
+                            spbc_2fa__failed($user, true);
+                        }
+
+                        // Delete it so no one could login via this code
+                        unset($spbc->data['2fa_keys'][ $user->user_login ]);
+                        $spbc->save('data');
+
+                        $user_rate_limiter->reset();
+                        spbc_authenticate__write_log_login($user);
+                        spbc_2fa__success($user);
+                    } elseif (
+                        $type2fa === '2fa_application' &&
+                        $_2fa_app_token &&
+                        spbc_2fa__app_code_check($user, $_2fa_app_token, $code, $is_code_reused, false)
+                    ) {
+                        // Only one of concurrent requests with the same token may log in
+                        if ( ! spbc_2fa__step_token_claim($user, $step) ) {
+                            spbc_2fa__failed($user, true);
+                        }
+
+                        spbc_2fa__app_code_mark_used($user);
+                        $user_rate_limiter->reset();
+                        spbc_authenticate__write_log_login($user);
+                        spbc_2fa__success($user);
+                    }
                 }
+
+                spbc_2fa__failed($user, ! spbc_2fa__step_token_after_fail($user, $step), $is_code_reused);
             }
         }
     }
@@ -1063,6 +1418,10 @@ function spbc_2fa__success(\WP_User $user)
 {
     global $spbc;
 
+    // The step record is already consumed by spbc_2fa__step_token_claim(). Don't touch user meta here:
+    // it may already hold a fresh token of a concurrent password login in another browser.
+    spbc_2fa__step_cookie_set('', time() - 3600);
+
     // Check if password is leaked after 2FA success
     if (UsersPassCheckHandler::isUserPassLeaked($user->ID)) {
         // Set force password change flag
@@ -1129,7 +1488,42 @@ function spbc_2fa__success(\WP_User $user)
     die();
 }
 
-function spbc_2fa__failed(\WP_User $user)
+/**
+ * 2FA step is locked for the user because of too many wrong codes.
+ * Reachable only with a valid step token, so it can't be triggered anonymously.
+ *
+ * @param \WP_User $user
+ */
+function spbc_2fa__locked(\WP_User $user)
+{
+    $type2fa = get_user_meta($user->ID, 'spbc_2fa_type', true);
+
+    spbc_auth_log(
+        array(
+            'username'     => $user->user_login,
+            'event'        => $type2fa === '2fa_application' ? 'auth_failed_g2fa' : 'auth_failed_2fa',
+            'roles'        => reset($user->roles),
+            'user_agent'   => htmlspecialchars(Server::getString('HTTP_USER_AGENT')),
+            'browser_sign' => spbc_authenticate__browser_sign__get_hash($user),
+        )
+    );
+
+    spbc_2fa__challenge_revoke($user);
+    spbc_2fa__step_cookie_set('', time() - 3600);
+
+    wp_die(
+        esc_html__('Too many wrong authorization codes. Please try again later. Protected - Security by CleanTalk.', 'security-malware-firewall'),
+        'Forbidden',
+        array('response' => 403)
+    );
+}
+
+/**
+ * @param \WP_User $user
+ * @param bool     $restart Send the user back to the password form (no valid 2FA step token or attempts exhausted)
+ * @param bool     $is_code_reused The code is correct, but was already used - the user has to wait for the next one
+ */
+function spbc_2fa__failed(\WP_User $user, $restart = false, $is_code_reused = false)
 {
     $type2fa = get_user_meta($user->ID, 'spbc_2fa_type', true);
     $event   = $type2fa === '2fa_application' ? 'auth_failed_g2fa' : 'auth_failed_2fa';
@@ -1143,10 +1537,18 @@ function spbc_2fa__failed(\WP_User $user)
         'browser_sign' => spbc_authenticate__browser_sign__get_hash($user),
         )
     );
+
+    if ( $restart ) {
+        // Only the requester's cookie is cleared: server-side state must not be touched by a request without a valid token
+        spbc_2fa__step_cookie_set('', time() - 3600);
+        wp_redirect(wp_login_url());
+        die();
+    }
+
     wp_redirect(
         wp_login_url()
         . ( strpos(wp_login_url(), '?') === false ? '?' : '&' )
-        . 'spbc_2fa_error=1&spbc_2fa_user=' . $user->user_login
+        . 'spbc_2fa_error=' . ( $is_code_reused ? '2' : '1' ) . '&spbc_2fa_user=' . rawurlencode($user->user_login)
     );
     die();
 }
@@ -1364,13 +1766,16 @@ function spbc_2fa__Get2FAAppQrCode()
     }
 
     if (property_exists($user_obj, 'ID')) {
-        $user_token = get_user_meta($user_obj->ID, 'spbc_2fa_app_token', true);
+        // The secret is never exposed again once 2FA application is activated
+        if (get_user_meta($user_obj->ID, 'spbc_2fa_type', true) === '2fa_application') {
+            wp_send_json_error(esc_html__('Error: 2FA application is already enabled. Disable it first to set up a new one.', 'security-malware-firewall'));
+        }
+
         $ga = new GoogleAuthenticator();
 
-        if (!$user_token) {
-            $user_token = $ga->generateSecret();
-            update_user_meta($user_obj->ID, 'spbc_2fa_app_token', $user_token);
-        }
+        // Fresh secret on each setup attempt, so a secret leaked from an abandoned setup is not reused
+        $user_token = $ga->generateSecret();
+        update_user_meta($user_obj->ID, 'spbc_2fa_app_token', $user_token);
 
         $otpauth = $ga->getUrl(
             $user_obj->user_login,
@@ -1409,10 +1814,7 @@ function spbc_2fa__Check2FAAppCode()
             $user_token = get_user_meta($user_obj->ID, 'spbc_2fa_app_token', true);
 
             if ($user_token) {
-                $ga   = new GoogleAuthenticator();
-                $code = $ga->getCode($user_token);
-
-                if (trim($_POST['code']) === $code) {
+                if (spbc_2fa__app_code_check($user_obj, $user_token, trim($_POST['code']))) {
                     if (update_user_meta($user_obj->ID, 'spbc_2fa_type', '2fa_application')) {
                         wp_send_json_success();
                     }
diff --git a/lib/CleantalkSP/SpbctWP/G2FA/GoogleAuthenticator.php b/lib/CleantalkSP/SpbctWP/G2FA/GoogleAuthenticator.php
index ea8addd09..1b7c238b6 100644
--- a/lib/CleantalkSP/SpbctWP/G2FA/GoogleAuthenticator.php
+++ b/lib/CleantalkSP/SpbctWP/G2FA/GoogleAuthenticator.php
@@ -18,7 +18,7 @@ class GoogleAuthenticator
 {
     public static $PASS_CODE_LENGTH = 6;
     public static $PIN_MODULO;
-    public static $SECRET_LENGTH = 10;
+    public static $SECRET_LENGTH = 20;
 
     public function __construct()
     {
@@ -84,11 +84,7 @@ public function getUrl($user, $hostname, $secret)
 
     public function generateSecret()
     {
-        $secret = "";
-        for ( $i = 1; $i <= self::$SECRET_LENGTH; $i++ ) {
-            $c      = rand(0, 255);
-            $secret .= pack("c", $c);
-        }
+        $secret = random_bytes(self::$SECRET_LENGTH);
         $base32 = new FixedBitNotation(5, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567', true, true);
 
         return $base32->encode($secret);
diff --git a/lib/CleantalkSP/SpbctWP/SpbcRateLimit/SpbcUserRateLimiter.php b/lib/CleantalkSP/SpbctWP/SpbcRateLimit/SpbcUserRateLimiter.php
new file mode 100644
index 000000000..99c06835b
--- /dev/null
+++ b/lib/CleantalkSP/SpbctWP/SpbcRateLimit/SpbcUserRateLimiter.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace CleantalkSP\SpbctWP\SpbcRateLimit;
+
+use CleantalkSP\Common\RateLimit\RateLimiterConfig;
+
+/**
+ * Rate limiter keyed by WordPress user ID instead of IP address.
