Alexandre Froger

Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.
<h3>Overview</h3>
This plugin adds the following major features to WordPress:
<ul>
<li>3 One-Time Password modes: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li>3 Authentication Gateways for OTP Verification Codes: WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li>Two-Factor Authentication: allow (or force) users to authenticate with a second factor on top of their password.</li>
<li>Passwordless Authentication: allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li>Account Validation: force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li>Synchronize OTP identifiers with existing data: wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li>Simple yet customizable appearance: forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li>Activity Logs: when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li>Customizable for developers: developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li>Integration-friendly: specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li>Unlimited features: there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.
Each bug report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.
Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.
Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum.
<h3>Integrations</h3>
Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.
Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).
If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.
All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception. 
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.

OTP Authenticator

One-Time Password Authentication for WordPress

Victor Flores

Wapu Auth is a free Google Social Login plugin for WordPress and WooCommerce. It lets your visitors register and login to your site using their Google account instead of forcing them to fill out the default registration form. No passwords to remember, no validation emails to wait for — just one click and they’re in.
Whether you run a WooCommerce store, a membership site, or any WordPress site, Wapu Auth makes Google login and registration instant, secure, and completely free — including WooCommerce integration.
<blockquote>
Wapu Auth Pro is coming soon with additional social login providers (Facebook, Apple, GitHub), advanced analytics exports, and priority support.
</blockquote>
<h4>Free WooCommerce Social Login — No Pro Upgrade Required</h4>
Most social login plugins lock WooCommerce compatibility behind a paid plan. Wapu Auth includes free WooCommerce social login out of the box. The Google login button is automatically placed on your WooCommerce login page, registration page, and checkout form — zero configuration needed.
Store owners: let customers register and login at checkout with their Google account. Fewer abandoned carts. More completed purchases.
<h4>Google Login & Registration Features</h4>
Google Login — One Click 
Let visitors register and login with their Google account instantly. No passwords, no forms, no friction. Social login the way it should be: fast and invisible.
Free WooCommerce Login Integration 
Google login button automatically appears on all WooCommerce forms: login, register, and checkout. Free. No Pro plan required.
Analytics Dashboard 
Track every Google login attempt, new registration, and user activity from your WordPress admin panel.
Domain Restrictions 
Whitelist or blacklist email domains for your Google social login. Only @yourcompany.com users can log in? Done.
Sandbox Mode 
Test the complete Google OAuth login flow with specific test emails before going live. No risk to production data.
Customizable Google Login Button 
Match the social login button to your brand. Adjust colors, text, size, and style with a live visual editor — no CSS required.
Popup Mode 
Display the Google login prompt in a popup window for a seamless, redirect-free social login experience.
Activity Log 
Full log of every social login attempt: status, email, timestamp, and optional GeoIP location data.
Shortcode Support 
Place the Google social login button anywhere on your site: 
 [wapu_auth_button] — Google login button 
 [wapu_auth_login_form] — Full custom login form with Google login 
 [wapu_auth_register_form] — Full custom registration form with Google login
Custom Login & Registration Form Templates 
Replace the default WordPress login and register pages with three built-in templates: Classic, Modern, and Compact. All include the Google social login button.
Full Internationalization 
Fully translated into English and Spanish. Ready for community translation via translate.wordpress.org.
<h4>Who Uses Wapu Auth?</h4>
WooCommerce store owners looking to reduce cart abandonment by adding Google login to the checkout page — free, without a Pro plan.
Membership site owners who want fast, trusted social login and registration using Google accounts.
WordPress developers and agencies who need a clean, standards-compliant Google OAuth plugin for client sites.
Users switching from Nextend Social Login who need free WooCommerce social login integration without paying for a Pro addon.
<h4>How Google Social Login Works</h4>
<ol>
<li>Visitor clicks the Google login button on your site</li>
<li>Google authenticates the user via secure OAuth 2.0</li>
<li>Wapu Auth creates or matches their WordPress account by email</li>
<li>User is logged in — done. The whole process takes under 3 seconds.</li>
</ol>
Existing users who already have a WordPress account with the same Google email address are automatically matched and logged in — no duplicate accounts, no confusion.
<h4>Privacy & Compliance</h4>
Wapu Auth connects to Google’s OAuth API only when a user actively clicks the Google login button. GeoIP enrichment and Google Analytics integration are optional and disabled by default. Site owners are responsible for appropriate consent mechanisms for their jurisdiction (GDPR, CCPA, etc.).
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>SSL certificate (HTTPS) — required by Google OAuth</li>
<li>Free Google Cloud Console account — to generate OAuth credentials</li>
<li>WooCommerce 7.0 or higher (optional, for automatic WooCommerce social login integration)</li>
</ul>
<h3>External Services</h3>
This plugin connects to the following external services only under clearly documented conditions.
<h4>1. Google OAuth 2.0 / OpenID Connect (required for Google social login)</h4>
Endpoints: 
* <code>https://accounts.google.com/o/oauth2/v2/auth</code> 
* <code>https://oauth2.googleapis.com/token</code> 
* <code>https://www.googleapis.com/oauth2/v2/userinfo</code> 
* <code>https://accounts.google.com/.well-known/openid-configuration</code> (admin diagnostics only)
Data sent: Client ID, redirect URI, OAuth scope, state token, and authorization code. An access token is sent to retrieve the user’s Google profile.
Data received: Google account ID, email address, display name, profile picture URL, email verification status, and locale.
When triggered: Only when a user actively clicks the Google login button, or when an admin runs connection diagnostics from the settings page.
Google’s policies: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a> | <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a>
<h4>2. GeoIP Providers (optional — disabled by default)</h4>
Services: <code>https://ipapi.co/</code> with <code>https://ipwho.is/</code> as fallback.
Data sent: Visitor IP address for location lookup.
When triggered: Only when GeoIP enrichment is enabled in the plugin’s security settings.
Note: Enable only with appropriate legal basis and user consent where required (e.g. GDPR).
Policies: <a href="https://ipapi.co/privacy/" rel="nofollow ugc">ipapi.co</a> | <a href="https://ipwhois.io/privacy-policy/" rel="nofollow ugc">ipwhois</a>
<h4>3. Google Analytics 4 Event Bridge (optional — disabled by default)</h4>
Service: Uses the site’s existing gtag / GA4 setup, if present.
Data sent: Social login event names and metadata only (login_start, success/error status).
When triggered: Only when a GA4 Measurement ID is configured and analytics is enabled in plugin settings.
Note: Site owners are responsible for obtaining required user consent before enabling this feature.
<h4>4. Google Fonts (optional frontend asset)</h4>
Services: <code>https://fonts.googleapis.com</code> | <code>https://fonts.gstatic.com</code>
Data sent: Standard browser request headers (IP, user-agent) to retrieve font CSS.
When triggered: When the social login button is rendered on the frontend.
Google’s policies: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>

Wapu Auth – Google Social Login for WordPress & WooCommerce

Google Social Login for WordPress & WooCommerce -- free. Let users register and login with their Google account in one click. No passwords, no forms.

OTP Authenticator vs Wapu Auth – Google Social Login for WordPress & WooCommerce