oaron

<p>OneCode Login provides a modern, passwordless authentication experience for your WordPress site. Instead of traditional passwords, users receive a secure 6-digit verification code via email.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Passwordless Authentication</strong> – Users log in with just their email address</li>
<li><strong>6-Digit Verification Codes</strong> – Secure, time-limited codes sent via email</li>
<li><strong>Rate Limiting</strong> – Built-in protection against brute force attacks</li>
<li><strong>Request ID Binding</strong> – Each code is bound to a specific login session for enhanced security</li>
<li><strong>Neutral Feedback</strong> – Prevents user enumeration attacks by not revealing if an email exists</li>
<li><strong>Customizable</strong> – Configure expiry times, cooldowns, and email templates</li>
<li><strong>Accessible</strong> – Full keyboard navigation and screen reader support</li>
<li><strong>Gutenberg Block</strong> – Easy to add login forms to any page</li>
<li><strong>Shortcode Support</strong> – Use [onecode_login] anywhere</li>
<li><strong>wp-login.php Integration</strong> – Optionally replace the default WordPress login</li>
<li><strong>Developer API</strong> – Other plugins can use OneCode Login as an email one-time-code (OTP) service to verify a visitor’s email — see the <em>Developer information</em> section</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Cryptographically secure code generation</li>
<li>Codes and magic-link tokens are stored HMAC-hashed, never in plain text</li>
<li>Configurable code expiry (default: 10 minutes)</li>
<li>Resend cooldown to prevent spam</li>
<li>IP-based and email-based rate limiting</li>
<li>Automatic lockout after failed attempts</li>
<li>Codes are single-use and invalidated after successful login</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Membership sites where password fatigue is an issue</li>
<li>Customer portals requiring simple authentication</li>
<li>Internal tools where security without complexity is needed</li>
<li>Any site wanting to improve user experience</li>
</ul>
<h3>Developer information</h3>
<p>Other plugins on the same site can use OneCode Login as a generic email<br />
one-time-code (OTP) service — for example to verify a guest’s email before<br />
letting them act. OneCode emails the code and verifies it; your plugin keeps<br />
full control of its own login/session (OneCode only asserts that the code is<br />
valid for the email — it never logs anyone in). It works for <strong>any</strong> email<br />
address; the address does not need a WordPress account.</p>
<p>All entry points are plain functions (and matching filters), so you do not need<br />
a hard dependency on any class. The API is gated by the <em>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Advanced <span aria-hidden="true" class="wp-exclude-emoji">→</span><br />
Enable developer API</em> toggle.</p>
<p>Detect support (side-effect free — never call the request hook just to probe):</p>
<pre><code>if ( function_exists( 'onecode_login_request_otp' ) && onecode_login_supports( 'otp' ) ) { ... }
</code></pre>
<ol>
<li>
<p>Start authentication — email a code and receive a handle:</p>
<p>$handle = onecode_login_request_otp( $email, array( ‘consumer’ => ‘my_plugin’ ) );<br />
// $handle = array( ‘request_id’, ‘auth_secret’, ‘expires_in’ (seconds), ‘expires_at’ (UTC), ‘sent’ )<br />
// On failure: a WP_Error (codes: disabled, invalid_request, rate_limited, cooldown).</p>
</li>
</ol>
<p>Keep <code>request_id</code> and <code>auth_secret</code> server-side (e.g. in a transient tied to the<br />
visitor). The <code>auth_secret</code> is NEVER shown to the customer — it is what stops an<br />
outsider who only knows the email from completing verification by guessing codes.</p>
<ol>
<li>
<p>Complete authentication — the customer gives your plugin the code from the email:</p>
<p>$result = onecode_login_verify_otp( array(<br />
    ’email’       => $email,<br />
    ‘request_id’  => $handle[‘request_id’],<br />
    ‘code’        => $code_from_customer,<br />
    ‘auth_secret’ => $handle[‘auth_secret’],<br />
    ‘consumer’    => ‘my_plugin’,<br />
) );<br />
// Success: array( ‘valid’ => true, ’email’ => … ). Failure: WP_Error.</p>
</li>
</ol>
<p>On failure show a generic message to the user (the API intentionally returns a<br />
single <code>verify_failed</code> code so it can’t be used as an oracle).</p>
<p>Filters are also available for loose coupling: <code>onecode_login_request_otp</code><br />
(<code>$pre, $email, $args</code>) and <code>onecode_login_verify_otp</code> (<code>$pre, $args</code>).</p>
<p>Discovery and capabilities:</p>
<ul>
<li><code>onecode_login_supports( $feature )</code> — returns true for <code>'otp'</code>,<br />
  ‘identity_assertion’ and <code>'any_email'</code>.</li>
<li><code>onecode_login_api()</code> — returns the <code>OneCode_Login_API</code> service instance.</li>
<li><code>OneCode_Login_API::VERSION</code> — the API contract version (independent of the<br />
plugin version), so you can feature-gate against the API surface.</li>
<li><code>do_action( 'onecode_login_api_init', $api )</code> — fires once the API is ready;<br />
bind to it if you want to wire up as soon as OneCode Login loads.</li>
</ul>
<p>Reference: <code>$args['consumer']</code> (a short <code>[a-z0-9_-]</code> label identifying your<br />
integration) is required on both calls — it isolates your codes and rate limits<br />
from the built-in login and from other consumers. Both request and verify are<br />
rate-limited by OneCode, returning <code>rate_limited</code> / <code>cooldown</code> WP_Errors you can<br />
surface to the user.</p>