+ * Changing IP does not reset the counter.
+ *
+ * @package CleantalkSP\SpbctWP\SpbcRateLimit
+ */
+class SpbcUserRateLimiter extends SpbcRateLimiter
+{
+    /**
+     * @var int
+     */
+    private $user_id;
+
+    /**
+     * @param RateLimiterConfig $config
+     * @param int               $user_id
+     */
+    public function __construct(RateLimiterConfig $config, $user_id)
+    {
+        $this->user_id = (int) $user_id;
+        parent::__construct($config);
+    }
+
+    protected function setUID(): void
+    {
+        $this->uid = md5('user_' . $this->user_id . $this->config->type);
+    }
+
+    /**
+     * UA is informational here (the limiter is keyed by user ID), but an attacker-controlled value
+     * must not break the insert: the limiter fails open on DB errors, and wpdb rejects queries with
+     * text invalid for the table charset. Printable ASCII fits any charset and is truncated safely.
+     */
+    protected function setUA(): void
+    {
+        parent::setUA();
+        $this->ua = substr((string) preg_replace('/[^\x20-\x7E]/', '', $this->ua), 0, 200);
+    }
+
+    /**
+     * Drop the counter, e.g. after a successful attempt.
+     *
+     * @return void
+     */
+    public function reset(): void
+    {
+        global $wpdb;
+
+        $wpdb->query(
+            $wpdb->prepare('DELETE FROM ' . SPBC_TBL_RATE_LIMITS . ' WHERE uid = %s', $this->uid)
+        );
+    }
+}
diff --git a/security-malware-firewall.php b/security-malware-firewall.php
index 2c0d17cca..1cbcee25b 100644
--- a/security-malware-firewall.php
+++ b/security-malware-firewall.php
@@ -101,6 +101,9 @@
 
 // Auth params
 define('SPBC_2FA_KEY_TTL', 600);      // 2fa key lifetime in seconds
+define('SPBC_2FA_MAX_ATTEMPTS', 5);   // 2fa wrong code attempts allowed before the password has to be entered again
+define('SPBC_2FA_USER_MAX_ATTEMPTS', 10);  // 2fa code attempts per user allowed within SPBC_2FA_USER_LOCK_PERIOD (reset on success)
+define('SPBC_2FA_USER_LOCK_PERIOD', 900);  // 2fa per user counting window and lock time in seconds
 
 /**
  * Set SPBC_BFP_DISABLE to true to disable Brute Force Protection module.
diff --git a/tests/Inc/TwoFactorAuthTest.php b/tests/Inc/TwoFactorAuthTest.php
new file mode 100644
index 000000000..bc69cca7b
--- /dev/null
+++ b/tests/Inc/TwoFactorAuthTest.php
@@ -0,0 +1,938 @@
+<?php
+
+namespace Inc;
+
+use CleantalkSP\SpbctWP\DB\TablesCreator;
+use CleantalkSP\SpbctWP\G2FA\GoogleAuthenticator;
+use CleantalkSP\Variables\Get;
+use CleantalkSP\Variables\Server;
+use PHPUnit\Framework\AssertionFailedError;
+
+/**
+ * Thrown from the hooks to stop the flow where production code would send headers and die.
+ */
+class TwoFactorAuthTestInterrupt extends \Exception
+{
+    public $type;
+    public $value;
+
+    public function __construct($type, $value)
+    {
+        parent::__construct($type);
+        $this->type  = $type;
+        $this->value = $value;
+    }
+}
+
+/**
+ * 2FA step: binding to the first factor, replay protection, per-user attempts limit, setup endpoints.
+ */
+class TwoFactorAuthTest extends \SpbcTestCase
+{
+    const SECRET = 'GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ';
+
+    /** @var \WP_User */
+    private static $app_user_static;
+    /** @var \WP_User */
+    private static $email_user_static;
+    /** @var \WP_User */
+    private static $subscriber_static;
+
+    private $app_user;
+    private $email_user;
+    private $subscriber;
+    private $saved_server;
+    private $parallel_hook;
+    private $parallel_results = array();
+
+    /**
+     * Users are created once per class: wp_insert_user()/wp_delete_user() are the slowest part of the test.
