amitmital

<p>OTPfy – Semalessly integrate password-less login on your wordpress website.</p>
<p>Delight your users with seamless and quick login mechanism on top of your existing login methods. Verify users through one-time-code sent on their mobile number or email before allowing them to access any sensitive content.</p>
<h3>🔐 Key Features: Fortify Your WordPress Security with OTPfy</h3>
<h3>🔐 Reduce Fake Orders & RTO risk</h3>
<p>Verify customer’s mobile number via otp before they can place orders. Extremely helpful for COD orders and preventing RTO risk!</p>
<h3>🔐 Passwordless Elegance</h3>
<p>Step into the future of user authentication! Say farewell to cumbersome passwords and embrace the elegance of OTPfy’s passwordless login. Users receive a one-time password (OTP) in seconds, granting them swift and secure access to your WordPress realm without the fuss of memorizing complex passwords.</p>
<h3>🚀 Swift and Secure Logins</h3>
<p>No more waiting around! OTPfy’s rapid OTP delivery ensures swift and secure logins, enhancing both user satisfaction and website security.</p>
<p>Bouquet of outstanding features that make OTPfy the ultimate solution for enhancing authentication experience, for both website owners and website users.</p>
<h3>⚡️ Rapid OTP Delivery</h3>
<p>Say goodbye to waiting around! OTPfy ensures that OTPs reach users’ inboxes and phones within an astounding 3 seconds. This lightning speed guarantees seamless and secure logins, keeping your users delighted and secure.</p>
<h3>🔍 Transparency at Its Best</h3>
<p>Real time logs and delivery reports for every otp sent from your website, whether it’s sms or email.</p>
<h3>🤝 User-Friendly Bliss</h3>
<p>No more headaches. OTPfy is designed for simplicity, both for administrators configuring the plugin and for users logging in. Enjoy a secure login process that feels as effortless as it is safe.</p>
<h3>🛒 Seamless WooCommerce Magic</h3>
<p>Running a WooCommerce-powered online store? OTPfy seamlessly integrates with WooCommerce, casting a spell of convenience over your e-commerce experience. Elevate both security and user delight for your online shoppers with the enchantment of passwordless login. 🪄🛍️</p>
<h3>📱 Seamless Compatibility</h3>
<p>OTPfy plays nice with your favorite authentication plugins, such as social login plugins, 2FA plugins etc.. Your users can choose their preferred method, adding a layer of convenience to the login experience.</p>
<p>These are the extraordinary features that make OTPfy the go-to solution for fortifying your WordPress website. Embrace the future of security with 2FA, warp-speed OTPs, and a commitment to clarity and trustworthiness.</p>
<h3>External Services</h3>
<p>This plugin utilizes the following external services to render it’s functions:</p>
<ul>
<li>
<p>Quick Engage Messaging:</p>
<ul>
<li>This service is core of this plugin. All of your data is stored on this service and it’s responsible for sending OTPs.</li>
<li>https://quickengage.bitss.in/ privacy policy -https://bitss.tech/privacy-policy/ terms and conditions -https://bitss.tech/terms-conditions/</li>
</ul>
</li>
<li>
<p>Bitss Tech Server</p>
<ul>
<li>To save and process your feedbacks related to this plugin.</li>
<li>https://sites.bitss.tech</li>
</ul>
</li>
</ul>


