Alexandre Froger

Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.
<h3>Overview</h3>
This plugin adds the following major features to WordPress:
<ul>
<li>3 One-Time Password modes: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li>3 Authentication Gateways for OTP Verification Codes: WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li>Two-Factor Authentication: allow (or force) users to authenticate with a second factor on top of their password.</li>
<li>Passwordless Authentication: allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li>Account Validation: force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li>Synchronize OTP identifiers with existing data: wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li>Simple yet customizable appearance: forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li>Activity Logs: when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li>Customizable for developers: developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li>Integration-friendly: specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li>Unlimited features: there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.
Each bug report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.
Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.
Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum.
<h3>Integrations</h3>
Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.
Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).
If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.
All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception. 
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.

OTP Authenticator

One-Time Password Authentication for WordPress

Fahad Aslam

WP Ventra

VentraConnect provides a unified login system for WordPress: Social Login + Magic Link + Email OTP.
<ul>
<li>Social Login with 15+ providers (Google, Facebook, X/Twitter, LinkedIn, Microsoft, GitHub, and more)</li>
<li>Passwordless Login with Magic Link and Email OTP
<ul>
<li>Can run in Login only mode (existing users) or Login & Register mode (allow new accounts)</li>
</ul>
</li>
<li>Guardrails (optional): prevent spam accounts by letting Social Login, Magic Link and Email OTP log existing users in, but optionally blocking them from creating new users. This stops random visitors from turning your login screen into an open registration form, while your normal WordPress registration and any custom onboarding forms continue to work as usual.</li>
</ul>
Works out-of-the-box on the default WordPress login/registration screens (<code>wp-login.php</code>) and also supports shortcodes for custom pages and page builders.
No proxy servers. No third-party tracking. VentraConnect connects directly to each provider using official OAuth flows.
| <a href="https://wpventra.com/docs/what-is-ventraconnect-social-login/" rel="nofollow ugc">Setup</a> | <a href="https://wpventra.com/docs/" rel="nofollow ugc">Docs</a> | <a href="https://wpventra.com/pricing/" rel="nofollow ugc">Pro Addon</a> |
<h3>Modern WordPress login with VentraConnect</h3>
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/FEi8XCa6sys?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h3>Best for</h3>
<ul>
<li>Sites that want faster logins and fewer abandoned registrations by offering Social Login + passwordless login.</li>
<li>WooCommerce stores that want modern social + passwordless login on the login, checkout and My Account pages (Pro add-on).</li>
<li>Sites that are getting spam registrations and want Guardrails to control who can create new accounts from the default <code>wp-login.php</code> screen.</li>
<li>Sites that want to add passwordless login (Magic Link / Email OTP) as an option, without removing the classic username/password login.</li>
</ul>
<h3>Key Features (Free)</h3>
Social Login 
– 15+ providers (Google, Facebook, X/Twitter, LinkedIn, Microsoft, GitHub, and more) 
– Adds login buttons to core WordPress login & registration screens (<code>wp-login.php</code>) 
– Shortcodes for custom pages, page builders, and custom login pages 
– Account linking + unlinking (connect multiple providers to one WordPress user) 
– Optional profile sync (name + avatar) 
– Button styles: Light, Dark, Minimal, plus icon-only layouts
Passwordless Login (Magic Link + Email OTP)
<ul>
<li>Built-in security: expiry, resend throttling, single-use links, max attempt limits</li>
<li>Flexible behavior: Login only mode or Login & Register mode (per method)</li>
<li>Per-method redirect overrides (same page, referrer, homepage, custom URL)</li>
<li>Custom emails: edit sender name, subject, and message templates</li>