+     */
+    public static function setUpBeforeClass(): void
+    {
+        global $wpdb;
+
+        parent::setUpBeforeClass();
+
+        $tables_creator = new TablesCreator();
+        $tables_creator->createTable(SPBC_TBL_SECURITY_LOG);
+        $tables_creator->createTable(SPBC_TBL_RATE_LIMITS);
+        $tables_creator->createTable($wpdb->base_prefix . 'spbc_users_pass');
+
+        self::$app_user_static   = self::createUser('spbc_2fa_app', 'editor');
+        self::$email_user_static = self::createUser('spbc_2fa_mail', 'editor');
+        self::$subscriber_static = self::createUser('spbc_2fa_sub', 'subscriber');
+    }
+
+    public static function tearDownAfterClass(): void
+    {
+        require_once ABSPATH . 'wp-admin/includes/user.php';
+        foreach ( array(self::$app_user_static, self::$email_user_static, self::$subscriber_static) as $user ) {
+            wp_delete_user($user->ID);
+        }
+
+        parent::tearDownAfterClass();
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->app_user   = self::$app_user_static;
+        $this->email_user = self::$email_user_static;
+        $this->subscriber = self::$subscriber_static;
+
+        $this->saved_server = $_SERVER;
+        $this->resetState();
+
+        add_filter('wp_redirect', array($this, 'interruptRedirect'), 1);
+        add_filter('wp_die_handler', array($this, 'getDieHandler'), PHP_INT_MAX);
+        add_filter('wp_die_ajax_handler', array($this, 'getDieHandler'), PHP_INT_MAX);
+        add_action('set_auth_cookie', array($this, 'interruptAuthCookie'), 1, 4);
+    }
+
+    protected function tearDown(): void
+    {
+        remove_filter('wp_redirect', array($this, 'interruptRedirect'), 1);
+        remove_filter('wp_die_handler', array($this, 'getDieHandler'), PHP_INT_MAX);
+        remove_filter('wp_die_ajax_handler', array($this, 'getDieHandler'), PHP_INT_MAX);
+        remove_action('set_auth_cookie', array($this, 'interruptAuthCookie'), 1);
+
+        $this->resetState();
+        $_SERVER = $this->saved_server;
+        $this->resetRequestCache();
+
+        parent::tearDown();
+    }
+
+    /**
+     * Brings settings, request, users' 2FA meta and limiter counters to the initial state.
+     */
+    private function resetState()
+    {
+        global $spbc, $wpdb;
+
+        $spbc->settings['2fa__enable'] = 1;
+        $spbc->settings['2fa__roles']  = array('editor');
+        $spbc->data['2fa_keys']        = array();
+
+        $_POST = $_GET = $_COOKIE = $_REQUEST = array();
+        $_SERVER['REMOTE_ADDR']     = '10.10.10.10';
+        $_SERVER['HTTP_USER_AGENT'] = 'PHPUnit';
+        $this->resetRequestCache();
+
+        remove_filter('wp_doing_ajax', '__return_true');
+        if ( $this->parallel_hook ) {
+            remove_filter('query', $this->parallel_hook);
+            $this->parallel_hook = null;
+        }
+        $this->parallel_results = array();
+        wp_set_current_user(0);
+
+        $wpdb->query('DELETE FROM ' . SPBC_TBL_RATE_LIMITS);
+
+        foreach ( array($this->app_user, $this->email_user, $this->subscriber) as $user ) {
+            foreach ( array('spbc_2fa_type', 'spbc_2fa_app_token', 'spbc_2fa_step', 'spbc_2fa_last_step') as $meta ) {
+                delete_user_meta($user->ID, $meta);
+            }
+        }
+        update_user_meta($this->app_user->ID, 'spbc_2fa_type', '2fa_application');
+        update_user_meta($this->app_user->ID, 'spbc_2fa_app_token', self::SECRET);
+    }
+
+    // ---------------------------------------------------------------- hooks
+
+    public function interruptRedirect($location)
+    {
+        throw new TwoFactorAuthTestInterrupt('redirect', $location);
+    }
+
+    public function getDieHandler()
+    {
+        return array($this, 'interruptDie');
+    }
+
+    public function interruptDie($message, $title = '', $args = array())
+    {
+        $code = is_array($args) && isset($args['response']) ? $args['response'] : $args;
+        throw new TwoFactorAuthTestInterrupt('die', (int) $code);
+    }
+
+    public function interruptAuthCookie($auth_cookie, $expire, $expiration, $user_id)
+    {
+        throw new TwoFactorAuthTestInterrupt('auth', (int) $user_id);
+    }
+
+    // ---------------------------------------------------------------- helpers
+
+    private function resetRequestCache()
+    {
+        Server::getInstance()->variables = array();
+        Get::getInstance()->variables    = array();
+        \CleantalkSP\SpbctWP\Helpers\IP::getInstance()->ips_stored = array();
+    }
+
+    private static function createUser($login, $role)
+    {
+        $existing = get_user_by('login', $login);
+        if ( $existing ) {
+            require_once ABSPATH . 'wp-admin/includes/user.php';
+            wp_delete_user($existing->ID);
+        }
+
+        $user_id = wp_insert_user(array(
+            'user_login' => $login,
+            'user_pass'  => wp_generate_password(),
+            'user_email' => $login . '@example.com',
+            'role'       => $role,
+        ));
+
+        return get_user_by('id', $user_id);
+    }
+
+    /**
+     * Emulates the token issued after a successful password check.
+     */
+    private function giveStepToken(\WP_User $user, $fails = 0, $expires = null)
+    {
+        $token = bin2hex(random_bytes(32));
+        update_user_meta($user->ID, 'spbc_2fa_step', array(
+            'hash'    => hash('sha256', $token),
+            'expires' => $expires === null ? time() + 600 : $expires,
+            'fails'   => $fails,
+        ));
+        $_COOKIE['spbc_2fa_step'] = $token;
+
+        return $token;
+    }
+
+    private function timeStep()
+    {
+        return (int) floor(time() / 30);
+    }
+
+    private function codeForStep($time_step)
+    {
+        $ga = new GoogleAuthenticator();
+
+        return $ga->getCode(self::SECRET, $time_step);
+    }
+
+    private function currentCode()
+    {
+        return $this->codeForStep($this->timeStep());
+    }
+
+    /**
+     * A code that is invalid now and stays invalid if the time step changes during the test.
+     */
+    private function wrongCode()
+    {
+        $step  = $this->timeStep();
+        $valid = array($this->codeForStep($step - 1), $this->codeForStep($step), $this->codeForStep($step + 1));
+
+        for ( $code = 0; in_array(sprintf('%06d', $code), $valid, true); $code++ ) {
+        }
+
+        return sprintf('%06d', $code);
+    }
+
+    /**
+     * Runs a scenario which needs a valid TOTP code. Instead of waiting for a fresh time step,
+     * the scenario is repeated from the clean state if it failed because the step changed in the middle.
+     *
+     * @param callable $scenario Receives the code of the current time step
+     */
+    private function inOneTimeStep(callable $scenario)
+    {
+        for ( $attempt = 1;; $attempt++ ) {
+            $step = $this->timeStep();
+            try {
+                $scenario($this->codeForStep($step));
+                return;
+            } catch ( AssertionFailedError $e ) {
+                if ( $attempt >= 2 || $this->timeStep() === $step ) {
+                    throw $e;
+                }
+                $this->resetState();
+            }
+        }
+    }
+
+    /**
+     * Emulates a concurrent request: runs $parallel right before the first query matching $pattern is executed.
