kwtsms

<p><strong>kwtSMS</strong> replaces or supplements WordPress passwords with SMS one-time codes, sends WooCommerce order updates automatically, and lets you verify phone numbers on any contact form. Built on the <a href="https://www.kwtsms.com" rel="nofollow ugc">kwtSMS</a> SMS gateway.</p>
<p>Built for Arabic-speaking markets (Kuwait, Saudi Arabia, UAE, Bahrain, Qatar, Oman) with full RTL admin support and bilingual SMS templates in English and Arabic.</p>
<h4>Authentication</h4>
<ul>
<li><strong>2FA Mode:</strong> users log in with username + password, then confirm with a 6-digit SMS code</li>
<li><strong>Passwordless Mode:</strong> users enter their phone number and receive an OTP to log in directly, no password needed</li>
<li><strong>Both Modes:</strong> let each user choose their preferred method</li>
<li><strong>Password Reset via SMS:</strong> replace the email link with an SMS OTP verification flow</li>
<li><strong>Role-Based Enforcement:</strong> configure which user roles must pass OTP (exclude administrators, apply only to customers, etc.)</li>
<li><strong>Welcome SMS:</strong> send a customisable welcome message when a new user registers</li>
<li><strong>Country Code Dropdown:</strong> restrict the dial-code selector on login forms to GCC countries or a custom list</li>
</ul>
<h4>WooCommerce Integration</h4>
<ul>
<li><strong>7 order status notifications:</strong> Processing, On-Hold (Shipped), Completed, Cancelled, Pending Payment, Refunded, Failed</li>
<li><strong>Admin order notifications:</strong> automatically notify a configurable admin phone number on any order status change</li>
<li><strong>Checkout OTP Gate:</strong> require phone verification before the customer can place an order (all methods or COD-only)</li>
<li><strong>Per-status templates:</strong> independent English + Arabic SMS template for every order status</li>
<li><strong>Admin SMS panel:</strong> send a custom free-text SMS to any order’s customer from the order edit screen</li>
<li><strong>Stock alerts:</strong> low stock, out of stock, and backorder notifications to admin</li>
<li><strong>New product SMS:</strong> notify admin when a product is first published</li>
<li><strong>Back-in-stock notifications:</strong> customers subscribe on out-of-stock product pages, SMS sent automatically on restock</li>
<li><strong>Instant new order SMS:</strong> notify admin the moment an order is placed, before status processing</li>
<li><strong>Cart abandonment recovery:</strong> detect abandoned carts, send recovery SMS with auto-generated coupon codes, track recovery stats on the dashboard</li>
<li><strong>Multivendor support:</strong> per-vendor order SMS for Dokan, WCFM, and WC Vendors</li>
<li>HPOS (High-Performance Order Storage) compatible</li>
</ul>
<h4>Contact Form Integrations</h4>
<p>Each integration supports two modes: <strong>Notification</strong> (send a confirmation SMS on submit) and <strong>OTP Gate</strong> (block submission until the phone number is verified):</p>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Ninja Forms</li>
</ul>
<h4>Security</h4>
<ul>
<li>Sliding-window rate limiting per phone number, per IP address, and per user account</li>
<li>Duplicate OTP guard: reuses existing valid OTP on double-click or page reload</li>
<li>IP Allowlist/Blocklist with CIDR support for IPv4 and IPv6</li>
<li>IPHub proxy/VPN detection (optional): silently block or flag OTP requests from known proxies</li>
<li>Registration OTP gate: verify phone via OTP before account creation</li>
<li>Trusted Devices: trust a device for 30 days after 2FA, with profile revoke controls</li>
<li>Phone blocking list: silently drop OTP requests from blocked numbers (anti-enumeration)</li>
<li>Attempt lockout after configurable max failures</li>
