About this plugin
Email OTP Login for User Manager adds an additional email verification step to the frontend login form provided by WP User Manager.
After a user enters valid username and password credentials, the plugin generates a one-time verification code and sends it to the user’s registered email address. The user must enter the verification code before the WordPress login is completed.
The plugin is designed for websites using WP User Manager where additional verification is required for frontend user logins.
Features
- Email-based one-time password (OTP) verification.
- Works with the WP User Manager frontend login form.
- Six-digit OTP codes.
- OTP codes are stored securely as hashes.
- Configurable OTP expiration period.
- Limits the number of incorrect OTP attempts.
- Invalidates the OTP after the maximum number of failed attempts.
- Prevents the WordPress login from being completed until OTP verification succeeds.
- Uses WordPress nonces for OTP form security.
- Supports WordPress email delivery through wp_mail().
- Administrators and other users logging in through the WP User Manager frontend login can use the OTP verification flow.
- Does not modify the standard WordPress wp-login.php authentication flow.
Requirements
- WordPress 6.0 or later.
- PHP 7.4 or later.
- WP User Manager.
The website must have working WordPress email delivery configured. For reliable email delivery, an SMTP plugin or another transactional email service may be used.
Usage
After installation, add the following shortcode to the page that will be used for OTP verification:
[softemot_email_otp_login]
When a user successfully submits their username and password through the WP User Manager frontend login form:
- The credentials are validated.
- A one-time verification code is generated.
- The verification code is sent to the user’s registered email address.
- The user is redirected to the OTP verification page.
- The user enters the verification code.
- The WordPress login is completed only after successful OTP verification.
Security
OTP codes are not stored in plain text. The plugin stores a hash of the generated OTP.
OTP verification attempts are limited. When the maximum number of incorrect attempts is reached, the current OTP is invalidated and the user must start the login process again.
The OTP verification form uses a WordPress nonce to help protect the verification request.
Email Delivery
This plugin uses WordPress’s wp_mail() function to send verification codes.
The plugin does not provide an SMTP mail server. If your website does not reliably send WordPress emails, configure an SMTP plugin or transactional email service separately.