+     */
+    private function runParallelBeforeQuery($pattern, callable $parallel)
+    {
+        $triggered           = false;
+        $this->parallel_hook = function ($query) use ($pattern, $parallel, &$triggered) {
+            if ( ! $triggered && preg_match($pattern, $query) ) {
+                $triggered                = true;
+                $this->parallel_results[] = $parallel();
+            }
+            return $query;
+        };
+        add_filter('query', $this->parallel_hook);
+    }
+
+    /**
+     * @return array [type, value]: 'auth' => user id, 'redirect' => location, 'die' => status code, 'none' => null
+     */
+    private function postCode($login, $code)
+    {
+        $_POST['log']      = $login;
+        $_POST['spbc_2fa'] = $code;
+
+        return $this->runInterruptible('spbc_2fa__authenticate');
+    }
+
+    private function runInterruptible($callback)
+    {
+        $args = array_slice(func_get_args(), 1);
+        try {
+            call_user_func_array($callback, $args);
+        } catch ( TwoFactorAuthTestInterrupt $e ) {
+            return array($e->type, $e->value);
+        }
+
+        return array('none', null);
+    }
+
+    private function assertRestart(array $result)
+    {
+        $this->assertSame(array('redirect', wp_login_url()), $result);
+    }
+
+    private function assertCodeError(array $result, $error, \WP_User $user)
+    {
+        $this->assertSame('redirect', $result[0]);
+        $this->assertStringContainsString('spbc_2fa_error=' . $error, $result[1]);
+        $this->assertStringContainsString('spbc_2fa_user=' . rawurlencode($user->user_login), $result[1]);
+    }
+
+    private function captureOutput($callback)
+    {
+        ob_start();
+        try {
+            $result = $this->runInterruptible($callback);
+        } finally {
+            $output = ob_get_clean();
+        }
+
+        return array($result, $output);
+    }
+
+    private function asAjaxUser(\WP_User $user)
+    {
+        wp_set_current_user($user->ID);
+        add_filter('wp_doing_ajax', '__return_true');
+        $_REQUEST['security'] = wp_create_nonce('ct_secret_stuff');
+    }
+
+    // ---------------------------------------------------------------- step token
+
+    public function testStepTokenIssueStoresOnlyHash()
+    {
+        spbc_2fa__step_token_issue($this->app_user);
+
+        $step = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+        $this->assertRegExp('/^[a-f0-9]{64}$/', $step['hash']);
+        $this->assertSame(0, $step['fails']);
+        $this->assertGreaterThan(time(), $step['expires']);
+    }
+
+    public function testStepTokenValidOnlyWithMatchingCookie()
+    {
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user), 'no cookie');
+
+        $this->giveStepToken($this->app_user);
+        $this->assertTrue(spbc_2fa__step_token_is_valid($this->app_user));
+
+        $_COOKIE['spbc_2fa_step'] = str_repeat('a', 64);
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user), 'foreign token');
+
+        $_COOKIE['spbc_2fa_step'] = array('x');
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user), 'array cookie');
+
+        $_COOKIE['spbc_2fa_step'] = 'not-a-token';
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user), 'malformed cookie');
+    }
+
+    public function testStepTokenIsBoundToUser()
+    {
+        $this->giveStepToken($this->email_user);
+
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user));
+    }
+
+    public function testExpiredStepTokenIsRejectedAndDeleted()
+    {
+        $this->giveStepToken($this->app_user, 0, time() - 1);
+
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user));
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+    }
+
+    public function testExhaustedStepTokenIsRejectedAndDeleted()
+    {
+        $this->giveStepToken($this->app_user, SPBC_2FA_MAX_ATTEMPTS);
+
+        $this->assertFalse(spbc_2fa__step_token_is_valid($this->app_user));
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+    }
+
+    public function testReserveAttemptCountsFailsAndAfterFailDestroysTokenAndEmailKeyOnLastAttempt()
+    {
+        global $spbc;
+
+        $this->giveStepToken($this->email_user);
+        $spbc->data['2fa_keys'][$this->email_user->user_login] = array('generated' => time(), 'val' => '123456');
+
+        for ( $i = 1; $i < SPBC_2FA_MAX_ATTEMPTS; $i++ ) {
+            $reserved = spbc_2fa__step_token_reserve_attempt($this->email_user);
+            $this->assertSame($i, $reserved['fails']);
+            $this->assertSame($reserved, get_user_meta($this->email_user->ID, 'spbc_2fa_step', true));
+            $this->assertTrue(spbc_2fa__step_token_after_fail($this->email_user, $reserved));
+        }
+
+        $reserved = spbc_2fa__step_token_reserve_attempt($this->email_user);
+        $this->assertFalse(spbc_2fa__step_token_after_fail($this->email_user, $reserved));
+        $this->assertSame('', get_user_meta($this->email_user->ID, 'spbc_2fa_step', true));
+        $this->assertArrayNotHasKey($this->email_user->user_login, $spbc->data['2fa_keys']);
+    }
+
+    public function testReserveAttemptWithoutTokenReturnsFalse()
+    {
+        $this->assertFalse(spbc_2fa__step_token_reserve_attempt($this->app_user));
+    }
+
+    /**
+     * Two requests which read the same record: only the first swap succeeds.
+     */
+    public function testSwapSucceedsOnlyForActualRecord()
+    {
+        $this->giveStepToken($this->app_user);
+        $read_by_both = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+
+        $first = array_merge($read_by_both, array('fails' => 1));
+        $this->assertTrue(spbc_2fa__step_token_swap($this->app_user, $read_by_both, $first));
+        $this->assertFalse(spbc_2fa__step_token_swap($this->app_user, $read_by_both, array_merge($read_by_both, array('fails' => 7))));
+        $this->assertSame($first, get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+
+        $this->assertFalse(spbc_2fa__step_token_claim($this->app_user, $read_by_both));
+        $this->assertTrue(spbc_2fa__step_token_claim($this->app_user, $first));
+        $this->assertFalse(spbc_2fa__step_token_claim($this->app_user, $first), 'token can be claimed only once');
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+    }
+
+    // ---------------------------------------------------------------- TOTP check
+
+    public function testAppCodeCheckAcceptsCurrentCodeOnce()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $is_reused = null;
+            $this->assertTrue(spbc_2fa__app_code_check($this->app_user, self::SECRET, $code, $is_reused));
+            $this->assertFalse($is_reused);
+            $this->assertSame(
+                $this->timeStep(),
+                (int) get_user_meta($this->app_user->ID, 'spbc_2fa_last_step', true)
+            );
+
+            $this->assertFalse(spbc_2fa__app_code_check($this->app_user, self::SECRET, $code, $is_reused));
+            $this->assertTrue($is_reused, 'Correct code of an already used step must be reported as reused');
+        });
+    }
+
+    public function testAppCodeCheckRejectsWrongAndPreviousStepCode()
+    {
+        $code = $this->currentCode();
+        $ga   = new GoogleAuthenticator();
+
+        $is_reused = null;
+        $this->assertFalse(spbc_2fa__app_code_check($this->app_user, self::SECRET, $this->wrongCode(), $is_reused));
+        $this->assertFalse($is_reused);
+
+        $previous = $ga->getCode(self::SECRET, $this->timeStep() - 1);
+        if ( $previous !== $code ) {
+            $this->assertFalse(spbc_2fa__app_code_check($this->app_user, self::SECRET, $previous));
+        }
+
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_last_step', true));
+    }
+
+    // ---------------------------------------------------------------- spbc_2fa__authenticate
+
+    /**
+     * S1 regression: login + valid TOTP without passing the password step must not log in.