Otpfy your Website

Premium Email & SMS service for OTP based authentication

Konceptwise Digital Media Pvt Ltd

<p>Authyo Passwordless Login is a WordPress login security plugin that protects your site with brute-force protection, IP blacklisting, security activity logs, XML-RPC blocking, REST API protection, and a custom login URL. All security features work immediately after activation — no API keys or account registration needed.</p>
<p>Optionally, add Authyo API credentials to enable passwordless OTP login where users log in with a one-time password sent to their email instead of a traditional password.</p>
<p><strong>Security features that work without API keys:</strong></p>
<ul>
<li><strong>Brute-force protection</strong> — Limit login attempts per IP and username with progressive lockout durations. Repeat offenders are automatically blacklisted.</li>
<li><strong>IP Manager</strong> — Whitelist trusted IPs and blacklist attackers. Includes search, filter, pagination, and per-page selector for large lists.</li>
<li><strong>Security activity logs</strong> — Track every login, logout, failed attempt, lockout, and blocked access. Includes request URL tracking, date filters, search, and CSV export.</li>
<li><strong>Disable XML-RPC</strong> — Block xmlrpc.php requests at the server level using .htaccess rules. Removes X-Pingback headers and XML-RPC discovery links. Falls back to PHP blocking on Nginx.</li>
<li><strong>REST API Protection</strong> — Restrict access to WordPress REST API endpoints for unauthenticated users. Prevents data enumeration and unauthorized access while keeping essential endpoints functional.</li>
<li><strong>Custom login URL</strong> — Hide wp-login.php behind a custom URL slug to prevent automated attacks.</li>
<li><strong>Blocked IP logging</strong> — Every access attempt from blacklisted or locked-out IPs is logged with IP address, user agent, and request URL.</li>
</ul>
<p><strong>Passwordless login features (requires free Authyo API keys):</strong></p>
<ul>
<li><strong>Email OTP login</strong> — Users receive a one-time password via email and log in without a traditional password.</li>
<li><strong>Google Authenticator fallback</strong> — Server-side verified 2FA as a backup method after multiple OTP attempts.</li>
<li><strong>Secure login tokens</strong> — Cryptographically generated, single-use, browser-bound tokens that expire after 5 minutes.</li>
<li><strong>AJAX-powered login</strong> — Smooth login experience with no page reloads.</li>
</ul>
<h3>How It Works</h3>
<p><strong>Security (works immediately after activation):</strong></p>
<ol>
<li>Activate the plugin — brute-force protection and security logs start automatically</li>
<li>Go to Settings > Authyo Passwordless Login > Security tab</li>
<li>Enable XML-RPC Protection, REST API Protection, and Custom Login URL as needed</li>
<li>Visit Authyo Logs to monitor activity and manage IPs</li>
</ol>
<p><strong>Passwordless login (requires API keys):</strong></p>
<ol>
<li>User enters their email on the WordPress login page</li>
<li>A one-time password (OTP) is sent to their email</li>
<li>User enters the OTP code</li>
<li>WordPress logs the user in automatically — no password required</li>
</ol>
<h3>External Services</h3>
<p>This plugin connects to Authyo’s external API only for passwordless login and Google Authenticator features. All security features (brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, custom login URL) work locally without any external service.</p>
<p><strong>OTP Authentication:</strong></p>
<ul>
<li>User email address is sent to Authyo API when requesting an OTP</li>
<li>OTP code and Mask ID are sent to Authyo API for verification</li>
</ul>
<p><strong>Google Authenticator Verification:</strong></p>
<ul>
<li>Verification token is sent to Authyo API for server-side validation</li>
<li>The Authyo 2FA SDK script is loaded from <a href="https://app.authyo.io/js/v1/auth-2fasdk.js" rel="nofollow ugc">https://app.authyo.io/js/v1/auth-2fasdk.js</a></li>
</ul>
<p><strong>Usage Tracking (Opt-In Only):</strong></p>
<p>If the user explicitly opts in, plugin version, WordPress version, and site URL are sent when settings are saved. Deactivation feedback is sent when the plugin is deactivated. No tracking data is sent without user consent.</p>
<p><strong>Authentication Flow:</strong></p>
<ul>
<li>After OTP verification, the plugin generates a secure single-use token using WordPress core functions</li>
<li>Token is browser-bound using a hashed User-Agent signature to prevent session hijacking</li>
<li>Token is stored temporarily in WordPress transients (5-minute expiry) and deleted immediately after use</li>
</ul>
<p><strong>Data Storage:</strong></p>
<ul>
<li>OTP session data stored temporarily in WordPress transients (10-minute expiry)</li>
<li>Login tokens stored temporarily in WordPress transients (5-minute expiry, single-use)</li>
<li>Security logs stored in a custom database table with configurable retention</li>
<li>IP whitelist and blacklist stored in a custom database table</li>
<li>No user data is permanently stored beyond security logs</li>
</ul>
<p><strong>Service URLs:</strong></p>
<ul>
<li>API: <a href="https://app.authyo.io/api/v1/" rel="nofollow ugc">https://app.authyo.io/api/v1/</a></li>
<li>2FA SDK: <a href="https://app.authyo.io/js/v1/auth-2fasdk.js" rel="nofollow ugc">https://app.authyo.io/js/v1/auth-2fasdk.js</a></li>
</ul>
<p><strong>Terms of Service:</strong> <a href="https://authyo.io/terms-service" rel="nofollow ugc">https://authyo.io/terms-service</a><br />
<strong>Privacy Policy:</strong> <a href="https://authyo.io/privacy-policy" rel="nofollow ugc">https://authyo.io/privacy-policy</a></p>


Authyo Passwordless Login

WordPress login security with brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, and passwordless OTP login.

Otpfy your Website vs Authyo Passwordless Login