<li>Google reCAPTCHA v3 and Cloudflare Turnstile support</li>
<li>All credentials stored server-side, never output to HTML</li>
<li>Nonces on every form and AJAX action</li>
<li>Anti-enumeration: password reset never reveals whether an account exists</li>
</ul>
<h4>External Services</h4>
<p>This plugin connects to the following external services:</p>
<p><strong>1. kwtSMS API</strong> (required): sends all SMS messages. <a href="https://www.kwtsms.com" rel="nofollow ugc">kwtsms.com</a> | <a href="https://www.kwtsms.com/policy.html" rel="nofollow ugc">Terms</a> | <a href="https://www.kwtsms.com/privacy.html" rel="nofollow ugc">Privacy</a></p>
<p><strong>2. ipapi.co</strong> (optional): detects visitor country for dial-code pre-selection. <a href="https://ipapi.co" rel="nofollow ugc">ipapi.co</a> | <a href="https://ipapi.co/terms/" rel="nofollow ugc">Terms</a> | <a href="https://ipapi.co/privacy/" rel="nofollow ugc">Privacy</a></p>
<p><strong>3. IPHub</strong> (optional): proxy/VPN detection on OTP requests. <a href="https://iphub.info" rel="nofollow ugc">iphub.info</a> | <a href="https://iphub.info/legal" rel="nofollow ugc">Terms</a> | <a href="https://iphub.info/legal" rel="nofollow ugc">Privacy</a></p>
<p><strong>4. Google reCAPTCHA v3</strong> (optional): bot protection on OTP forms. <a href="https://www.google.com/recaptcha/" rel="nofollow ugc">google.com/recaptcha</a> | <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy</a></p>
<p><strong>5. Cloudflare Turnstile</strong> (optional): alternative bot protection. <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">cloudflare.com/turnstile</a> | <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Terms</a> | <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Privacy</a></p>
<h4>Admin</h4>
<ul>
<li><strong>Users Without Phone</strong> sub-page under the WordPress Users menu: lists all registered users missing a phone number, with a dynamic count badge on the menu item</li>
</ul>
<h4>Test Mode</h4>
<p>Enable <strong>Test Mode</strong> in the Gateway settings to test without receiving real SMS messages. Messages are queued on the kwtSMS server but never delivered to the phone. Credits are still deducted. To recover them, log in to your kwtSMS account dashboard and delete the queued messages. The OTP code is visible under kwtSMS > Logs > Debug Log so you can complete flows during development.</p>
<h4>Languages</h4>
<p>Ships with English (default) and Arabic translations. The plugin admin UI and all user-facing strings are fully translatable.</p>
<h3>Help & Support</h3>
<ul>
<li><strong><a href="https://www.kwtsms.com/faq/" rel="nofollow ugc">kwtSMS FAQ</a></strong>: Answers to common questions about credits, sender IDs, OTP, and delivery.</li>
<li><strong><a href="https://www.kwtsms.com/support.html" rel="nofollow ugc">kwtSMS Support</a></strong>: Open a support ticket or browse help articles.</li>
<li><strong><a href="https://www.kwtsms.com/#contact" rel="nofollow ugc">Contact kwtSMS</a></strong>: Reach the kwtSMS team directly for Sender ID registration and account issues.</li>
<li><strong><a href="https://www.kwtsms.com/sender-id-help.html" rel="nofollow ugc">Sender ID Help</a></strong>: Sender ID registration and guidelines.</li>
<li><strong><a href="https://www.kwtsms.com/login/" rel="nofollow ugc">kwtSMS Dashboard</a></strong>: Recharge credits, buy Sender IDs, view message logs, and manage coverage.</li>
<li><strong><a href="https://www.kwtsms.com/integrations.html" rel="nofollow ugc">Other Integrations</a></strong>: Plugins and integrations for other platforms and languages.</li>
<li><strong><a href="https://github.com/boxlinknet/kwtsms-wordpress/issues" rel="nofollow ugc">Plugin Issues</a></strong>: Report bugs or request features for this WordPress plugin.</li>
</ul>


