oaron

OneCode Login provides a modern, passwordless authentication experience for your WordPress site. Instead of traditional passwords, users receive a secure 6-digit verification code via email.
<h4>Key Features</h4>
<ul>
<li>Passwordless Authentication – Users log in with just their email address</li>
<li>6-Digit Verification Codes – Secure, time-limited codes sent via email</li>
<li>Rate Limiting – Built-in protection against brute force attacks</li>
<li>Request ID Binding – Each code is bound to a specific login session for enhanced security</li>
<li>Neutral Feedback – Prevents user enumeration attacks by not revealing if an email exists</li>
<li>Customizable – Configure expiry times, cooldowns, and email templates</li>
<li>Accessible – Full keyboard navigation and screen reader support</li>
<li>Gutenberg Block – Easy to add login forms to any page</li>
<li>Shortcode Support – Use [onecode_login] anywhere</li>
<li>wp-login.php Integration – Optionally replace the default WordPress login</li>
<li>Developer API – Other plugins can use OneCode Login as an email one-time-code (OTP) service to verify a visitor’s email — see the Developer information section</li>
</ul>
<h4>Security Features</h4>
<ul>
<li>Cryptographically secure code generation</li>
<li>Codes and magic-link tokens are stored HMAC-hashed, never in plain text</li>
<li>Configurable code expiry (default: 10 minutes)</li>
<li>Resend cooldown to prevent spam</li>
<li>IP-based and email-based rate limiting</li>
<li>Automatic lockout after failed attempts</li>
<li>Codes are single-use and invalidated after successful login</li>
</ul>
<h4>Use Cases</h4>
<ul>
<li>Membership sites where password fatigue is an issue</li>
<li>Customer portals requiring simple authentication</li>
<li>Internal tools where security without complexity is needed</li>
<li>Any site wanting to improve user experience</li>
</ul>
<h3>Developer information</h3>
Other plugins on the same site can use OneCode Login as a generic email 
one-time-code (OTP) service — for example to verify a guest’s email before 
letting them act. OneCode emails the code and verifies it; your plugin keeps 
full control of its own login/session (OneCode only asserts that the code is 
valid for the email — it never logs anyone in). It works for any email 
address; the address does not need a WordPress account.
All entry points are plain functions (and matching filters), so you do not need 
a hard dependency on any class. The API is gated by the Settings → Advanced → 
Enable developer API toggle.
Detect support (side-effect free — never call the request hook just to probe):
<pre><code>if ( function_exists( 'onecode_login_request_otp' ) && onecode_login_supports( 'otp' ) ) { ... }
</code></pre>
<ol>
<li>
Start authentication — email a code and receive a handle:
$handle = onecode_login_request_otp( $email, array( ‘consumer’ => ‘my_plugin’ ) ); 
// $handle = array( ‘request_id’, ‘auth_secret’, ‘expires_in’ (seconds), ‘expires_at’ (UTC), ‘sent’ ) 
// On failure: a WP_Error (codes: disabled, invalid_request, rate_limited, cooldown).
</li>
</ol>
Keep <code>request_id</code> and <code>auth_secret</code> server-side (e.g. in a transient tied to the 
visitor). The <code>auth_secret</code> is NEVER shown to the customer — it is what stops an 
outsider who only knows the email from completing verification by guessing codes.
<ol>
<li>
Complete authentication — the customer gives your plugin the code from the email:
$result = onecode_login_verify_otp( array( 
 ’email’ => $email, 
 ‘request_id’ => $handle[‘request_id’], 
 ‘code’ => $code_from_customer, 
 ‘auth_secret’ => $handle[‘auth_secret’], 
 ‘consumer’ => ‘my_plugin’, 
) ); 
// Success: array( ‘valid’ => true, ’email’ => … ). Failure: WP_Error.
</li>
</ol>
On failure show a generic message to the user (the API intentionally returns a 
single <code>verify_failed</code> code so it can’t be used as an oracle).
Filters are also available for loose coupling: <code>onecode_login_request_otp</code> 
(<code>$pre, $email, $args</code>) and <code>onecode_login_verify_otp</code> (<code>$pre, $args</code>).
Discovery and capabilities:
<ul>
<li><code>onecode_login_supports( $feature )</code> — returns true for <code>'otp'</code>, 
 ‘identity_assertion’ and <code>'any_email'</code>.</li>
<li><code>onecode_login_api()</code> — returns the <code>OneCode_Login_API</code> service instance.</li>
<li><code>OneCode_Login_API::VERSION</code> — the API contract version (independent of the 
plugin version), so you can feature-gate against the API surface.</li>
<li><code>do_action( 'onecode_login_api_init', $api )</code> — fires once the API is ready; 
bind to it if you want to wire up as soon as OneCode Login loads.</li>
</ul>
Reference: <code>$args['consumer']</code> (a short <code>[a-z0-9_-]</code> label identifying your 
integration) is required on both calls — it isolates your codes and rate limits 
from the built-in login and from other consumers. Both request and verify are 
rate-limited by OneCode, returning <code>rate_limited</code> / <code>cooldown</code> WP_Errors you can 
surface to the user.

OneCode Login

Simple and secure passwordless login using email verification codes. No passwords to remember, just enter your email and verify with a 6-digit code.

trusona

Trusona provides the most popular passwordless 2FA login for FREE. Just point your phone to the secure QR code and voila – you are in.
<h4>Top Features</h4>
<ul>
<li>FREE passwordless MFA including support</li>
<li>Hide username and password from login form</li>
<li>Login without typing or remembering passwords</li>
<li>NEW: Trusona ONLY Mode – get rid of the password fields FOREVER!</li>
<li>Dynamic QR code displayed at login</li>
<li>No SMS or OTP (one-time passwords)</li>
<li>Patented anti-replay for added security</li>
<li>One-click installation</li>
</ul>
<h4>What is the Cost?</h4>
Trusona’s passwordless 2FA is completely FREE – just download it today and start using it with one-click install. Support is included. We really mean it – it is totally FREE.
<h4>How do I know it is secure?</h4>
73% of WordPress sites are vulnerable to attack – and passwords are most likely to blame. Trusona’s passwordless 2FA for WordPress is based on the most secure technology you will ever use. And now you can experience this level of true security for your WordPress accounts, too. In this version we added a Trusona ONLY mode in settings. This feature does not allow to show the user name and password fields. Setting this page to this mode is the most secure approach. Only recommended to advanced users.
<h4>Please note:</h4>
Once you download the Trusona WordPress Plugin you need to download the Trusona app. To download for iOS, visit the <a href="https://itunes.apple.com/us/app/trusona/id1052983449" rel="nofollow ugc">App Store</a>. For Android devices, visit <a href="//play.google.com/store/apps/details?id=com.trusona.trusona" rel="nofollow ugc">Google Play</a>.

Trusona for WordPress

Watched an interview with Frank Abagnale who mentioned this company. Did a bit of googling and noticed they had a plugin which I installed immediately.  What can I say, works seamlessly and I love it!  Will be rolling this out to all my sites.

Frank Abagnale Approves

Passwordless 2FA for your WordPress admin account with one-click install.  Trusona's FREE passwordless plug-in prevents unauthorized logins, defa …

OneCode Login vs Trusona for WordPress