BerryPress

LoginBerry bundles account verification, two-factor authentication (2FA), passwordless login, and login logs. Each feature can be enabled or disabled independently. Outgoing codes are delivered by email.
The plugin works for standard WordPress sites. When WooCommerce is active, additional customer- and order-related options are available (for example 2FA on the My Account login form and optional account activation tied to orders).
<h4>User-facing behavior (when features are enabled)</h4>
<ul>
<li>Account verification: After registration, the user signs in and completes activation on the configured activation page using a six-digit code sent by email.</li>
<li>Two-factor authentication: After a successful username and password, the user enters a second code sent by email. Per-role modes are Required, Optional, or Disabled.</li>
<li>Passwordless login: On <code>wp-login.php</code>, eligible roles may request a one-time email code instead of entering a password.</li>
<li>Login logs: Success and failure records are listed in the WordPress admin.</li>
</ul>
Authentication codes are email-based; end users do not install a separate authenticator app for the flows described here.
<h4>Account verification</h4>
<ul>
<li>New accounts receive a six-digit activation code by email.</li>
<li>After fifteen failed activation attempts, the account is locked until an administrator intervenes.</li>
<li>Administrators can resend codes, activate accounts manually, and unlock accounts from Users → All Users.</li>
</ul>
<h4>Two-factor authentication (2FA)</h4>
<ul>
<li>Per-role setting: Required, Optional, or Disabled.</li>
<li>Optional mode allows users to enable 2FA from the profile when permitted by role.</li>
<li>Supported on <code>wp-login.php</code> and on the WooCommerce My Account login form.</li>
</ul>
<h4>Passwordless login</h4>
Let users log in without a password – just enter a username or email and receive a one-time login code. Improves user experience while maintaining strong security through email verification.
<ul>
<li>Toggle between password and passwordless login on wp-login.php</li>
<li>One-time email codes on <code>wp-login.php</code>, controlled per role.</li>
<li>When both passwordless login and 2FA are enabled for the same role, the passwordless flow does not require a separate 2FA step (email possession is already verified).</li>
</ul>
<h4>WooCommerce</h4>
<ul>
<li>Optional automatic account activation when an WooCommerce order is created.</li>
<li>Optional restriction so that only paid orders trigger activation.</li>
<li>Integration points include classic checkout, block checkout (Store API), and paid-order completion hooks, as implemented in the plugin.</li>
</ul>
<h4>Login logs</h4>
Monitor all login activity on your site. Essential for detecting suspicious behavior and meeting security compliance requirements for e-commerce stores.
<ul>
<li>Records successful and failed login attempts</li>
<li>Logs username, email, IP address, and timestamp</li>
<li>View all logs in a dedicated admin page with sortable columns</li>
<li>Identify patterns of brute force attacks and suspicious login activity</li>
<li>Audit trail for security compliance and fraud investigation</li>
</ul>
<h4>Admin interface</h4>
<ul>
<li>Centralized settings under BerryPress → LoginBerry, with separate screens per feature.</li>
</ul>
<h4>Email templates</h4>
HTML email templates for activation, 2FA, and passwordless login ship in the plugin <code>templates/</code> directory. To override, copy the desired template into the active theme or child theme under <code>templates/loginberry/</code> (see each template file header for the exact path).
<h4>Email delivery</h4>
Reliable outbound email is required for codes to arrive. Typical setups use the hosting provider’s mail relay, a transactional email API (for example Brevo, Mailchimp Transactional / Mandrill, Postmark, SendGrid, Amazon SES), or a WordPress plugin that sends mail via SMTP or a provider API. Test delivery with a real signup or code request before relying on the feature in production.
<h4>Typical use cases</h4>
<ul>
<li>Reducing unwanted or automated registrations and limiting abuse of disposable email addresses.</li>
<li>Verifying that a customer or member controls the email address on file.</li>
<li>Adding a second factor after password entry for selected roles.</li>
<li>Reviewing login success and failure history in the admin.</li>
<li>WooCommerce: applying optional post-order account activation, including a paid-order-only mode where configured.</li>
</ul>
<h4>Roadmap</h4>
LoginBerry is a brand new plugin and we are improving it quickly based on real user feedback. If you have ideas, feature requests, or run into a theme-specific styling issue, we would love to hear from you.
Planned work includes:
<ul>
<li>Configurable failed-attempt limits (instead of the fixed fifteen for activation lockout)</li>
<li>Track last login time for each user</li>
<li>Custom activation page URL</li>
<li>Custom redirect URL after successful verification</li>
<li>Rate limiting on code verification attempts</li>
<li>Social login options</li>
<li>Improved styling flexibility and theme compatibility</li>
</ul>
Feedback and compatibility reports are welcome via the plugin support channels. New features are prioritized based on user feedback.