OneCode Login

Simple and secure passwordless login using email verification codes. No passwords to remember, just enter your email and verify with a 6-digit code.

Marco Gargano

<p>Protect pages and posts with email-delivered verification codes. Secure, passwordless access control with user management and customization.</p>
<h3>✅ Features</h3>
<p>One Time Email Access Guard <strong>protects your WordPress pages and posts</strong> using email-delivered verification codes. Each authorized user receives a time-limited code, allowing secure access without traditional passwords.</p>
<ul>
<li><strong>Email-Based Verification</strong>: Send secure verification codes via email</li>
<li><strong>User Management</strong>: Create and manage authorized users with contact details</li>
<li><strong>Content Protection</strong>: Enable protection per page/post with user assignment</li>
<li><strong>Customizable Access</strong>: Set custom access duration and expiration dates</li>
<li><strong>Modal Customization</strong>: Customize colors, opacity, and appearance</li>
<li><strong>Protected Content Tracking</strong>: Monitor all protected pages and authorized users</li>
<li><strong>Secure Cookies</strong>: Maintain login sessions with secure access tokens</li>
</ul>
<p><strong><a href="https://access-guard.github.io/" rel="nofollow ugc">👉👉👉 Visit the official page 👈👈👈</a></strong></p>
<h3>😌 Easy to use</h3>
<ol>
<li><strong>Create user</strong> under Access Guard</li>
<li><strong>Activate user</strong> in the page/post page</li>
</ol>
<p><span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/XE4d496uPUc?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></p>
<h3>🛡️ Secure</h3>
<p><strong>🪜 Up to 3 security levels available</strong></p>
<p>Configurable in settings:<br />
1️⃣ <strong>Phone number</strong> – Required ✦✧✧<br />
Two-factor authentication: enter your phone number to receive a code by email<br />
2️⃣ <strong>First name</strong> – Optional ✦✦✧<br />
Three-factor authentication: phone number + first namenome<br />
3️⃣ <strong>Last name</strong> – Optional ✦✦✦<br />
Multi-factor authentication: phone number + first name + last name</p>
<h3>🧰 All Features</h3>
<h4>🔐 Advanced Security</h4>
<ul>
<li>Passwordless access via email verification codes</li>
<li>Email based One Time Password (OTP) access</li>
<li>User verification with name and phone number</li>
<li>Verification codes expire after 15 minutes</li>
<li>Secure access tokens via cookies</li>
<li>International phone support (195+ countries)</li>
</ul>
<h4>🎨 Fully Customizable</h4>
<ul>
<li>Custom modal colors (overlay, background, text)</li>
<li>Adjustable opacity and shadow</li>
<li>Custom titles and messages</li>
<li>Professional HTML email templates</li>
</ul>
<h4>👥 User Management</h4>
<ul>
<li>Create users with name, email, and phone</li>
<li>Enable/disable users instantly with toggle switch</li>
<li>Custom access duration (15 min to unlimited)</li>
<li>Optional expiration date and time</li>
<li>User status indicator with visual feedback</li>
<li>Bulk operations (activate/deactivate all users)</li>
<li>Bulk expiry date setting</li>
<li>CSV import/export for user data</li>
</ul>
<h4>🔒 Content Protection</h4>
<ul>
<li>Enable protection per page/post</li>
<li>Assign authorized users with multi-select</li>
<li>Protection status column in admin</li>
<li>Real-time user status display (active/expired)</li>
<li>Quick edit access from protected pages list</li>
</ul>
<h4>📊 Monitoring</h4>
<ul>
<li>View all protected pages/posts</li>
<li>See authorized users</li>
<li>Direct quick-edit access</li>
</ul>
<h4>⚙️ Flexible Configuration</h4>
<ul>
<li>Optional first name and last name fields</li>
<li>Custom blocked-content messages</li>
<li>Modal color customization (overlay, background, text)</li>
<li>Adjustable overlay opacity</li>
<li>Toggle modal shadow effects</li>
<li>Reset all settings to default</li>
</ul>


One Time Email Access Guard

Protect pages and posts with email-delivered verification codes. Secure, passwordless access control with user management and customization.

OneCode Login vs One Time Email Access Guard