+     */
+    public function testTotpWithoutPasswordStepDoesNotLogIn()
+    {
+        $result = $this->postCode($this->app_user->user_login, $this->currentCode());
+
+        $this->assertRestart($result);
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_last_step', true));
+    }
+
+    public function testTotpWithTokenOfAnotherUserDoesNotLogIn()
+    {
+        $this->giveStepToken($this->email_user);
+
+        $this->assertRestart($this->postCode($this->app_user->user_login, $this->currentCode()));
+    }
+
+    public function testInvalidTokenDoesNotTouchVictimState()
+    {
+        $this->giveStepToken($this->app_user);
+        $victim_step = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+
+        $_COOKIE['spbc_2fa_step'] = str_repeat('b', 64);
+        for ( $i = 0; $i < SPBC_2FA_MAX_ATTEMPTS + 1; $i++ ) {
+            $this->assertRestart($this->postCode($this->app_user->user_login, '000000'));
+        }
+
+        $this->assertSame($victim_step, get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+        $this->assertTrue(spbc_2fa__user_rate_limiter($this->app_user)->checkPassed(), 'limiter must not be spent');
+    }
+
+    public function testValidTotpWithStepTokenLogsIn()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $this->giveStepToken($this->app_user);
+
+            $result = $this->postCode($this->app_user->user_login, $code);
+
+            $this->assertSame(array('auth', $this->app_user->ID), $result);
+            $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_step', true), 'token is one-time');
+        });
+    }
+
+    /**
+     * Successful login must not revoke a fresh challenge issued meanwhile to a password login in another browser.
+     */
+    public function testSuccessKeepsFreshTokenOfConcurrentLogin()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $this->giveStepToken($this->app_user);
+            $login = $this->app_user->user_login;
+            $fresh = null;
+
+            // Another browser passes the password right after this request consumed its token
+            $this->runParallelBeforeQuery(
+                "/^DELETE FROM \\S*spbc_rate_limits/",
+                function () use (&$fresh) {
+                    spbc_2fa__step_token_issue($this->app_user);
+                    $fresh = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+                    return true;
+                }
+            );
+
+            $this->assertSame(array('auth', $this->app_user->ID), $this->postCode($login, $code));
+            $this->assertCount(1, $this->parallel_results, 'parallel login was not emulated');
+            $this->assertIsArray($fresh);
+            $this->assertSame($fresh, get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+        });
+    }
+
+    public function testLoginByEmailWorksWithStepToken()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $this->giveStepToken($this->app_user);
+
+            $result = $this->postCode($this->app_user->user_email, $code);
+
+            $this->assertSame(array('auth', $this->app_user->ID), $result);
+        });
+    }
+
+    public function testWrongCodeCountsFail()
+    {
+        $this->giveStepToken($this->app_user);
+
+        $result = $this->postCode($this->app_user->user_login, $this->wrongCode());
+
+        $this->assertCodeError($result, 1, $this->app_user);
+        $step = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+        $this->assertSame(1, $step['fails']);
+    }
+
+    public function testReusedCodeIsRejectedWithSeparateError()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $this->giveStepToken($this->app_user);
+            $this->assertSame(array('auth', $this->app_user->ID), $this->postCode($this->app_user->user_login, $code));
+
+            $this->giveStepToken($this->app_user);
+            $this->assertCodeError($this->postCode($this->app_user->user_login, $code), 2, $this->app_user);
+        });
+    }
+
+    /**
+     * Two simultaneous submissions of the same token and code: only one may log in.
+     */
+    public function testConcurrentSubmissionOfSameCodeLogsInOnce()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $this->giveStepToken($this->app_user);
+            $login = $this->app_user->user_login;
+
+            // The parallel request runs when the first one is about to consume the token
+            $this->runParallelBeforeQuery(
+                "/^DELETE FROM \\S*usermeta .*'spbc_2fa_step'/",
+                function () use ($login, $code) {
+                    return $this->postCode($login, $code);
+                }
+            );
+            $first = $this->postCode($login, $code);
+
+            $this->assertCount(1, $this->parallel_results, 'parallel request was not emulated');
+            $results = array($first, $this->parallel_results[0]);
+            $this->assertCount(
+                1,
+                array_filter($results, function ($result) {
+                    return $result[0] === 'auth';
+                }),
+                'Exactly one of concurrent requests must log in: ' . var_export($results, true)
+            );
+        });
+    }
+
+    /**
+     * Simultaneous wrong codes with the same token: each attempt is counted, the loser has to restart.
