Alexandre Froger

<p>Add Two-Factor Authentication, Passwordless Authentication and Account Validation to your WordPress website.</p>
<h3>Overview</h3>
<p>This plugin adds the following major features to WordPress:</p>
<ul>
<li><strong>3 One-Time Password modes</strong>: Two-Factor Authentication, Passwordless Authentication and Account Validation.</li>
<li><strong>3 Authentication Gateways for OTP Verification Codes:</strong> WordPress Email, Twilio SMS, Alibaba Cloud SMS ; all with option to use a sandbox mode.</li>
<li><strong>Two-Factor Authentication:</strong> allow (or force) users to authenticate with a second factor on top of their password.</li>
<li><strong>Passwordless Authentication:</strong> allow users to login simply with their username, an identifier, and an OTP Verification Code (identifier depending on the Authentication Gateway – email or phone number supported with the default gateways).</li>
<li><strong>Account Validation:</strong> force users to validate their account by entering an OTP Verification Code at first login, on a set regular basis at login, or at each login.</li>
<li><strong>Synchronize OTP identifiers with existing data:</strong> wish to use Twilio SMS, but already have a phone number field saved in database? Perhaps with the “Billing Phone” in WooCommerce? Use this field by indicating its user meta key in the gateway settings (Note: duplicate identifiers will require users to choose a different one on update).</li>
<li><strong>Simple yet customizable appearance:</strong> forms used to request OTP Verification Codes use a neutral dedicated style compatible with most themes, with customizable logo and call-to-action colors.</li>
<li><strong>Activity Logs:</strong> when enabled, administrators can follow the activity of the enabled gateway. Critical messages regarding gateway malfunction are always logged.</li>
<li><strong>Customizable for developers:</strong> developers can add their own gateways or add custom One-Time Password modes using action and filter hooks, and more – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a>.</li>
<li><strong>Integration-friendly:</strong> specific integration with Ultimate Member and WooCommerce is included by default ; developers can easily plug into OTP Authenticator with a multitude of functions, filter hooks and action hooks – see the <a href="https://github.com/froger-me/otp-authenticator" rel="nofollow ugc">developers documentation</a> – contributions to integrations are welcome.</li>
<li><strong>Unlimited features:</strong> there are no premium version feature restrictions shenanigans – OTP Authenticator is fully-featured right out of the box.</li>
</ul>
<h3>Troubleshooting</h3>
<p>OTP Authenticator is regularly updated, and bug reports are welcome, preferably on <a href="https://github.com/froger-me/otp-authenticator/issues" rel="nofollow ugc">Github</a>, especially for advanced troubleshooting.</p>
<p>Each <strong>bug</strong> report will be addressed in a timely manner, but general inquiries and issues reported on the WordPress forum may take significantly longer to receive a response.</p>
<p><strong>Only issues occurring with included integrated plugins (or plugin features), core WordPress and default WordPress themes (incl. WooCommerce Storefront) will be considered without compensation.</strong></p>
<p><strong>Troubleshooting involving 3rd-party plugins or themes will require compensation in any case, and will not be addressed on the WordPress support forum</strong>.</p>
<h3>Integrations</h3>
<p>Although OTP Authenticator is designed to work out of the box with most combinations of WordPress plugins and themes, there are some edge cases necessitating integration, with code included in the core files of OTP Authenticator executing under certain conditions.</p>
<p>Integrations added to core are limited to popular plugins and themes: any extra code specific to a handful of installations require a separate custom integration plugin not shared with the community (decision at the discretion of the OTP Authenticator plugin author).</p>
<p>If such need for plugin integration arises, website administrators may contact the author of OTP Authenticator to become a patron.</p>
<p><strong>All integrations are to be funded by plugin users, with downpayment and delivery payment, at the plugin author’s discretion, without exception</strong>.<br />
The patron in return may be credited with their name (or company name) and a link to a page of their choice in the plugin’s Changelog.</p>


OTP Authenticator

One-Time Password Authentication for WordPress

miniOrange

miniorange

<p>Meet the new global standard of web authentication (WebAuthn). WebAuthn is a core component of FIDO2 Alliance which includes protocols that are based on public key cryptography and are strongly resistant to phishing (to varying degrees).<br />
WebAuthn is a browser-based API by FIDO2 that allows web applications to simplify and secure user authentication by using their registered devices (android phones/ iphones, laptops, etc.) as factors. WebAuthn uses public key cryptography by FIDO2 to protect users from advanced phishing attacks. With WebAuthn’s Passwordless login using Fingerprint, FaceID, Touch ID plugin, you can allow your users to login to your website by just entering their device credentials (Fingerprint, windows hello, face ID, touch ID, etc).</p>
<p>WebAuthn increases the security of your website by providing an additional layer of security and it also enhances the user experience of your website. Webauthn protects your website from many common attacks like phishing, brute force protection, man in the middle attack, malwares, etc.</p>
<p><strong><a href="https://www.miniorange.com/webauthn" rel="nofollow ugc">WebAuthn</a> requires HTTPS connection or <code>localhost</code> for secure authentication</strong></p>
<h4>Passwordless login with webauthn</h4>
<p>FIDO2/WebAuthn implements the concept of passwordless authentication. The users will enter their username and if their device/keys are configured with WebAuthn then they need to verify it for successful login. If the device is not registered for WebAuthn, then users need to enter their password and then they can configure the WebAuthn. This will make the user experience better by removing the password. It will also increase the security as webauthn is based on public key cryptography authentication and it allows the user to login only if the user is authenticated from the trusted device.</p>
<h4>WebAuthn as the [second factor](https://plugins.miniorange.com/2-factor-authentication-for-wordpress)</h4>
<p>WebAuthn is also used as the <a href="https://plugins.miniorange.com/login-to-your-wordpress-site-with-fingerprint-and-faceid-using-webauthn" rel="nofollow ugc">second factor</a> to add an extra layer of security on your website. In this case the users will enter their username and password to verify their first factor and after that they will be prompted with the WebAuthn for verification of the second layer of security. This will protect your website even if the users’ passwords are compromised, because to verify the identity of any user you need to confirm the web authentication with their device.</p>
<h4>Usernameless login with WebAuthn*</h4>
<p>WebAuthn also allows you to provide an option where users can login to your website without entering their username and password. The user will be automatically picked at login via WebAuthn.</p>
<p>As most of the users do not want to maintain too many credentials so in that case you can allow your users to use their device as the credentials and if the device is verified they will be logged into the site.</p>
<h4>Device limitation*</h4>
<p>The WebAuthn plugin provides an option where you can put a limit on the number of devices a user can register with WebAuthn. This will be helpful when you want only a particular device to login to the website.<br />
This will allow you to restrict the number of devices a user can use to access your website.</p>
<h4>Role based WebAuthn*</h4>
<p>With this you can allow WebAuthn to specific user roles. The users who have been allowed to use WebAuthn can login with WebAuthn and others will use their usual wordpress login credentials for access, without getting prompted for the WebAuthn.</p>
<h4>User-specific WebAuthn</h4>
<p>With this you can select the specific users who can login using WebAuthn to your website. Other users have to use their WordPress credentials to login.</p>
<ul>
<li>supported in the Premium version</li>
</ul>


WebAuthn – Passwordless login using Fingerprint, FaceID, Touch ID, Yubikey

WebAuthn is a new way of authenticating your user on the website. WebAuthn by the…

OTP Authenticator vs WebAuthn – Passwordless login using Fingerprint, FaceID, Touch ID, Yubikey