Alexandre Froger

Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.
<h3>Overview</h3>
This plugin adds the following major features to WordPress:
<ul>
<li>3 One-Time Password modes: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li>3 Authentication Gateways for OTP Verification Codes: WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li>Two-Factor Authentication: allow (or force) users to authenticate with a second factor on top of their password.</li>
<li>Passwordless Authentication: allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li>Account Validation: force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li>Synchronize OTP identifiers with existing data: wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li>Simple yet customizable appearance: forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li>Activity Logs: when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li>Customizable for developers: developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li>Integration-friendly: specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li>Unlimited features: there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.
Each bug report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.
Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.
Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum.
<h3>Integrations</h3>
Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.
Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).
If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.
All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception. 
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.

OTP Authenticator

One-Time Password Authentication for WordPress

Huzaifa Al Mesbah

<a href="https://tastewp.org/plugins/smart-password-protect" rel="nofollow ugc">Live Demo</a> | <a href="https://wordpress.org/support/plugin/smart-password-protect/" rel="ugc">Support</a>
Smart Password Protect is the most powerful and versatile security plugin for WordPress. It combines robust site-wide password protection with a modern temporary login system, giving you complete control over who accesses your website.
Whether you are developing a site in a staging environment, putting your site in maintenance mode, or need to grant temporary admin access to a developer, Smart Password Protect has you covered.
We analyzed the top security plugins in the market and built a better, all-in-one solution. Stop installing multiple plugins for “Maintenance Mode”, “Password Protection”, and “Temporary Logins”. Get it all in one lightweight, high-performance package.
<h3>🔥 Key Features Overview</h3>
<h4>1. 🔐 Password Protect Entire Site (Maintenance Mode)</h4>
Lock your WordPress site instantly with a single password. This is perfect for staging sites, private portfolios, or maintenance mode.
<ul>
<li>One-Click Protection: Enable or disable protection instantly from the dashboard.</li>
<li>IP Whitelisting: Allow specific IP addresses (e.g., your office, home, or client) to bypass the password.</li>
<li>User Role Bypass: Allow Administrators or logged-in users to access the site without a password.</li>
<li>SEO Friendly: Automatically sends <code>noindex</code> headers to prevent Google from indexing your private/staging content.</li>
<li>Modern Password Form: A beautiful, responsive login page that looks great on all devices.</li>
<li>Remember Me: Users can choose to stay logged in for up to 7 days (configurable).</li>
<li>Customization: Easily customize the look and feel of the password page via CSS.</li>
</ul>
<h4>2. 🔗 Temporary Login Without Password (Magic Links)</h4>
Create secure, self-expiring login links to grant temporary admin access without sharing your real credentials.
<ul>
<li>Secure Developer Access: Give developers or support agents admin access safely.</li>
<li>Auto-Expiration: Set links to expire after 1 hour, 1 day, 7 days, or a custom date.</li>
<li>No Credentials Needed: Users log in simply by clicking the link. No username or password required.</li>
<li>Role Management: Assign any role (Admin, Editor, Subscriber) to the temporary user.</li>
<li>Redirect After Login: Automatically redirect users to a specific page (e.g., Settings, Home, or Custom URL).</li>
<li>Activity Logs: Track exactly when a temporary user logs in, their IP address, and browser.</li>
<li>Login Limits: Restrict the number of times a link can be used.</li>
<li>Self-Preservation: Temporary users cannot deactivate or delete the Smart Password Protect plugin itself.</li>
<li>Profile Lockdown: Temporary users are blocked from editing their profile or creating/deleting other users.</li>
</ul>
<h4>3. 🛡️ Advanced Security & Logs</h4>
Keep a close eye on who is accessing your site and ensure maximum security.
<ul>
<li>Detailed Audit Trail: View a history of every temporary login, including time, IP, and browser.</li>
<li>Bot Protection: Blocks search engine crawlers when protection is active.</li>
<li>Capability Controls: Restrict temporary admins from deleting plugins or themes.</li>
<li>Smart Validation: Automatically checks for token expiration and usage limits before allowing access.</li>
<li>Secure Session: Sets a secure, temporary cookie that expires automatically after 1 day.</li>
</ul>
<h3>⚡ Use Cases for Smart Password Protect</h3>
⚡ Use Case #1: Secure Staging & Development Environments 