+     */
+    public function testConcurrentWrongCodesAreAllCounted()
+    {
+        $this->giveStepToken($this->app_user);
+        $login = $this->app_user->user_login;
+        $wrong = $this->wrongCode();
+
+        // The parallel request runs when the first one is about to reserve the attempt
+        $this->runParallelBeforeQuery(
+            "/^UPDATE \\S*usermeta SET meta_value .*'spbc_2fa_step'/",
+            function () use ($login, $wrong) {
+                return $this->postCode($login, $wrong);
+            }
+        );
+        $first = $this->postCode($login, $wrong);
+
+        $this->assertCount(1, $this->parallel_results, 'parallel request was not emulated');
+        $this->assertCodeError($this->parallel_results[0], 1, $this->app_user);
+        $this->assertRestart($first);
+
+        $step = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+        $this->assertSame(1, $step['fails']);
+    }
+
+    public function testUserOutsideOf2faRolesCannotLogInByCode()
+    {
+        global $spbc;
+
+        $spbc->settings['2fa__roles'] = array('administrator');
+        $this->giveStepToken($this->app_user);
+
+        $this->assertRestart($this->postCode($this->app_user->user_login, $this->currentCode()));
+    }
+
+    public function testEmailCodeRequiresStepToken()
+    {
+        global $spbc;
+
+        $login = $this->email_user->user_login;
+        $spbc->data['2fa_keys'][$login] = array('generated' => time(), 'val' => '123456');
+
+        $this->assertRestart($this->postCode($login, '123456'));
+        $this->assertArrayHasKey($login, $spbc->data['2fa_keys']);
+
+        $this->giveStepToken($this->email_user);
+        $this->assertSame(array('auth', $this->email_user->ID), $this->postCode($login, '123456'));
+        $this->assertArrayNotHasKey($login, $spbc->data['2fa_keys'], 'e-mail code is one-time');
+    }
+
+    public function testNonStringInputIsHandledAsWrongCode()
+    {
+        $this->giveStepToken($this->app_user);
+
+        $result = $this->postCode($this->app_user->user_login, array('000000'));
+        $this->assertCodeError($result, 1, $this->app_user);
+
+        $this->assertSame(array('none', null), $this->postCode(array('x'), '000000'));
+    }
+
+    public function testNonNumericCodeIsRejected()
+    {
+        $this->giveStepToken($this->app_user);
+
+        $this->assertCodeError($this->postCode($this->app_user->user_login, ' 12a456'), 1, $this->app_user);
+    }
+
+    public function testUnknownUserIsIgnored()
+    {
+        $this->assertSame(array('none', null), $this->postCode('spbc_2fa_nobody', '000000'));
+    }
+
+    public function testStepTokenIsDestroyedAfterMaxFails()
+    {
+        $this->giveStepToken($this->app_user);
+        $wrong = $this->wrongCode();
+
+        for ( $i = 1; $i < SPBC_2FA_MAX_ATTEMPTS; $i++ ) {
+            $this->assertCodeError($this->postCode($this->app_user->user_login, $wrong), 1, $this->app_user);
+        }
+        $this->assertRestart($this->postCode($this->app_user->user_login, $wrong));
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+
+        // Even the correct code needs a new password step now
+        $this->assertRestart($this->postCode($this->app_user->user_login, $this->currentCode()));
+    }
+
+    public function testPerUserLimitSurvivesNewPasswordLoginsAndIpChange()
+    {
+        $wrong = $this->wrongCode();
+
+        for ( $i = 1; $i <= SPBC_2FA_USER_MAX_ATTEMPTS; $i++ ) {
+            // New password step and new IP on each attempt
+            $_SERVER['REMOTE_ADDR'] = '10.0.0.' . $i;
+            $this->resetRequestCache();
+            $this->giveStepToken($this->app_user);
+            $this->assertCodeError($this->postCode($this->app_user->user_login, $wrong), 1, $this->app_user);
+        }
+
+        $this->giveStepToken($this->app_user);
+        $this->assertSame(array('die', 403), $this->postCode($this->app_user->user_login, $this->currentCode()));
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_step', true));
+
+        $this->giveStepToken($this->app_user);
+        $this->assertSame(array('die', 403), $this->postCode($this->app_user->user_login, $this->currentCode()));
+
+        // Other users are not affected
+        $this->giveStepToken($this->email_user);
+        $this->assertCodeError($this->postCode($this->email_user->user_login, '000000'), 1, $this->email_user);
+    }
+
+    /**
+     * A challenge issued for the old password (step cookie + e-mail code) must not complete the login after a reset.
+     */
+    public function testPasswordResetRevokesPendingChallenge()
+    {
+        global $spbc;
+
+        $login = $this->email_user->user_login;
+        $this->giveStepToken($this->email_user);
+        $spbc->data['2fa_keys'][$login] = array('generated' => time(), 'val' => '123456');
+
+        spbc_2fa__challenge_revoke($this->email_user);
+
+        $this->assertSame('', get_user_meta($this->email_user->ID, 'spbc_2fa_step', true));
+        $this->assertArrayNotHasKey($login, $spbc->data['2fa_keys']);
+        $this->assertRestart($this->postCode($login, '123456'));
+    }
+
+    public function testPerUserLimitIsResetByPasswordReset()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $wrong = $this->wrongCode();
+
+            for ( $i = 0; $i <= SPBC_2FA_USER_MAX_ATTEMPTS; $i++ ) {
+                $this->giveStepToken($this->app_user);
+                $this->postCode($this->app_user->user_login, $wrong);
+            }
+            $this->giveStepToken($this->app_user);
+            $this->assertSame(array('die', 403), $this->postCode($this->app_user->user_login, $wrong));
+
+            spbc_2fa__user_rate_limiter_reset($this->app_user);
+
+            $this->giveStepToken($this->app_user);
+            $this->assertSame(array('auth', $this->app_user->ID), $this->postCode($this->app_user->user_login, $code));
+        });
+    }
+
+    public function testSuccessfulLoginResetsPerUserCounter()
+    {
+        $this->inOneTimeStep(function ($code) {
+            $wrong = $this->wrongCode();
+
+            for ( $i = 1; $i < SPBC_2FA_USER_MAX_ATTEMPTS; $i++ ) {
+                $this->giveStepToken($this->app_user);
+                $this->postCode($this->app_user->user_login, $wrong);
+            }
+            $this->giveStepToken($this->app_user);
+            $this->assertSame(array('auth', $this->app_user->ID), $this->postCode($this->app_user->user_login, $code));
+
+            for ( $i = 1; $i <= SPBC_2FA_USER_MAX_ATTEMPTS; $i++ ) {
+                $this->giveStepToken($this->app_user);
+                $this->assertCodeError($this->postCode($this->app_user->user_login, $wrong), 1, $this->app_user);
+            }
+        });
+    }
+
+    public function testDisabled2faIgnoresCode()
+    {
+        global $spbc;
+
+        $spbc->settings['2fa__enable'] = 0;
+        $this->giveStepToken($this->app_user);
+
+        $this->assertSame(array('none', null), $this->postCode($this->app_user->user_login, $this->currentCode()));
+    }
