BerryPress

<p>LoginBerry bundles <strong>account verification</strong>, <strong>two-factor authentication (2FA)</strong>, <strong>passwordless login</strong>, and <strong>login logs</strong>. Each feature can be enabled or disabled independently. Outgoing codes are delivered by <strong>email</strong>.</p>
<p>The plugin works for standard WordPress sites. When WooCommerce is active, additional customer- and order-related options are available (for example 2FA on the My Account login form and optional account activation tied to orders).</p>
<h4>User-facing behavior (when features are enabled)</h4>
<ul>
<li><strong>Account verification:</strong> After registration, the user signs in and completes activation on the configured activation page using a six-digit code sent by email.</li>
<li><strong>Two-factor authentication:</strong> After a successful username and password, the user enters a second code sent by email. Per-role modes are Required, Optional, or Disabled.</li>
<li><strong>Passwordless login:</strong> On <code>wp-login.php</code>, eligible roles may request a one-time email code instead of entering a password.</li>
<li><strong>Login logs:</strong> Success and failure records are listed in the WordPress admin.</li>
</ul>
<p>Authentication codes are email-based; end users do not install a separate authenticator app for the flows described here.</p>
<h4>Account verification</h4>
<ul>
<li>New accounts receive a six-digit activation code by email.</li>
<li>After fifteen failed activation attempts, the account is locked until an administrator intervenes.</li>
<li>Administrators can resend codes, activate accounts manually, and unlock accounts from <strong>Users <span aria-hidden="true" class="wp-exclude-emoji">→</span> All Users</strong>.</li>
</ul>
<h4>Two-factor authentication (2FA)</h4>
<ul>
<li>Per-role setting: Required, Optional, or Disabled.</li>
<li>Optional mode allows users to enable 2FA from the profile when permitted by role.</li>
<li>Supported on <code>wp-login.php</code> and on the WooCommerce <strong>My Account</strong> login form.</li>
</ul>
<h4>Passwordless login</h4>
<p>Let users log in without a password – just enter a username or email and receive a one-time login code. Improves user experience while maintaining strong security through email verification.</p>
<ul>
<li>Toggle between password and passwordless login on wp-login.php</li>
<li>One-time email codes on <code>wp-login.php</code>, controlled per role.</li>
<li>When both passwordless login and 2FA are enabled for the same role, the passwordless flow does not require a separate 2FA step (email possession is already verified).</li>
</ul>
<h4>WooCommerce</h4>
<ul>
<li>Optional automatic account activation when an WooCommerce order is created.</li>
<li>Optional restriction so that only <strong>paid</strong> orders trigger activation.</li>
<li>Integration points include classic checkout, block checkout (Store API), and paid-order completion hooks, as implemented in the plugin.</li>
</ul>
<h4>Login logs</h4>
<p>Monitor all login activity on your site. Essential for detecting suspicious behavior and meeting security compliance requirements for e-commerce stores.</p>
<ul>
<li>Records successful and failed login attempts</li>
<li>Logs username, email, IP address, and timestamp</li>
<li>View all logs in a dedicated admin page with sortable columns</li>
<li>Identify patterns of brute force attacks and suspicious login activity</li>
<li>Audit trail for security compliance and fraud investigation</li>
</ul>
<h4>Admin interface</h4>
<ul>
<li>Centralized settings under <strong>BerryPress <span aria-hidden="true" class="wp-exclude-emoji">→</span> LoginBerry</strong>, with separate screens per feature.</li>
</ul>
<h4>Email templates</h4>
<p>HTML email templates for activation, 2FA, and passwordless login ship in the plugin <code>templates/</code> directory. To override, copy the desired template into the active theme or child theme under <code>templates/loginberry/</code> (see each template file header for the exact path).</p>
<h4>Email delivery</h4>
<p>Reliable outbound email is required for codes to arrive. Typical setups use the hosting provider’s mail relay, a transactional email API (for example Brevo, Mailchimp Transactional / Mandrill, Postmark, SendGrid, Amazon SES), or a WordPress plugin that sends mail via SMTP or a provider API. Test delivery with a real signup or code request before relying on the feature in production.</p>
<h4>Typical use cases</h4>
<ul>
<li>Reducing unwanted or automated registrations and limiting abuse of disposable email addresses.</li>
<li>Verifying that a customer or member controls the email address on file.</li>
<li>Adding a second factor after password entry for selected roles.</li>
<li>Reviewing login success and failure history in the admin.</li>
<li>WooCommerce: applying optional post-order account activation, including a paid-order-only mode where configured.</li>
</ul>
<h4>Roadmap</h4>
<p>LoginBerry is a brand new plugin and we are improving it quickly based on real user feedback. If you have ideas, feature requests, or run into a theme-specific styling issue, we would love to hear from you.</p>
<p>Planned work includes:</p>
<ul>
<li>Configurable failed-attempt limits (instead of the fixed fifteen for activation lockout)</li>
<li>Track last login time for each user</li>
<li>Custom activation page URL</li>
<li>Custom redirect URL after successful verification</li>
<li>Rate limiting on code verification attempts</li>
<li>Social login options</li>
<li>Improved styling flexibility and theme compatibility</li>
</ul>
<p>Feedback and compatibility reports are welcome via the plugin support channels. New features are prioritized based on user feedback.</p>