LoginBerry – 2FA, Passwordless & Email Verification

Complete login security for WordPress & WooCommerce: LoginBerry adds email-based account verification, optional two-factor authentication (2FA), o …

Victor Flores

Wapu Auth is a free Google Social Login plugin for WordPress and WooCommerce. Let your visitors register and sign in using their Google account — no passwords, no forms, no friction.
Whether you run a WooCommerce store, a membership site, or any WordPress site, Wapu Auth makes authentication instant, secure, and completely free — including WooCommerce integration.
<blockquote>
Wapu Auth Pro is coming soon with additional social login providers, advanced analytics exports, and priority support.
</blockquote>
<h4>Free WooCommerce Social Login — No Pro Upgrade Required</h4>
Most social login plugins lock WooCommerce compatibility behind a paid plan. Wapu Auth includes free WooCommerce social login out of the box. The Google login button is automatically placed on your WooCommerce login page, registration page, and checkout form — zero configuration needed.
Store owners: let customers register and sign in at checkout with their Google account. Fewer abandoned carts. More completed purchases.
<h4>Features</h4>
Google Login — One Click 
Let visitors register and sign in with their Google account instantly. No passwords, no forms, no friction. Fast and invisible.
Google One Tap 
Show a non-intrusive sign-in prompt that authenticates users with a single click, without leaving the current page.
Magic Link — Passwordless Login 
Let customers sign in with a secure one-click link sent to their email. No password required. Links expire automatically for security.
Two-Factor Authentication (Email OTP) 
Add email verification codes to the sign-in flow. Enable globally for all users, require it for administrators only, or let customers opt in from their account page.
Active Sessions & Trusted Devices 
Customers can see every device signed in to their account and revoke sessions remotely. Trusted devices skip 2FA automatically for smoother return visits.
Unified Security Tab (WooCommerce My Account) 
Customers manage two-factor authentication, active sessions, trusted devices, and their Google connection from a single “Security” page in My Account.
Built-in SMTP Mailer 
Send magic links and OTP codes reliably using a custom SMTP server configured directly in the plugin settings — no third-party plugin required.
Free WooCommerce Login Integration 
Google login button automatically appears on all WooCommerce forms: login, register, and checkout. Free. No Pro plan required.
Smart Redirect Post-Login 
After signing in on the cart or checkout page, customers return to that page — not to My Account.
Analytics Dashboard 
Track every Google login attempt, new registration, and user activity from your WordPress admin panel.
Domain Restrictions 
Whitelist or blacklist email domains for your Google social login. Only @yourcompany.com users can sign in? Done.
Sandbox Mode 
Test the complete Google OAuth login flow with specific test emails before going live. No risk to production data.
Customizable Google Login Button 
Match the login button to your brand. Adjust colors, text, size, and style with a live visual editor — no CSS required.
Popup Mode 
Display the Google login prompt in a popup window for a seamless, redirect-free experience.
Activity Log 
Full log of every login attempt: status, email, timestamp, and optional GeoIP location data.
Shortcode Support 
Place the Google login button anywhere on your site: 
 [wapu_auth_button] — Google login button 
 [wapu_auth_login_form] — Full custom login form with Google login 
 [wapu_auth_register_form] — Full custom registration form with Google login
Custom Login & Registration Form Templates 
Replace the default WordPress login and register pages with three built-in templates: Classic, Modern, and Compact. All include the Google login button.
Setup Wizard 
Step-by-step guided setup walks you through creating Google OAuth credentials and configuring the plugin in under 5 minutes.
Full Internationalization 
Fully translated into English and Spanish. Ready for community translation via translate.wordpress.org.
<h4>Who Uses Wapu Auth?</h4>
WooCommerce store owners looking to reduce cart abandonment by adding Google login to the checkout page — free, without a Pro plan.
Membership site owners who want fast, trusted social login and registration using Google accounts.
WordPress developers and agencies who need a clean, standards-compliant Google OAuth plugin for client sites.
Users switching from Nextend Social Login who need free WooCommerce social login integration without paying for a Pro addon.
<h4>How Google Social Login Works</h4>
<ol>
<li>Visitor clicks the Google login button on your site</li>
<li>Google authenticates the user via secure OAuth 2.0</li>
<li>Wapu Auth creates or matches their WordPress account by email</li>
<li>User is logged in — done. The whole process takes under 3 seconds.</li>
</ol>
Existing users who already have a WordPress account with the same Google email address are automatically matched and logged in — no duplicate accounts, no confusion.
<h4>Privacy & Compliance</h4>
Wapu Auth connects to Google’s OAuth API only when a user actively clicks the Google login button. GeoIP enrichment and Google Analytics integration are optional and disabled by default. Site owners are responsible for appropriate consent mechanisms for their jurisdiction (GDPR, CCPA, etc.).