+
+    // ---------------------------------------------------------------- first factor
+
+    public function testPasswordStepIssuesTokenFor2faUser()
+    {
+        $result = $this->runInterruptible('spbc_authenticate', $this->app_user, $this->app_user->user_login);
+
+        $this->assertSame('redirect', $result[0]);
+        $this->assertStringContainsString('spbc_2fa_user=' . rawurlencode($this->app_user->user_login), $result[1]);
+
+        $step = get_user_meta($this->app_user->ID, 'spbc_2fa_step', true);
+        $this->assertIsArray($step);
+        $this->assertSame(0, $step['fails']);
+    }
+
+    public function testPasswordStepDoesNotIssueTokenForUserOutsideOf2faRoles()
+    {
+        $result = $this->runInterruptible('spbc_authenticate', $this->subscriber, $this->subscriber->user_login);
+
+        $this->assertSame(array('none', null), $result);
+        $this->assertSame('', get_user_meta($this->subscriber->ID, 'spbc_2fa_step', true));
+    }
+
+    // ---------------------------------------------------------------- code form
+
+    public function testCodeFormIsNotShownWithoutStepToken()
+    {
+        $_GET['spbc_2fa_user'] = $this->app_user->user_login;
+
+        list($result, $output) = $this->captureOutput('spbc_2fa__show_field');
+
+        $this->assertSame(array('none', null), $result);
+        $this->assertSame('', $output);
+    }
+
+    public function testCodeFormIsShownWithStepToken()
+    {
+        $_GET['spbc_2fa_user'] = $this->app_user->user_login;
+        $this->giveStepToken($this->app_user);
+
+        list(, $output) = $this->captureOutput('spbc_2fa__show_field');
+
+        $this->assertStringContainsString('spbc_2fa', $output);
+        $this->assertStringNotContainsString('CODE ALREADY USED', $output);
+    }
+
+    public function testReusedCodeMessageIsRenderedWithoutInnerHtml()
+    {
+        $_GET['spbc_2fa_user']  = $this->app_user->user_login;
+        $_GET['spbc_2fa_error'] = '2';
+        $this->giveStepToken($this->app_user);
+
+        list(, $output) = $this->captureOutput('spbc_2fa__show_field');
+
+        $this->assertStringContainsString('CODE ALREADY USED', $output);
+        $this->assertStringNotContainsString('{{', $output);
+
+        $error_script = substr($output, 0, strpos($output, '</script>'));
+        $this->assertStringContainsString('textContent', $error_script);
+        $this->assertStringNotContainsString('innerHTML', $error_script);
+    }
+
+    public function testReusedCodeMessageIsNotShownForEmailCode()
+    {
+        $_GET['spbc_2fa_user']  = $this->email_user->user_login;
+        $_GET['spbc_2fa_error'] = '2';
+        $this->giveStepToken($this->email_user);
+
+        list(, $output) = $this->captureOutput('spbc_2fa__show_field');
+
+        $this->assertStringNotContainsString('CODE ALREADY USED', $output);
+    }
+
+    // ---------------------------------------------------------------- 2FA application setup / removal
+
+    public function testReplaceMetaRemovesSecretEvenWithoutType()
+    {
+        delete_user_meta($this->app_user->ID, 'spbc_2fa_type');
+        update_user_meta($this->app_user->ID, 'spbc_2fa_last_step', 123);
+
+        $this->assertTrue(spbc_2fa__2fa_app_replace_meta($this->app_user));
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_app_token', true));
+        $this->assertSame('', get_user_meta($this->app_user->ID, 'spbc_2fa_last_step', true));
+    }
+
+    public function testQrEndpointDoesNotExposeActivatedSecret()
+    {
+        $this->asAjaxUser($this->app_user);
+
+        list($result, $output) = $this->captureOutput('spbc_2fa__Get2FAAppQrCode');
+
+        $this->assertSame('die', $result[0]);
+        $response = json_decode($output, true);
+        $this->assertFalse($response['success']);
+        $this->assertStringNotContainsString(self::SECRET, $output);
+        $this->assertSame(self::SECRET, get_user_meta($this->app_user->ID, 'spbc_2fa_app_token', true));
+    }
+
+    public function testQrEndpointIssuesFreshSecretOnEachSetup()
+    {
+        delete_user_meta($this->email_user->ID, 'spbc_2fa_type');
+        $this->asAjaxUser($this->email_user);
+
+        $secrets = array();
+        for ( $i = 0; $i < 2; $i++ ) {
+            list(, $output) = $this->captureOutput('spbc_2fa__Get2FAAppQrCode');
+            $response = json_decode($output, true);
+
+            $this->assertTrue($response['success']);
+            $this->assertRegExp('/^[A-Z2-7]{32}$/', $response['data']['code']);
+            $this->assertSame($response['data']['code'], get_user_meta($this->email_user->ID, 'spbc_2fa_app_token', true));
+            $secrets[] = $response['data']['code'];
+        }
+
+        $this->assertNotSame($secrets[0], $secrets[1]);
+    }
+
+    public function testQrEndpointRequiresNonce()
+    {
+        $this->asAjaxUser($this->email_user);
+        $_REQUEST['security'] = 'wrong';
+
+        list($result) = $this->captureOutput('spbc_2fa__Get2FAAppQrCode');
+
+        $this->assertSame(array('die', 403), $result);
+        $this->assertSame('', get_user_meta($this->email_user->ID, 'spbc_2fa_app_token', true));
+    }
+
+    public function testActivationCodeMarksTimeStepAsUsed()
+    {
+        $this->inOneTimeStep(function ($code) {
+            delete_user_meta($this->app_user->ID, 'spbc_2fa_type');
+            $this->asAjaxUser($this->app_user);
+            $_POST['code'] = $code;
+
+            list(, $output) = $this->captureOutput('spbc_2fa__Check2FAAppCode');
+
+            $this->assertTrue(json_decode($output, true)['success']);
+            $this->assertSame('2fa_application', get_user_meta($this->app_user->ID, 'spbc_2fa_type', true));
+            $this->assertSame(
+                $this->timeStep(),
+                (int) get_user_meta($this->app_user->ID, 'spbc_2fa_last_step', true)
+            );
+
+            // The code used for activation can't be used to log in
+            $this->giveStepToken($this->app_user);
+            $this->assertCodeError($this->postCode($this->app_user->user_login, $code), 2, $this->app_user);
+        });
+    }
+
+    public function testEmailCodeIsSixDigits()
+    {
+        global $spbc;
+
+        for ( $i = 0; $i < 20; $i++ ) {
+            spbc_2fa__key_generate_and_store($this->email_user);
+            $this->assertRegExp(
+                '/^[1-9]\d{5}$/',
+                (string) $spbc->data['2fa_keys'][$this->email_user->user_login]['val']
+            );
+        }
+    }
+}
diff --git a/tests/lib/CleantalkSP/SpbctWP/G2FA/TestGoogleAuthenticator.php b/tests/lib/CleantalkSP/SpbctWP/G2FA/TestGoogleAuthenticator.php
new file mode 100644
index 000000000..0c031a28f
--- /dev/null
+++ b/tests/lib/CleantalkSP/SpbctWP/G2FA/TestGoogleAuthenticator.php
@@ -0,0 +1,38 @@
+<?php
+
+use CleantalkSP\SpbctWP\G2FA\GoogleAuthenticator;
+use PHPUnit\Framework\TestCase;
+
+class TestGoogleAuthenticator extends TestCase
+{
+    /**
+     * RFC 6238 test vector (SHA1, secret "12345678901234567890", T = 59 s), truncated to 6 digits.