kwtSMS: OTP & SMS Notifications

SMS OTP login, password reset, and WooCommerce order notifications via the kwtSMS gateway. Arabic RTL support included.

cs7.in

<p><strong>Email OTP Authenticator</strong> is an Authentication & Security plugin designed to simplify WordPress login while strengthening user protection. It replaces traditional passwords with secure OTP verification and adds advanced session protection for better control over user access.</p>
<p>Built as a modular security system, the plugin operates through three dedicated protection engines while maintaining a fully self-contained architecture without external service dependency.</p>
<h3>Delivering these key benefits:</h3>
<ul>
<li>Reduce login friction</li>
<li>Increase signup conversions</li>
<li>Reduce password reset requests</li>
<li>Strengthen multi-layered website security</li>
<li>Enhance user trust with secure authentication</li>
</ul>
<p>Designed to make WordPress authentication faster, smarter and more secure.</p>
<h3>Core Security Architecture</h3>
<p>The plugin is engineered around three dedicated security engines:</p>
<p><strong>Access Engine</strong></p>
<p>Handles secure user entry through passwordless authentication.</p>
<p>Features:<br />
* OTP Login<br />
* OTP Registration<br />
* Guest Verification<br />
* Email authorization<br />
* Fast Authentication Flow</p>
<p><strong>Validation Engine</strong></p>
<p>Adds identity confirmation and verification controls.</p>
<p>Features:<br />
* New Device detection<br />
* Auto-popup with UI lock<br />
* Parallel login validation<br />
* Two-Factor Authentication<br />
* Login Validity Enforcement</p>
<p><strong>Security Engine</strong></p>
<p>Protects active sessions and detects abnormal activity.</p>
<p>Features:<br />
* Dynamic Session Shield<br />
* Session Validity Check<br />
* Session Inactivity Lock<br />
* Adaptive 2FA Enforcement<br />
* Suspicious Activity Guard</p>
<h3>Key Highlights</h3>
<ul>
<li><strong>Quick Login & Signup</strong> – Instant, easy, and password-free; Login & signup with OTP.</li>
<li><strong>Built-in Two-Factor Authentication</strong> – Additional identity protection layer.</li>
<li><strong>Verified Access Control</strong> – Verify users without login for access to restricted pages.</li>
<li><strong>Dynamic Session Shield</strong> – Intelligent session protection engine.</li>
<li><strong>Zero External Dependency</strong> – Works without third-party services.</li>
<li><strong>Modern Vanilla JavaScript Engine</strong> – No jQuery dependency.</li>
<li><strong>Flexible Integration Options</strong> – Add authentication anywhere.</li>
<li><strong>Complete Admin Control</strong> – Fine-tune authentication behavior.</li>
<li><strong>Built-in Interface System</strong> – Attractive ready-to-use templates.</li>
<li><strong>Lightweight & Fast</strong> – Optimized for performance.</li>
</ul>
<h3>Flexible Integration Options</h3>
<p>Add authentication forms anywhere on your website using simple integration methods.</p>
<p>Integration methods include:</p>
<ul>
<li>Shortcode integration (auto-popup, popup or inline forms)</li>
<li>Menu trigger integration (popup forms)</li>
<li>Redirect support for auto-popup & inline form pages</li>
<li>Multiple forms on the same page</li>
<li>Easy setup without coding complexity</li>
</ul>
<h3>Built-in Templates</h3>
<p>Attractive 27 ready-to-use templates with auto-popup, popup and inline support.</p>
<p>Easy-to-apply modern designs that match your website style, with options to customize pre-built templates or create your own.</p>
<h3>Complete Admin Control</h3>
<p>Customize authentication behavior, layout options, security restrictions and verification rules with ease. Admins gain complete control over user access and interaction across the website.</p>
<h3>Zero External Dependency</h3>
<p>Run a complete authentication system without relying on any third-party services.</p>
<ul>
<li>Full data control</li>
<li>Standalone operation</li>
<li>No external APIs required</li>
<li>Self-hosted OTP processing</li>
<li>Reliable authentication flow</li>
</ul>
<h3>Modern Architecture</h3>
<p>Built using modern development practices:</p>
<ul>
<li>Vanilla JavaScript implementation (no jQuery)</li>
<li>Optimized settings storage</li>
<li>Secure token validation</li>
<li>Lightweight execution flow</li>
<li>Improved performance structure</li>
</ul>
<h3>Ideal Use Cases</h3>
<p>This plugin is ideal for:</p>
<ul>
<li>Membership websites</li>
<li>WooCommerce stores</li>
<li>SaaS dashboards</li>
<li>Community platforms</li>
<li>Agencies managing client websites</li>
<li>Developers needing flexible authentication</li>
<li>Beginners and small websites needing simple security</li>
</ul>
<p>Designed to scale from beginner websites to enterprise environments.</p>
<h3>Compatibility</h3>
<p>Works smoothly with popular WordPress tools:</p>
<ul>
<li>WooCommerce</li>
<li>Ultimate Member</li>
<li>MemberPress</li>
<li>BuddyPress</li>
<li>ProfileGrid</li>
<li>ProfilePress</li>
<li>User Registration</li>
<li>WP User Manager</li>
<li>Paid Memberships Pro</li>
<li>RegistrationMagic</li>
<li>Forminator</li>
<li>Login/Signup Popup plugins</li>
<li>And many more</li>
</ul>
<h3>Why Choose This Plugin</h3>
<ul>
<li>FAST – Quick OTP authentication process</li>
<li>FRIENDLY – Simple user experience</li>
<li>SMART – Intelligent access handling</li>
<li>SMOOTH – Clean UI integration</li>
<li>SECURED – Strong authentication protection</li>
</ul>
<h3>Support</h3>
<p>Feedback helps improve this plugin.<br />
Send suggestions or issues to:<br />
<a href="mailto:Mr.Chandan.Shrivastava@gmail.com" rel="nofollow ugc">Mr.Chandan.Shrivastava@gmail.com</a></p>
<h3>Notes</h3>
<p>This is the Lite version with advanced features included for exploration.</p>


Email OTP Authenticator – Login, Register, 2FA & Session Lock

An advanced OTP-powered plugin for Login, Registration, 2FA Protection and Dynamic Session Security. It is FAST, FRIENDLY, SMART, SMOOTH & SECURE.

kwtSMS: OTP & SMS Notifications vs Email OTP Authenticator – Login, Register, 2FA & Session Lock