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 8.0 or higher</li>
<li>SSL certificate (HTTPS) — required by Google OAuth</li>
<li>Free Google Cloud Console account — to generate OAuth credentials</li>
<li>WooCommerce 7.0 or higher (optional, for automatic WooCommerce social login integration)</li>
</ul>
<h3>Hooks & Filters</h3>
Wapu Auth exposes the following WordPress action and filter hooks so developers can extend the authentication flow without modifying plugin files.
<h4>Actions</h4>
<ul>
<li><code>wapu_auth_before_login</code> — Fires right before a user is authenticated by Wapu Auth.</li>
<li><code>wapu_auth_user_authenticated</code> — Fires after a WordPress user is logged in via Google. Passes <code>$user</code> (WP_User), <code>$google_user</code> (array), and <code>$is_new_user</code> (bool).</li>
<li><code>wapu_auth_user_created</code> — Fires after a new WordPress user is created from a Google account. Passes <code>$user_id</code>, <code>$email</code>, and <code>$google_id</code>.</li>
<li><code>wapu_auth_google_account_unlinked</code> — Fires when a user disconnects their Google account from My Account. Passes <code>$user_id</code>.</li>
<li><code>wapu_auth_analytics_event</code> — Fires when an analytics event is recorded. Passes <code>$event_type</code>, <code>$user_id</code>, and <code>$data</code>.</li>
<li><code>wapu_auth_log</code> — Fires on every plugin log entry. Passes <code>$message</code>, <code>$level</code>, and <code>$context</code>. Useful for routing logs to a custom handler.</li>
<li><code>wp_login</code> — The standard WordPress action fires on every successful Google login so security and 2FA plugins receive Google logins uniformly.</li>
</ul>
<h4>Filters</h4>
<ul>
<li><code>wapu_auth_auth_params</code> — Modify the query parameters sent to Google’s OAuth authorization endpoint (scope, prompt, hd, etc.).</li>
<li><code>wapu_auth_user_data</code> — Modify the user data array returned by Google before Wapu Auth creates or matches an account.</li>
<li><code>wapu_auth_redirect_url</code> — Override the URL users are redirected to after a successful login. Passes <code>$url</code>, <code>$user</code>, and <code>$is_new_user</code>.</li>
<li><code>wapu_auth_error_message</code> — Customize the error message shown to the user when authentication fails. Passes <code>$message</code> and <code>$code</code>.</li>
<li><code>wapu_auth_button_html</code> — Modify the rendered login button HTML. Passes <code>$html</code>, <code>$args</code>, and <code>$settings</code>.</li>
<li><code>wapu_auth_redirect_uri</code> — Override the OAuth callback redirect URI registered with Google. Passes the current URI string.</li>
<li><code>wapu_auth_geoip_enabled</code> — Enable or disable GeoIP lookup programmatically. Passes the current boolean value.</li>
</ul>
<h3>External Services</h3>
This plugin connects to the following external services only under clearly documented conditions.
<h4>1. Google OAuth 2.0 / OpenID Connect (required for Google social login)</h4>
Endpoints: 
* <code>https://accounts.google.com/o/oauth2/v2/auth</code> 
* <code>https://oauth2.googleapis.com/token</code> 
* <code>https://www.googleapis.com/oauth2/v2/userinfo</code> 
* <code>https://accounts.google.com/.well-known/openid-configuration</code> (admin diagnostics only)
Data sent: Client ID, redirect URI, OAuth scope, state token, and authorization code. An access token is sent to retrieve the user’s Google profile.
Data received: Google account ID, email address, display name, profile picture URL, email verification status, and locale.
When triggered: Only when a user actively clicks the Google login button, or when an admin runs connection diagnostics from the settings page.
Google’s policies: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a> | <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a>
<h4>2. GeoIP Providers (optional — disabled by default)</h4>
Services: <code>https://ipapi.co/</code> with <code>https://ipwho.is/</code> as fallback.
Data sent: Visitor IP address for location lookup.
When triggered: Only when GeoIP enrichment is enabled in the plugin’s security settings.
Note: Enable only with appropriate legal basis and user consent where required (e.g. GDPR).
Policies: <a href="https://ipapi.co/privacy/" rel="nofollow ugc">ipapi.co</a> | <a href="https://ipwhois.io/privacy-policy/" rel="nofollow ugc">ipwhois</a>
<h4>3. Google Analytics 4 Event Bridge (optional — disabled by default)</h4>
Service: Uses the site’s existing gtag / GA4 setup, if present.
Data sent: Social login event names and metadata only (login_start, success/error status).
When triggered: Only when a GA4 Measurement ID is configured and analytics is enabled in plugin settings.
Note: Site owners are responsible for obtaining required user consent before enabling this feature.
<h4>4. Google Fonts (optional frontend asset)</h4>
Services: <code>https://fonts.googleapis.com</code> | <code>https://fonts.gstatic.com</code>
Data sent: Standard browser request headers (IP, user-agent) to retrieve font CSS.
When triggered: When the social login button is rendered on the frontend.
Google’s policies: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>

Wapu Auth – Google Social Login for WordPress & WooCommerce

Google social login for WordPress & WooCommerce. One-click sign-in, passwordless magic links, email two-factor authentication, session management, …

LoginBerry – 2FA, Passwordless & Email Verification vs Wapu Auth – Google Social Login for WordPress & WooCommerce