Cozmoslabs

Cristian Antohe

Chris Martens

Transform your WordPress login experience with passwordless authentication. Users simply enter their email address and receive a secure magic link – click to login instantly. It’s more secure than weak passwords and infinitely more user-friendly.
<h4>Why Choose Keyless Auth?</h4>
<ul>
<li>Enhanced Security: No more weak, reused, or compromised passwords</li>
<li>Better User Experience: One click instead of remembering complex passwords</li>
<li>Reduced Support: Eliminate “forgot password” requests</li>
<li>Modern Authentication: Enterprise-grade security used by Slack, Medium, and others</li>
<li>Security Hardening: Built-in protection against brute force attacks and username enumeration</li>
</ul>
<h4>Quick Start</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Create a new page and add the shortcode <code>[keyless-auth]</code></li>
<li>Configure email templates in Keyless Auth → Templates</li>
<li>Done! Users can now login passwordlessly</li>
</ol>
<h4>Core Features</h4>
Ready to Use 
* Magic Link Authentication – Secure, one-time login links via email 
* Two-Factor Authentication (2FA) – Complete TOTP support with Google Authenticator 
* Role-Based 2FA – Require 2FA for specific user roles (admins, editors, etc.) 
* Custom 2FA Setup URLs – Direct users to branded frontend 2FA setup pages 
* SMTP Integration – Reliable email delivery through your mail server 
* Email Templates – Professional, customizable login emails 
* Mail Logging – Track all sent emails with delivery status 
* Custom Database Tables – Scalable architecture with dedicated audit logs
Advanced Security 
* Token Security: 10-minute expiration, single-use tokens 
* Audit Logging: IP addresses, device types, login attempts 
* Emergency Mode: Grace period system with admin controls 
* Secure Storage: SMTP credentials in wp-config.php option 
* XML-RPC Disable: Block brute force attacks via XML-RPC interface 
* Application Passwords Control: Disable programmatic authentication when not needed 
* User Enumeration Prevention: Block username discovery attacks
Customization 
* WYSIWYG Email Editor: Full HTML support with live preview 
* Advanced Color Controls: Hex, RGB, HSL color formats 
* Template System: German, English, and custom templates 
* Branding Options: Custom sender names and professional styling
<h4>Installation & Setup</h4>
Basic Installation 
1. WordPress Admin → Plugins → Add New 
2. Search for “Keyless Auth” 
3. Install and activate 
4. Add [keyless-auth] shortcode to any page
SMTP Configuration (Recommended) 
1. Navigate to Keyless Auth → SMTP 
2. Configure your email provider (Gmail, Outlook, SendGrid, etc.) 
3. Test email delivery 
4. Save settings
Two-Factor Authentication Setup 
1. Go to Keyless Auth → Options 
2. Enable “Two-Factor Authentication” 
3. Select required user roles 
4. Users scan QR code with authenticator app
<h4>Email Templates</h4>
Template Options 
* German Professional: Sleek German-language template 
* English Simple: Clean, minimalist design 
* Custom HTML: Create your own with WYSIWYG editor
Customization Features 
* Full HTML and CSS support 
* Color picker for buttons and links 
* Responsive email design 
* Live template preview 
* Placeholder system for dynamic content
<h4>Security & Compliance</h4>
Token Security 
* Generated using WordPress security standards 
* Based on user ID, timestamp, and wp-config.php salt 
* 10-minute expiration with single-use enforcement 
* Secure database storage with automatic cleanup
Two-Factor Authentication 
* TOTP-based system compatible with Google Authenticator, Authy 
* Role-based requirements for granular control 
* Grace period system for smooth user transitions 
* Custom verification forms with professional styling
Database Architecture 
* Custom tables for optimal performance 
* Comprehensive audit logging 
* Device tracking and IP monitoring 
* Automatic maintenance and cleanup routines
<h4>Security Hardening</h4>
Keyless Auth includes comprehensive security hardening features to protect your WordPress site from common attack vectors. All features are optional and can be enabled based on your site’s needs.
XML-RPC Disable 
* Prevents brute force attacks via WordPress XML-RPC interface 
* Reduces attack surface by disabling legacy API 
* Recommended for sites not using Jetpack, mobile apps, or pingbacks
Application Passwords Control 
* Disable REST API and XML-RPC authentication when programmatic access isn’t needed 
* Prevents unauthorized API access 
* Recommended for simple sites without third-party integrations
User Enumeration Prevention 
* Blocks REST API user endpoints (<code>/wp-json/wp/v2/users</code>) 
* Redirects author archives and <code>?author=N</code> queries 
* Removes login error messages that reveal usernames 
* Strips comment author CSS classes 
* Removes author data from oEmbed responses 
* Recommended for business/corporate sites without author profiles
Benefits 
* Combined protection against brute force attacks 
* Prevents username discovery for targeted attacks 
* Reduces unauthorized API access 
* Easy to configure without code or .htaccess modifications 
* All features include comprehensive documentation 
* FTP recovery available if needed
<h4>SMTP & Email Delivery</h4>
Supported Providers 
* Gmail / Google Workspace 
* Outlook / Microsoft 365 
* Mailgun, SendGrid, Amazon SES 
* Any SMTP-compatible service
Advanced Email Features 
* Message-ID domain alignment for deliverability 
* SPF/DKIM/DMARC compliance 
* Custom sender names and addresses 
* Bulk email log management 
* Delivery status tracking
Secure Credential Storage 
Store SMTP credentials securely in wp-config.php:
<pre><code>define('CHRMRTNS_KLA_SMTP_USERNAME', 'your-email@example.com');
define('CHRMRTNS_KLA_SMTP_PASSWORD', 'your-smtp-password');
</code></pre>
<h4>WordPress Integration</h4>
Login Page Integration 
* Optional magic login field on wp-login.php 
* Seamless integration with existing login flow 
* Toggle control for easy enable/disable 
* Clean, responsive form styling
Shortcode Usage 
Use <code>[keyless-auth]</code> anywhere: pages, posts, widgets, or custom templates.
<h4>Developer Features</h4>
Hooks & Filters
Customize login redirect: 
 add_filter(‘wpa_after_login_redirect’, ‘custom_redirect_function’);
Modify email headers: 
 add_filter(‘wpa_email_headers’, ‘custom_email_headers’);
Change token expiration: 
 add_filter(‘wpa_change_link_expiration’, ‘custom_expiration_time’);
Modular Architecture 
* Clean, organized class structure 
* Separated concerns for easy maintenance 
* WordPress coding standards compliance 
* Extensive documentation and comments
<h4>Requirements</h4>
<ul>
<li>WordPress: 3.9 or higher (tested up to 6.8)</li>
<li>PHP: 7.4 or higher</li>
<li>Email Delivery: SMTP recommended for reliability</li>
</ul>
Note: Keyless Auth complements WordPress’s default login system – it doesn’t replace it.
Developed by Chris Martens | Based on the original Passwordless Login plugin by Cozmoslabs