Protect your client’s site while it’s under development. Use the “Password Protection” feature to keep the site hidden from the public and search engines (noindex) while allowing you and your client to view progress. This is the professional way to handle staging sites without complex server configurations.
⚡ Use Case #2: Grant Safe Temporary Access to Developers 
Need a developer to fix a bug? Don’t share your admin credentials. Instead, generate a “Temporary Login Link” with a specific role and expiration time. They get one-click access, and you get peace of mind knowing the access will auto-expire and they can’t delete your plugins.
⚡ Use Case #3: Maintenance Mode Made Simple 
Updating your site or making design changes? Instantly lock the entire site with a single password. You can whitelist your own IP address to keep working while visitors see a professional password page. It’s faster and easier than installing a dedicated maintenance mode plugin.
⚡ Use Case #4: Exclusive Client Portfolios 
Showcase your work privately. Password protect your portfolio site and share the password only with prospective clients. This ensures your creative work remains exclusive and confidential until you are ready to show it to the world.
⚡ Use Case #5: Internal Company Documentation 
Create a private hub for your team. Restrict access to internal tools, wikis, or resources. With “User Role Bypass”, your logged-in employees can access content seamlessly without entering a password every time, while outsiders remain blocked.
⚡ Use Case #6: Private Family & Personal Blogs 
Share personal stories and photos with only those you trust. Set a simple site-wide password so family and friends can view your content while keeping it safe from strangers and bots. It’s the perfect solution for keeping personal memories private.
<h3>🚀 Explore Smart Password Protect Features</h3>
✅ Complete Site Protection — 100% FREE
What it does: Instantly locks your entire WordPress site behind a secure password screen. Only visitors with the correct password can access your content. 
How to use: 
1. Navigate to Smart Password Protect > Password Protection. 
2. Toggle “Enable Password Protection” to On. 
3. Enter your desired password in the “Set Password” field. 
4. (Optional) Adjust “Remember Me” duration to control how long users stay logged in.
✅ Secure Temporary Login Links — No Credentials Needed
What it does: Generates a unique “Magic Link” that logs a user in automatically with a specific role and expiration time. Perfect for developers or support agents. 
How to use: 
1. Go to Smart Password Protect > Temporary Login. 
2. Select an expiration time (e.g., 7 Days). 
3. (Optional) Click “+ Show Advanced Options” to set a specific User Role or Login Limit. 
4. Click Generate Link and copy the URL.
✅ Passwordless Admin Access
What it does: Allows administrators to access the site without entering the protection password, saving time and hassle. 
How to use: 
1. Go to Smart Password Protect > Password Protection > Permissions. 
2. Toggle “Allow Administrators” to On. 
3. Now, if you are logged into WordPress as an admin, you will bypass the password screen automatically.
✅ Allow RSS Feeds
What it does: Ensures your RSS feeds remain accessible even when the site is password protected. 
How to use: 
1. Go to Smart Password Protect > Password Protection > Permissions. 
2. Toggle “Allow RSS Feeds” to On. 
3. Your RSS feeds (e.g., /feed) will now be publicly accessible without a password.
✅ Allow REST API
What it does: Allows external applications and mobile apps to access your site’s data via the WordPress REST API by bypassing the protection. 
How to use: 
1. Go to Smart Password Protect > Password Protection > Permissions. 
2. Toggle “Allow REST API” to On. 
3. Your site’s REST API endpoints (e.g., /wp-json) will now be accessible. 
 * Note: When disabled, API requests will return a <code>401 Unauthorized</code> error with the message “Password protection is enabled”.
✅ Smart IP Whitelisting
What it does: Grants instant access to specific IP addresses (like your home or office) so you don’t have to enter a password. 
How to use: 
1. Go to Smart Password Protect > Password Protection > IP Settings. 
2. Click Auto Fill Input to detect your current IP address. 
3. Click Add IP to whitelist it. You can add as many IPs as you need.
✅ Temporary Login Log
What it does: View history of temporary login usage and user actions. 
How to use: 
1. Go to Smart Password Protect > Temporary Login. 
2. Click on the Logs tab. 
3. View the list of all recent login attempts to ensure no unauthorized access has occurred.
✅ Auto-Cleanup : Expired Links and Temporary Login Log
What it does: Automatically deletes expired temporary login links and users from your database to keep your site clean and secure. 
How to use: 
1. Go to Smart Password Protect > Temporary Login > Settings. 
2. Find the Expired Links Auto-cleanup setting. 
3. Set the number of days (e.g., 30 days) after which expired logs and users will be permanently deleted.
<h3>🌟 What Makes Us Different?</h3>
<pre>
Feature | Smart Password Protect | Competitor A | Competitor B
------------------------|------------------------|--------------|-------------
Password Protection | ✅ | ✅ | ❌
Temporary Login | ✅ | ❌ | ✅
Activity Logs | ✅ | ❌ | ❌
IP Whitelisting | ✅ | ✅ | ❌
Modern UI (React) | ✅ | ❌ | ❌
</pre>
<h3>🔜 Roadmap & Upcoming Features</h3>
We are constantly working to improve Smart Password Protect. Here are some features coming in the next update:
<ul>
<li>Partial Content Protection: Lock specific parts of a post or page using shortcodes like <code>[protect]Content[/protect]</code>.</li>
<li>Granular Protection: Password protect individual Pages, Posts, and Categories.</li>
<li>WooCommerce Protection: Hide your shop or specific products from the public.</li>
<li>Password Styles: Customize the look and feel of the password login page with a visual editor.</li>
<li>Multiple Passwords: Set different passwords for different users or groups.</li>
<li>Email Notifications: Get notified when someone logs in via a temporary link.</li>
</ul>
<h3>⚡ Reasons Why You Should Opt for Smart Password Protect</h3>
⚡ Reason #1: Uncompromising Security & Control 
Upgrade your site’s defense mechanisms with ease. Smart Password Protect allows you to lock your entire website instantly with a single password, while offering granular controls like IP Whitelisting and User Role Bypass. Built with advanced encryption and “Self-Preservation” logic, it ensures that temporary users cannot disable the plugin or hijack your site, giving you total peace of mind.
⚡ Reason #2: Eliminate the Risk of Sharing Credentials 
Never share your admin username and password again. With our Temporary Login (Magic Links) feature, you can generate secure, self-expiring access links for developers or support agents. These links use cryptographically secure tokens and allow one-click access without requiring any credentials. Once the work is done, the access is automatically revoked, keeping your main admin account completely secure.
⚡ Reason #3: Automated & Hands-Free Management 
Say goodbye to manual user cleanup. Set your temporary login links to expire automatically after 1 hour, 1 day, or 7 days. Our intelligent “Auto-Cleanup” system runs in the background to permanently remove expired links and temporary user accounts from your database. This “set it and forget it” approach keeps your site clean and reduces administrative overhead.
⚡ Reason #4: Gain Valuable Insights with Activity Logs 
Knowledge is power. Stay informed with our detailed Activity Logs that tracks every single temporary login event. Monitor exactly who accessed your site, when they logged in, their IP address, and even their browser information. This audit trail is essential for security monitoring and ensures you always have oversight of external access.
⚡ Reason #5: Optimized for Speed & SEO 
Don’t let security slow you down. Smart Password Protect is engineered to be lightweight and bloat-free, ensuring zero impact on your site’s loading speed. It also automatically handles SEO best practices by sending <code>noindex</code> headers for protected content, preventing Google from indexing staging sites or private pages. Plus, it works seamlessly with major caching plugins like WP Rocket and W3 Total Cache.
⚡ Reason #6: The Ultimate All-in-One Toolkit 
Stop cluttering your site with multiple plugins. Smart Password Protect combines robust Maintenance Mode, Site-Wide Password Protection, and Temporary Login functionality into a single, cohesive package. By consolidating these features, you reduce plugin conflicts, save server resources, and simplify your workflow.
⚡ Reason #7: Intuitive & Modern User Experience 
We believe security shouldn’t be complicated. Our plugin features a modern, React-powered dashboard that is intuitive and easy to navigate. From generating links to toggling protection, every action is just a click away. The frontend password form is also fully responsive and customizable, ensuring a professional experience for your visitors on any device.
⚡ Reason #8: Built for Developers 
Need more control? We’ve got you covered. Smart Password Protect is packed with hooks and filters, allowing developers to customize functionality to fit specific needs. Whether you need to modify bypass rules, control REST API access, or integrate with other tools, our codebase is clean, documented, and developer-friendly.
<h3>Check out our other Plugins</h3>
Enhance your WordPress site with our other powerful plugins:
<ul>
<li><a href="https://wordpress.org/plugins/access-defender/" rel="ugc">Access Defender</a> – Advanced security plugin to protect your WordPress site from unauthorized access and malicious attacks.</li>
<li><a href="https://wordpress.org/plugins/contributors-gallery/" rel="ugc">Contributors Gallery</a> – Showcase your WordPress contributors in a beautiful and customizable gallery layout.</li>
<li><a href="https://wordpress.org/plugins/product-spotlight-badge/" rel="ugc">Product Spotlight Badge</a> – Highlight your WooCommerce products with eye-catching badges to boost sales.</li>
<li><a href="https://wordpress.org/plugins/redirect-after-logout/" rel="ugc">Redirect After Logout</a> – Redirect users to a custom page after logging out for enhanced user experience.</li>
<li><a href="https://wordpress.org/plugins/smart-optimizer/" rel="ugc">Smart Optimizer</a> – Instantly Boost Page Speed with One-Click Optimization</li>
<li><a href="https://wordpress.org/plugins/random-quote/" rel="ugc">Random Quote</a> – Daily Inspirational Quotes for WordPress</li>
</ul>

Password Protect – Temporary Login Without Password & Password Protect Entire Site

Password Protect entire site & create Temporary Login Without Password links. Simple & secure access for developers or maintenance.

OTP Authenticator vs Password Protect – Temporary Login Without Password & Password Protect Entire Site