+     */
+    public function testRfc6238Vector()
+    {
+        $ga = new GoogleAuthenticator();
+
+        $this->assertSame('287082', $ga->getCode('GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ', 1));
+    }
+
+    public function testCodeIsSixDigits()
+    {
+        $ga = new GoogleAuthenticator();
+
+        $this->assertRegExp('/^\d{6}$/', $ga->getCode($ga->generateSecret()));
+    }
+
+    public function testSecretIs160BitBase32()
+    {
+        $ga = new GoogleAuthenticator();
+
+        $secrets = array();
+        for ( $i = 0; $i < 50; $i++ ) {
+            $secret = $ga->generateSecret();
+            $this->assertRegExp('/^[A-Z2-7]{32}$/', $secret);
+            $secrets[] = $secret;
+        }
+
+        $this->assertCount(50, array_unique($secrets));
+    }
+}
diff --git a/tests/lib/CleantalkSP/SpbctWP/RateLimiter/TestSpbcUserRateLimiter.php b/tests/lib/CleantalkSP/SpbctWP/RateLimiter/TestSpbcUserRateLimiter.php
new file mode 100644
index 000000000..b3cd41007
--- /dev/null
+++ b/tests/lib/CleantalkSP/SpbctWP/RateLimiter/TestSpbcUserRateLimiter.php
@@ -0,0 +1,151 @@
+<?php
+
+use CleantalkSP\Common\RateLimit\RateLimiterConfig;
+use CleantalkSP\SpbctWP\DB\TablesCreator;
+use CleantalkSP\SpbctWP\SpbcRateLimit\SpbcUserRateLimiter;
+use CleantalkSP\Variables\Server;
+
+class TestSpbcUserRateLimiter extends \SpbcTestCase
+{
+    const TYPE = 'test_user_limiter';
+
+    private $saved_server;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $tables_creator = new TablesCreator();
+        $tables_creator->createTable(SPBC_TBL_RATE_LIMITS);
+        $this->deleteRows();
+
+        $this->saved_server = $_SERVER;
+        $this->setRequest('10.0.0.1', 'PHPUnit');
+    }
+
+    protected function tearDown(): void
+    {
+        $this->deleteRows();
+        $_SERVER = $this->saved_server;
+        $this->resetRequestCache();
+
+        parent::tearDown();
+    }
+
+    private function deleteRows()
+    {
+        global $wpdb;
+        $wpdb->query($wpdb->prepare('DELETE FROM ' . SPBC_TBL_RATE_LIMITS . ' WHERE type = %s', self::TYPE));
+    }
+
+    private function resetRequestCache()
+    {
+        Server::getInstance()->variables = array();
+        \CleantalkSP\SpbctWP\Helpers\IP::getInstance()->ips_stored = array();
+    }
+
+    private function setRequest($ip, $ua)
+    {
+        $_SERVER['REMOTE_ADDR']     = $ip;
+        $_SERVER['HTTP_USER_AGENT'] = $ua;
+        $this->resetRequestCache();
+    }
+
+    private function limiter($user_id, $limit = 2)
+    {
+        return new SpbcUserRateLimiter(new RateLimiterConfig(self::TYPE, $limit, 60), $user_id);
+    }
+
+    public function testLocksAfterLimit()
+    {
+        $this->assertTrue($this->limiter(1)->checkPassed());
+        $this->assertTrue($this->limiter(1)->checkPassed());
+
+        $limiter = $this->limiter(1);
+        $this->assertFalse($limiter->checkPassed());
+        $this->assertTrue($limiter->process_ok);
+    }
+
+    public function testCounterIsPerUser()
+    {
+        for ( $i = 0; $i < 3; $i++ ) {
+            $this->limiter(1)->checkPassed();
+        }
+
+        $this->assertFalse($this->limiter(1)->checkPassed());
+        $this->assertTrue($this->limiter(2)->checkPassed());
+    }
+
+    public function testIpChangeDoesNotResetCounter()
+    {
+        for ( $i = 1; $i <= 2; $i++ ) {
+            $this->setRequest('10.0.0.' . $i, 'PHPUnit');
+            $this->assertTrue($this->limiter(1)->checkPassed());
+        }
+
+        $this->setRequest('10.0.0.3', 'PHPUnit');
+        $this->assertFalse($this->limiter(1)->checkPassed());
+    }
+
+    public function testResetUnlocksOnlyGivenUser()
+    {
+        for ( $i = 0; $i < 3; $i++ ) {
+            $this->limiter(1)->checkPassed();
+            $this->limiter(2)->checkPassed();
+        }
+
+        $this->limiter(1)->reset();
+
+        $this->assertTrue($this->limiter(1)->checkPassed());
+        $this->assertFalse($this->limiter(2)->checkPassed());
+    }
+
+    public function hostileUserAgentProvider()
+    {
+        return array(
+            'long ascii'                     => array(str_repeat('A', 1000)),
+            'multibyte char split at 200'    => array(str_repeat('A', 199) . "\xC3\xA9"),
+            'invalid utf-8 byte'             => array('Mozilla' . "\xFF\xFE"),
+            '4-byte utf-8 char'              => array('Mozilla ' . "\xF0\x9F\x98\x80"),
+            'long multibyte'                 => array(str_repeat("\xD0\x96", 500)),
+        );
+    }
+
+    /**
+     * An attacker-controlled UA must not fail the insert: the limiter fails open on DB errors.
+     *
+     * @dataProvider hostileUserAgentProvider
+     */
+    public function testHostileUserAgentDoesNotBreakCounting($ua)
+    {
+        $this->assertLockedAfterOneAttempt($ua);
+    }
+
+    /**
+     * @dataProvider hostileUserAgentProvider
+     */
+    public function testHostileUserAgentDoesNotBreakCountingInStrictMode($ua)
+    {
+        global $wpdb;
+
+        $sql_mode = $wpdb->get_var('SELECT @@SESSION.sql_mode');
+        $wpdb->query("SET SESSION sql_mode = 'STRICT_ALL_TABLES'");
+
+        try {
+            $this->assertLockedAfterOneAttempt($ua);
+        } finally {
+            $wpdb->query($wpdb->prepare('SET SESSION sql_mode = %s', $sql_mode));
+        }
+    }
+
+    private function assertLockedAfterOneAttempt($ua)
+    {
+        $this->setRequest('10.0.0.1', $ua);
+
+        $this->assertTrue($this->limiter(1, 1)->checkPassed());
+
+        $limiter = $this->limiter(1, 1);
+        $this->assertFalse($limiter->checkPassed(), 'limiter must not fail open on a hostile UA');
+        $this->assertTrue($limiter->process_ok);
+    }
+}