Keyless Auth – Login without Passwords

Secure, passwordless authentication for WordPress. Your users login via magic email links – no passwords to remember or forget.

Sadekur Rahman

Password Less Login is a passwordless and OTP-based login system for WordPress. 
Every user — both existing and new — must verify their identity using a One-Time Password (OTP) sent to their email before being logged in.
This ensures that no one can access an account without confirming ownership of the email address, providing a secure, passwordless authentication process.
<h3>How It Works</h3>
<ol>
<li>The user enters their email address.</li>
<li>The plugin sends a 6-digit OTP to that email.</li>
<li>The user enters the OTP:
<ul>
<li>If the email exists → the user is securely logged in.</li>
<li>If the email is new → the user provides a username, verifies the OTP, and a new account is created automatically.</li>
</ul>
</li>
<li>The OTP is valid for 10 minutes and expires after use.</li>
</ol>
<blockquote>
Note: The plugin never logs in users without OTP verification.
</blockquote>
<h3>Key Features</h3>
<ul>
<li>OTP-Based Authentication for All Users – Both existing and new users must verify the OTP before login.</li>
<li>Passwordless Login – Securely log in using only your email and OTP.</li>
<li>Auto User Registration – New users can register instantly after OTP verification.</li>
<li>Temporary OTP (10 Minutes) – Each OTP expires after 10 minutes and can only be used once.</li>
<li>Rate Limiting – Prevents brute-force or spam OTP requests (maximum 5 per 15 minutes per email).</li>
<li>Nonce Verification – Protects REST API endpoints from unauthorized access.</li>
<li>Secure Email Handling – Emails are hashed when stored in transients to protect user data.</li>
<li>Streamlined User Experience – Clean, minimal login flow with conditional fields for existing vs. new users.</li>
</ul>
<h3>Why Choose Password Less Login?</h3>
<ul>
<li>No passwords to remember or reset.</li>
<li>OTP verification ensures true ownership of email.</li>
<li>Protects against brute-force attacks.</li>
<li>Simple setup – works with the native WordPress login page.</li>
<li>Modern and user-friendly design.</li>
<li>Reduces “Forgot Password” support requests.</li>
</ul>
<h3>Usage</h3>
<ol>
<li>Go to your WordPress login page.</li>
<li>Enter your email address and click “Send OTP”.</li>
<li>Check your email for the OTP.</li>
<li>Enter the OTP in the login form:
<ul>
<li>If your account exists, you’ll be logged in.</li>
<li>If not, you’ll be prompted to provide a username before registration and login.</li>
</ul>
</li>
<li>You’ll be redirected to your dashboard after successful verification.</li>
</ol>
<h3>License</h3>
This plugin is released under the GPL license. You are free to use and modify it.
For support, contact: <a href="mailto:sadekur0rahman@gmail.com" rel="nofollow ugc">sadekur0rahman@gmail.com</a>

Password Less Login

A powerful and easy-to-use WordPress plugin for passwordless and OTP-based login.

Keyless Auth – Login without Passwords vs Password Less Login