WP Busters

<h4>Use your glance or fingerprint using Touch ID or Face ID for easy and secure access.</h4>
<p>Improve your authentication security; you do not need a password.<br />
When you enable Passwordless WP on your site, you can log in with a simple action.</p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/ZdhW089h69w?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p>The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users using public-key cryptography instead of a password.</p>
<h4>Safe facial or fingerprint data</h4>
<p>The plugin recieves data which is provided by the device, your deivce tells the plugin if your person was recognized or not. It does not store your data, only token will be stored in WordPress without the ability to use it. It’s useless data without your physical access to the device.</p>
<h4>Focus on User Experience</h4>
<p>We follow the standard WordPress UX login page together with common-used elements to make using comfortable with a minimal footprint. Login and attach your device and passwordless login will available for the next login.</p>
<h4>FIDO 2 + WebAuthn</h4>
<p>WebAuthn was officially recognized as a W3C web standard in March 2019. Web Authentication is a new standard enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users using hardware authenticators.</p>
<h4>GDPR Safe</h4>
<p>The web standard was created from the outset with a “privacy by design” approach and are a strong fit for GDPR compliance. Crucially, the plugin delivers authentication with no third-party involvement or tracking between accounts. And when it comes to biometrics, FIDO and WebAuthn standards prevent this information from being stored and matched in servers – it never leaves the user’s device do not allow for any biometric data to be captured.</p>
<h4>Browsers Supports</h4>
<p>Passwordless WP is currently supported in Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari web browsers on iOS 14 and BigSur, as well as Windows 10 and Android platforms.</p>
<p>Passwordless WP requires HTTPS and SSL secure connection or localhost/127.0.0.1 environment. It supports only platform authenticator like Touch ID, Face ID, Windows Hello, Fingerprint and etc.</p>
<h4>Help with ideas and testing</h4>
<p>If you want to discuss and suggest any new ideas,<br />
Join to Early Access Team group here: https://www.facebook.com/groups/676882319616540/</p>
<p>Trademark notices</p>
<p>Registered trademarks and service marks are the property of their respective owners.</p>
<p>Apple, Face ID, iPad, iPhone, Mac, macOS, Safari, and Touch ID are trademarks of Apple Inc., registered in the U.S. and other countries.</p>
<p>Android, Chrome, Google, Google Chrome are trademarks of Google, Inc.</p>
<p>Microsoft, Windows are registered trademarks of Microsoft Corporation in the United States and other countries.</p>
<p>Contributing</p>
<p>You can contribute or see sources to this plugin on <a href="https://github.com/WP-Busters/passwordless-wp" rel="nofollow ugc">GitHub</a>.</p>


Passwordless WP – Login with your glance or fingerprint

I have been waiting for this. This is how devices started getting rid of passwords. Then some native phone apps followed. Now to web apps and WordPress. This is the future.

Perfect and elegant

Use your glance or fingerprint using Touch ID or Face ID for easy and secure access. Improve your authentication security, you do not need a password.

Andrew Norcross

Jason Coleman

<p>WP Bouncer restricts the number of simultaneous logins for the same WordPress user account. The plugin’s goal is to deter people from sharing their login credentials for your site, which is especially important for a paid membership, premium content, or eLearning site.</p>
<h3>How WP Bouncer Protects Shared User Logins</h3>
<ul>
<li>The plugin stores a random <code>FAKESESSID</code> for each user when they log in.</li>
<li>If a user is logged in, on each page load (init hook), WP Bouncer checks if the <code>FAKESESSID</code> stored in the user’s cookies is the same as the last login stored in a transient (<code>fakesessid_user_login</code>).</li>
<li>If the two values do no match, WP Bouncer logs the user out and redirects them to the WordPress login page or a custom page using the wp_bouncer_redirect_url filter.</li>
</ul>
<p>If the WP_BOUNCER_HEARTBEAT_CHECK is defined to true, JavaScript will be loaded to bounce users when a new user logs in with the same login. This is useful for sites with page caching.</p>
<p>Admininstrator accounts or any users with the “manage_options” capability are excluded from bounces.</p>
<h3>Or, Allow a Specific Number of Active Sessions</h3>
<p>By default, WP Bouncer only allows one session per user.</p>
<p>You can use this plugin to offer bulk memberships to corporate, education, or other group-type customers via a shared login.</p>
<p>Use the <code>wp_bouncer_number_simultaneous_logins</code> filter to allow a defined number of active “sessions”.</p>
<p><a href="https://www.paidmembershipspro.com/limit-user-active-sessions/" rel="nofollow ugc">View the Recipe</a></p>
<h3>Example Use Cases for WP Bouncer</h3>
<ul>
<li>User A logs in as “user”. Their <code>FAKESESSID</code>, say “SESSION_A” is stored in a WordPress option.</li>
<li>User B logs in as “user”. Their <code>FAKESESSID</code>, say “SESSION_B” is overwrites the stored WordPress option.</li>
<li>User A tries to load a page on your site, WP Bouncer catches them and logs them out, redirecting them to the warning message.</li>
<li>User B can browse around the site as normal… unless…</li>
<li>User A logs in again as “user”. Their <code>FAKESESSID</code>, “SESSION_A_v2” is stored in the WordPress option.</li>
<li>Now user B would be logged out if they load another page.</li>
</ul>
<h3>Hooks and Filters</h3>
<ul>
<li><code>wp_bouncer_ignore_admins</code> filter: if returning false even admins will be bounced.</li>
<li><code>wp_bouncer_redirect_url</code> filter: can be used to change the URL redirected to after being bounced.</li>
<li><code>wp_bouncer_number_simultaneous_logins</code> filter: can be set to limit logins to a number other than 1. 0 means unlimited logins.</li>
<li><code>wp_bouncer_login_flag</code>: runs right before bouncing (can be used to potentially stop the bouncing).</li>
<li><code>wp_bouncer_session_ids</code> hook: used to filter session ids when saving them. Passes $session_ids, $old_session_ids (before any were removed/bounced), and the current user’s ID as parameters.</li>
<li><code>wp_bouncer_session_length</code> hook: used to filter how long the session ids transients are set. This way, you can time the transients to expire at a specific time of day. Note that the transient is saved on every page load, so if you set it to 5 minutes, it’s going to push it out 5 minutes on every page load. You should try to set it to (the number of seconds until midnight) or something like that.</li>
</ul>
<h3>Support the Plugin Authors</h3>
<p>If you like this plugin, please check out Jason’s work with <a href="https://www.strangerstudios.com" rel="nofollow ugc">Stranger Studios</a> and <a href="https://www.paidmembershipspro.com" rel="nofollow ugc">Paid Memberships Pro</a> and <a href="http://andrewnorcross.com/" rel="nofollow ugc">Andrew’s work at his personal site</a>.</p>


WP Bouncer – Limit Simultaneous Logins

Deter members from sharing login credentials: restrict simultaneous logins for the same user.

Passwordless WP – Login with your glance or fingerprint vs WP Bouncer – Limit Simultaneous Logins