WP 2FA Premium by Melapress extends the free plugin with per-role policies, trusted devices, customisable grace periods, white-label branding, and an extended set of methods including hardware keys and recovery codes. The configuration screens are clean, but the auditor's question (which users on this site still have not enrolled, and which ones are using the weakest acceptable method) is buried in wp_usermeta rather than answered on a single page.

SleekView reads the wp_2fa_enabled_methods, wp_2fa_status, wp_2fa_grace_period, and wp_2fa_last_login meta keys WP 2FA Premium writes, then joins them with wp_users and the capabilities meta to produce a per-user roster. Role, method, status, grace expiry, and last verification become first-class columns, sortable and filterable together.

Edits route through WP 2FA's own settings APIs where the plugin exposes them (resetting a user, extending grace, removing trusted devices). Where it does not, SleekView falls back to direct meta updates with conflict detection so the audit trail stays intact and two admins editing the same row cannot silently overwrite each other.

Most credential-driven WordPress incidents involve accounts that should have had 2FA but did not, often because someone slipped through a grace period or a role exception that nobody reviewed in time. WP 2FA Premium's enforcement is solid, but enforcement only counts in an audit when it is regularly verified at the per-user level, and the default Premium screens emphasise policy configuration rather than per-user state. Security teams therefore either trust the policy is being applied correctly (which most auditors will not accept) or they extract enrollment data from wp_usermeta by hand.

SleekView turns the underlying schema into a first-class asset, joining wp_users with the wp_2fa_* keys to produce a roster of every user and every relevant meta value. Saved views answer the questions a security committee asks every quarter, including admin compliance, method mix, grace-period stragglers, and trusted-device counts. That moves 2FA from 'we have a policy' to 'here is the proof, exported yesterday, with these specific users being followed up by name'.

The roster also replaces an ad-hoc spreadsheet that some analyst maintained by hand, which is always slightly out of date and never reflects the live state of wp_usermeta.