LoginBerry – 2FA, Passwordless & Email Verification

Complete login security for WordPress & WooCommerce: LoginBerry adds email-based account verification, optional two-factor authentication (2FA), o …

Sunil Kumar Sharma

xpertzmate

The Better India

<p>WP One Tap Google Sign In adds Google One Tap authentication to WordPress. It helps site owners offer a faster, passwordless login experience while keeping authentication tied to existing WordPress user accounts.</p>
<p>When a visitor signs in with Google, the plugin verifies the Google ID token server-side, checks the configured OAuth client ID, confirms the Google email is verified, and then signs in the matching WordPress user. The plugin also supports site-wide display for logged-out visitors, a customizable companion message block, and direct Google account linking from WordPress user profiles.</p>
<h4>Key Features</h4>
<ul>
<li>Google One Tap prompt on the WordPress login screen.</li>
<li>Optional site-wide One Tap prompt for logged-out visitors.</li>
<li>Server-side Google ID token verification with WordPress HTTP APIs.</li>
<li>Existing-user login only by default.</li>
<li>Google account linking and disconnect controls on WordPress user profiles.</li>
<li>Automatic account-link migration after a successful verified email login.</li>
<li>Admin activity log for successful logins, failed attempts, account linking, and unlinking events.</li>
<li>Salted hashes for IP addresses and Google account identifiers in the activity log.</li>
<li>Optional custom message block with image, title, and formatted content.</li>
<li>WordPress 7.0-ready metadata with PHP 8.1, 8.2, and 8.3 compatibility.</li>
</ul>
<h4>Security Approach</h4>
<p>The plugin uses WordPress nonces for AJAX requests, sanitizes all incoming data, escapes admin output, and validates the Google token audience against the configured OAuth client ID. It does not create new users automatically. A Google login succeeds only when the verified Google account maps to an existing WordPress user.</p>
<h4>Privacy</h4>
<p>The activity log stores the Google email address used during an event, the WordPress user ID when available, event status, event reason, user agent, and salted hashes of the request IP address and Google account identifier. Activity records older than 90 days are pruned automatically when new events are logged.</p>
<h3>Configuration</h3>
<h4>Create a Google OAuth Client ID</h4>
<ol>
<li>Open the Google Cloud Console credentials page:<br />
https://console.developers.google.com/apis/credentials</li>
<li>Create an OAuth 2.0 Client ID.</li>
<li>Choose Web application as the application type.</li>
<li>Add your WordPress site’s authorized JavaScript origin.</li>
<li>Copy the client ID into Settings > One Tap GSI.</li>
</ol>
<h4>Link a WordPress User to Google</h4>
<ol>
<li>Open Users > Profile for your own account, or edit another user if your role allows it.</li>
<li>Find the Google One Tap Sign-In section.</li>
<li>Use the Google button to link a verified Google account.</li>
<li>To disconnect, check Disconnect this Google account and save the profile.</li>
</ol>
<h4>Customize the Message Block</h4>
<ol>
<li>Go to Settings > One Tap GSI.</li>
<li>Enable the custom message block.</li>
<li>Choose an image from the Media Library or enter an image URL.</li>
<li>Add a short title and supporting formatted content.</li>
<li>Save the settings.</li>
</ol>


WP One Tap Google Sign In

Secure Google One Tap sign-in for WordPress login pages, with account linking and admin activity logs.

LoginBerry – 2FA, Passwordless & Email Verification vs WP One Tap Google Sign In