Naimur Rahman Nahid

<p><strong>Naimur Email OTP Verification for WooCommerce</strong> verifies customer email ownership using a One Time Password (OTP) before account creation. Optional Google reCAPTCHA, email logs, activity tracking, and a responsive OTP modal are included.</p>
<p>This plugin verifies users through a unique OTP sent to their email during:<br />
– Login<br />
– Registration</p>
<h3>Documentation</h3>
<p>Full documentation for setup, usage, and customization is available here:<br />
👉 <strong>https://naimurrahmannahid.com/naimur-otp-plugin/</strong></p>
<h3>Video Tutorial</h3>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/AehMWNLxkVk?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h3>🔥 Key Features</h3>
<ul>
<li>Email-Based OTP Verification  </li>
<li>Instant OTP Delivery  </li>
<li>OTP for Login, Register & Checkout  </li>
<li>Smart OTP Input UI  </li>
<li>Custom Email Templates  </li>
<li>Secure & Anti-Spam Protection  </li>
</ul>
<h3>Additional Features</h3>
<ul>
<li>OTP expiry control  </li>
<li>Resend button with countdown  </li>
<li>AJAX-based OTP submit  </li>
<li>Google reCAPTCHA v2  </li>
<li>Custom error/success messages  </li>
<li>Translation-ready  </li>
<li>Developer-friendly hooks</li>
</ul>
<h3>External services</h3>
<p>This plugin can optionally integrate with Google reCAPTCHA to protect the WooCommerce login and registration forms from automated abuse and spam.</p>
<p>When reCAPTCHA is enabled in the plugin settings and you configure a site key and secret key, the following data is sent to Google:</p>
<ul>
<li>The reCAPTCHA response token generated in the browser</li>
<li>The IP address of the user</li>
<li>Additional browser and usage information collected by the reCAPTCHA widget</li>
</ul>
<p>This data is sent when the WooCommerce login or registration form is submitted in order to verify that the request is made by a human user.</p>
<p>Service provider:<br />
* Google reCAPTCHA – provided by Google LLC<br />
* Terms of Service: https://www.google.com/recaptcha/terms<br />
* Privacy Policy: https://policies.google.com/privacy</p>
<h3>Source code</h3>
<p>The JavaScript file <code>assets/js/main.js</code> is a compiled/optimized build used in production.</p>
<p>A human-readable source version of this script is bundled with the plugin under:</p>
<ul>
<li><code>assets/src/js/main.js</code></li>
</ul>
<p>This file contains the original source code that can be viewed, studied and modified by developers.</p>


Naimur Email OTP Verification for WooCommerce

Short Description: Verify WooCommerce customer email addresses with a 6-digit OTP before account creation for secure and spam-free registrations.

rishav001

<p>Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.</p>
<p>Features include:</p>
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
<p>Security highlights:</p>
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
<p>Security limitations:</p>
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
<p>Reliability notes:</p>
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
<p>This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.</p>
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>


Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

Naimur Email OTP Verification for WooCommerce vs Rishav AuthNova OTP