Alexandre Froger

<p>Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.</p>
<h3>Overview</h3>
<p>This plugin adds the following major features to WordPress:</p>
<ul>
<li><strong>3 One-Time Password modes</strong>: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li><strong>3 Authentication Gateways for OTP Verification Codes:</strong> WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li><strong>Two-Factor Authentication:</strong> allow (or force) users to authenticate with a second factor on top of their password.</li>
<li><strong>Passwordless Authentication:</strong> allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li><strong>Account Validation:</strong> force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li><strong>Synchronize OTP identifiers with existing data:</strong> wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li><strong>Simple yet customizable appearance:</strong> forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li><strong>Activity Logs:</strong> when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li><strong>Customizable for developers:</strong> developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li><strong>Integration-friendly:</strong> specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li><strong>Unlimited features:</strong> there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
<p>OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.</p>
<p>Each <strong>bug</strong> report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.</p>
<p><strong>Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.</strong></p>
<p><strong>Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum</strong>.</p>
<h3>Integrations</h3>
<p>Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.</p>
<p>Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).</p>
<p>If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.</p>
<p><strong>All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception</strong>.<br />
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.</p>


OTP Authenticator

One-Time Password Authentication for WordPress

Sunil Kumar Sharma

xpertzmate

The Better India

<p>WP One Tap Google Sign In adds Google One Tap authentication to WordPress. It helps site owners offer a faster, passwordless login experience while keeping authentication tied to existing WordPress user accounts.</p>
<p>When a visitor signs in with Google, the plugin verifies the Google ID token server-side, checks the configured OAuth client ID, confirms the Google email is verified, and then signs in the matching WordPress user. The plugin also supports site-wide display for logged-out visitors, a customizable companion message block, and direct Google account linking from WordPress user profiles.</p>
<h4>Key Features</h4>
<ul>
<li>Google One Tap prompt on the WordPress login screen.</li>
<li>Optional site-wide One Tap prompt for logged-out visitors.</li>
<li>Server-side Google ID token verification with WordPress HTTP APIs.</li>
<li>Existing-user login only by default.</li>
<li>Google account linking and disconnect controls on WordPress user profiles.</li>
<li>Automatic account-link migration after a successful verified email login.</li>
<li>Admin activity log for successful logins, failed attempts, account linking, and unlinking events.</li>
<li>Salted hashes for IP addresses and Google account identifiers in the activity log.</li>
<li>Optional custom message block with image, title, and formatted content.</li>
<li>WordPress 7.0-ready metadata with PHP 8.1, 8.2, and 8.3 compatibility.</li>
</ul>
<h4>Security Approach</h4>
<p>The plugin uses WordPress nonces for AJAX requests, sanitizes all incoming data, escapes admin output, and validates the Google token audience against the configured OAuth client ID. It does not create new users automatically. A Google login succeeds only when the verified Google account maps to an existing WordPress user.</p>
<h4>Privacy</h4>
<p>The activity log stores the Google email address used during an event, the WordPress user ID when available, event status, event reason, user agent, and salted hashes of the request IP address and Google account identifier. Activity records older than 90 days are pruned automatically when new events are logged.</p>
<h3>Configuration</h3>
<h4>Create a Google OAuth Client ID</h4>
<ol>
<li>Open the Google Cloud Console credentials page:<br />
https://console.developers.google.com/apis/credentials</li>
<li>Create an OAuth 2.0 Client ID.</li>
<li>Choose Web application as the application type.</li>
<li>Add your WordPress site’s authorized JavaScript origin.</li>
<li>Copy the client ID into Settings > One Tap GSI.</li>
</ol>
<h4>Link a WordPress User to Google</h4>
<ol>
<li>Open Users > Profile for your own account, or edit another user if your role allows it.</li>
<li>Find the Google One Tap Sign-In section.</li>
<li>Use the Google button to link a verified Google account.</li>
<li>To disconnect, check Disconnect this Google account and save the profile.</li>
</ol>
<h4>Customize the Message Block</h4>
<ol>
<li>Go to Settings > One Tap GSI.</li>
<li>Enable the custom message block.</li>
<li>Choose an image from the Media Library or enter an image URL.</li>
<li>Add a short title and supporting formatted content.</li>
<li>Save the settings.</li>
</ol>


WP One Tap Google Sign In

Secure Google One Tap sign-in for WordPress login pages, with account linking and admin activity logs.

OTP Authenticator vs WP One Tap Google Sign In