About this plugin
ShivWeb Login Verification adds two-factor authentication (2FA) to your WordPress login using email codes. A user signs in with their password as usual, then the plugin emails them a short login code and holds the session until the code is entered. Someone who has stolen a password but cannot open the user’s inbox stays locked out.
There is no authenticator app to set up, no external service to sign up for, and no API keys. Codes are sent through your site’s own email, so any SMTP plugin you already use handles delivery, and everything runs on your server.
How a login works
- The user enters their username and password as normal.
- The plugin emails them a one time code (OTP) and holds the session.
- They type the code on the verification screen and continue exactly where they were going.
Choose who needs a code
Enforcement is role based. Tick the roles that should verify and leave the rest alone. By default only the Customer role is gated, so a store can protect shopper accounts without changing how the team logs in.
Users can also mark a browser as trusted for a number of days you choose, so regulars are not asked for a code on every visit.
Built so you cannot lock yourself out
Enforcement stays off until you prove email delivery works: the plugin asks you to send yourself a test code and enter it before the feature can be switched on. So a broken mailer can never lock everyone out. php or one WP-CLI command turns everything off and releases every held session immediately.
Works with WooCommerce, including the block checkout
Most login verification plugins add a field to the login form. The WooCommerce block checkout never shows that field, because it signs customers in through the Store API in the background. php, wp-admin, My Account, the classic checkout and the block checkout are all covered by the same check.
Nothing depends on the browser, so it cannot be skipped by calling an endpoint directly.
Email verification at registration
Optionally require new sign-ups to confirm their email address with a code before their first session works. A small popup verifies the address right on the register form, checkout registrations are verified just after, and abandoned unverified accounts are cleaned up automatically after a grace period.
Features
- Two-factor authentication with email login codes, no authenticator app needed
- Role based enforcement: choose exactly which user roles must verify
- WooCommerce ready: My Account, classic checkout, and the block checkout
- Trusted devices: remember a browser for a number of days you choose
- Email verification for new registrations, with automatic cleanup
- Rate limiting on every layer: resend cooldown, attempt lockout, and per-account send caps
- Customizable email template and on-screen messages
- No external service, no API keys, no per-message fees, no tracking
- Recovery built in: a wp-config.php constant and WP-CLI commands
Recovery
php, or run wp swlv disable with WP-CLI. Both release every held session immediately. To unstick a single user (send limit reached, mailbox typo), run wp swlv reset-user <id|login|email>.