<li>New: Improved with polished default HTML emails for Magic Link and Email OTP.</li>
</ul>
Guardrails (Spam & signup control) 
– Prevent spam accounts by controlling whether Social Login, Magic Link and Email OTP are allowed to create new users 
– Keep your login screen focused on login only, while still letting existing users sign in with all three methods 
– Your normal WordPress registration form and other registration/onboarding flows continue to work as usual
Admin Tools 
– Basic redirect options for social + passwordless login 
– Diagnostics/logging to debug OAuth and login issues 
– Email notifications (user + admin) when a new account is created via social login
<h3>Pro Add-on (Optional)</h3>
The Pro add-on extends the same login system into popular plugins and adds advanced control:
<ul>
<li>WooCommerce integration for login, checkout and My Account, with Guardrails-aware flows and context-based shortcodes</li>
<li>LMS integrations: LearnDash, LifterLMS, LearnPress</li>
<li>Membership/community integrations: MemberPress, Ultimate Member, Paid Memberships Pro (PMPro), BuddyPress</li>
<li>Passwordless Mode (Off, Recommended, Strict) to control how aggressively passwords are phased out on supported forms while keeping an admin fallback</li>
<li>New: Custom-branded Magic Link & Email OTP emails with your logo, accent color, and footer text</li>
<li>New: Inline Magic Link and Email OTP forms for custom pages, Elementor popups, account dropdowns and custom login layouts.</li>
<li>Advanced redirect rules </li>
<li>Analytics & login insights</li>
<li>Additional diagnostics/logging for complex setups</li>
</ul>
Pro features require the separate <a href="https://wpventra.com/" rel="nofollow ugc">VentraConnect Social Login Pro</a> add-on.
<h3>Roadmap: Passkeys for WordPress</h3>
VentraConnect is being developed as a modern WordPress login suite that currently includes Social Login, Magic Link, Email OTP and Guardrails.
We are also working toward passkey support as a future VentraConnect add-on. The goal is to bring passkey login into the same ecosystem, with fallback options through Magic Link and Email OTP instead of forcing passkey-only access.
<a href="https://wpventra.com/blog/passkeys-for-wordpress-ventraconnect/" rel="nofollow ugc">Read the public passkeys roadmap</a>
<h3>Supported Social Providers</h3>
Google, Facebook, X (Twitter), LinkedIn, Microsoft, GitHub, Discord, Reddit, Slack, Twitch, Spotify, TikTok, Amazon, Yahoo, WordPress.com, LINE.
<h3>How It Works</h3>
<ol>
<li>The user clicks a Social Login button, or requests a Magic Link / Email OTP.</li>
<li>For Social Login, the user authenticates with the provider via official OAuth; for Magic Link / OTP, they verify ownership of their email address.</li>
<li>VentraConnect receives basic profile or email data and looks for an existing WordPress user.</li>
<li>If the email matches an existing user, the login methods are linked to that account and the user is logged in. If not, a new user may be created (subject to your Guardrails and registration settings).</li>
</ol>
<h3>External Services</h3>
VentraConnect Social Login is an OAuth client only.
During login:
<ol>
<li>The user is redirected to the selected provider such as Google or Facebook.</li>
<li>The provider authenticates the user.</li>
<li>The provider returns an authorization token to your site.</li>
<li>VentraConnect retrieves basic profile data:
<ul>
<li>Provider user ID</li>
<li>Email address</li>
<li>Display name</li>
<li>Avatar URL</li>
</ul>
</li>
</ol>
No user data is sent to or stored on servers owned by the plugin author. 
All communication happens directly between your WordPress site and the provider official APIs.
<h3>Provider Domains Used</h3>
Google 
accounts.google.com 
oauth2.googleapis.com 
people.googleapis.com
Facebook 
graph.facebook.com
Microsoft 
login.microsoftonline.com 
graph.microsoft.com
TikTok 
open.tiktokapis.com
Reddit 
www.reddit.com 
oauth.reddit.com
LINE 
access.line.me 
api.line.me
Slack 
slack.com
Discord 
discord.com
Twitch 
id.twitch.tv 
api.twitch.tv
GitHub 
github.com 
api.github.com
Amazon 
www.amazon.com 
api.amazon.com
Yahoo 
api.login.yahoo.com
WordPress.com 
public-api.wordpress.com
LinkedIn 
www.linkedin.com 
api.linkedin.com
Each provider has its own Terms of Service and Privacy Policy. You are responsible for complying with those terms when enabling a provider.

Social Login, Magic Link & Email OTP – Passwordless Login by VentraConnect

Social login with 15+ providers plus passwordless login (Magic Link & Email OTP), with Guardrails to block spam registrations.

OTP Authenticator vs Social Login, Magic Link & Email OTP – Passwordless Login by VentraConnect