BerryPress

<p>LoginBerry bundles <strong>account verification</strong>, <strong>two-factor authentication (2FA)</strong>, <strong>passwordless login</strong>, and <strong>login logs</strong>. Each feature can be enabled or disabled independently. Outgoing codes are delivered by <strong>email</strong>.</p>
<p>The plugin works for standard WordPress sites. When WooCommerce is active, additional customer- and order-related options are available (for example 2FA on the My Account login form and optional account activation tied to orders).</p>
<h4>User-facing behavior (when features are enabled)</h4>
<ul>
<li><strong>Account verification:</strong> After registration, the user signs in and completes activation on the configured activation page using a six-digit code sent by email.</li>
<li><strong>Two-factor authentication:</strong> After a successful username and password, the user enters a second code sent by email. Per-role modes are Required, Optional, or Disabled.</li>
<li><strong>Passwordless login:</strong> On <code>wp-login.php</code>, eligible roles may request a one-time email code instead of entering a password.</li>
<li><strong>Login logs:</strong> Success and failure records are listed in the WordPress admin.</li>
</ul>
<p>Authentication codes are email-based; end users do not install a separate authenticator app for the flows described here.</p>
<h4>Account verification</h4>
<ul>
<li>New accounts receive a six-digit activation code by email.</li>
<li>After fifteen failed activation attempts, the account is locked until an administrator intervenes.</li>
<li>Administrators can resend codes, activate accounts manually, and unlock accounts from <strong>Users <span aria-hidden="true" class="wp-exclude-emoji">→</span> All Users</strong>.</li>
</ul>
<h4>Two-factor authentication (2FA)</h4>
<ul>
<li>Per-role setting: Required, Optional, or Disabled.</li>
<li>Optional mode allows users to enable 2FA from the profile when permitted by role.</li>
<li>Supported on <code>wp-login.php</code> and on the WooCommerce <strong>My Account</strong> login form.</li>
</ul>
<h4>Passwordless login</h4>
<p>Let users log in without a password – just enter a username or email and receive a one-time login code. Improves user experience while maintaining strong security through email verification.</p>
<ul>
<li>Toggle between password and passwordless login on wp-login.php</li>
<li>One-time email codes on <code>wp-login.php</code>, controlled per role.</li>
<li>When both passwordless login and 2FA are enabled for the same role, the passwordless flow does not require a separate 2FA step (email possession is already verified).</li>
</ul>
<h4>WooCommerce</h4>
<ul>
<li>Optional automatic account activation when an WooCommerce order is created.</li>
<li>Optional restriction so that only <strong>paid</strong> orders trigger activation.</li>
<li>Integration points include classic checkout, block checkout (Store API), and paid-order completion hooks, as implemented in the plugin.</li>
</ul>
<h4>Login logs</h4>
<p>Monitor all login activity on your site. Essential for detecting suspicious behavior and meeting security compliance requirements for e-commerce stores.</p>
<ul>
<li>Records successful and failed login attempts</li>
<li>Logs username, email, IP address, and timestamp</li>
<li>View all logs in a dedicated admin page with sortable columns</li>
<li>Identify patterns of brute force attacks and suspicious login activity</li>
<li>Audit trail for security compliance and fraud investigation</li>
</ul>
<h4>Admin interface</h4>
<ul>
<li>Centralized settings under <strong>BerryPress <span aria-hidden="true" class="wp-exclude-emoji">→</span> LoginBerry</strong>, with separate screens per feature.</li>
</ul>
<h4>Email templates</h4>
<p>HTML email templates for activation, 2FA, and passwordless login ship in the plugin <code>templates/</code> directory. To override, copy the desired template into the active theme or child theme under <code>templates/loginberry/</code> (see each template file header for the exact path).</p>
<h4>Email delivery</h4>
<p>Reliable outbound email is required for codes to arrive. Typical setups use the hosting provider’s mail relay, a transactional email API (for example Brevo, Mailchimp Transactional / Mandrill, Postmark, SendGrid, Amazon SES), or a WordPress plugin that sends mail via SMTP or a provider API. Test delivery with a real signup or code request before relying on the feature in production.</p>
<h4>Typical use cases</h4>
<ul>
<li>Reducing unwanted or automated registrations and limiting abuse of disposable email addresses.</li>
<li>Verifying that a customer or member controls the email address on file.</li>
<li>Adding a second factor after password entry for selected roles.</li>
<li>Reviewing login success and failure history in the admin.</li>
<li>WooCommerce: applying optional post-order account activation, including a paid-order-only mode where configured.</li>
</ul>
<h4>Roadmap</h4>
<p>LoginBerry is a brand new plugin and we are improving it quickly based on real user feedback. If you have ideas, feature requests, or run into a theme-specific styling issue, we would love to hear from you.</p>
<p>Planned work includes:</p>
<ul>
<li>Configurable failed-attempt limits (instead of the fixed fifteen for activation lockout)</li>
<li>Track last login time for each user</li>
<li>Custom activation page URL</li>
<li>Custom redirect URL after successful verification</li>
<li>Rate limiting on code verification attempts</li>
<li>Social login options</li>
<li>Improved styling flexibility and theme compatibility</li>
</ul>
<p>Feedback and compatibility reports are welcome via the plugin support channels. New features are prioritized based on user feedback.</p>


LoginBerry – 2FA, Passwordless & Email Verification

Complete login security for WordPress & WooCommerce: LoginBerry adds email-based account verification, optional two-factor authentication (2FA), o …

Alexandre Froger

<p>Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.</p>
<h3>Overview</h3>
<p>This plugin adds the following major features to WordPress:</p>
<ul>
<li><strong>3 One-Time Password modes</strong>: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li><strong>3 Authentication Gateways for OTP Verification Codes:</strong> WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li><strong>Two-Factor Authentication:</strong> allow (or force) users to authenticate with a second factor on top of their password.</li>
<li><strong>Passwordless Authentication:</strong> allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li><strong>Account Validation:</strong> force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li><strong>Synchronize OTP identifiers with existing data:</strong> wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li><strong>Simple yet customizable appearance:</strong> forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li><strong>Activity Logs:</strong> when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li><strong>Customizable for developers:</strong> developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li><strong>Integration-friendly:</strong> specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li><strong>Unlimited features:</strong> there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
<p>OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.</p>
<p>Each <strong>bug</strong> report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.</p>
<p><strong>Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.</strong></p>
<p><strong>Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum</strong>.</p>
<h3>Integrations</h3>
<p>Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.</p>
<p>Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).</p>
<p>If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.</p>
<p><strong>All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception</strong>.<br />
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.</p>


OTP Authenticator

One-Time Password Authentication for WordPress

LoginBerry – 2FA, Passwordless & Email Verification vs OTP Authenticator