rathsh

<p><strong>Rat Two-Factor Authentication</strong> is a lightweight yet powerful security plugin that adds an extra layer of protection to your WordPress site through email-based One-Time Password (OTP) verification.</p>
<h4>Key Features</h4>
<ul>
<li><strong>Email-based OTP verification</strong> – Secure 6-digit codes sent to user’s email</li>
<li><strong>Lightweight and fast</strong> – Minimal impact on site performance</li>
<li><strong>User-friendly interface</strong> – Clean, responsive design that works on all devices</li>
<li><strong>Flexible settings</strong> – Enable 2FA globally or per user</li>
<li><strong>Role-based requirements</strong> – Require 2FA for specific user roles</li>
<li><strong>Session management</strong> – Secure session handling with timeout protection</li>
<li><strong>AJAX-powered</strong> – Smooth user experience without page reloads</li>
<li><strong>Auto-submit functionality</strong> – Automatically submits form when 6 digits are entered</li>
<li><strong>Resend functionality</strong> – Users can request new codes with cooldown protection</li>
<li><strong>Mobile-friendly</strong> – Optimized for mobile login experiences</li>
<li><strong>Security-first</strong> – Nonce protection, input sanitization, and secure coding practices</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>User enters their username and password normally</li>
<li>If 2FA is enabled, they’re redirected to an OTP verification screen</li>
<li>A 6-digit code is sent to their registered email address</li>
<li>User enters the code to complete login</li>
<li>Code expires after 10 minutes for security</li>
</ol>
<h4>Perfect For</h4>
<ul>
<li><strong>Business websites</strong> requiring enhanced security</li>
<li><strong>E-commerce stores</strong> protecting customer accounts</li>
<li><strong>Membership sites</strong> with sensitive user data</li>
<li><strong>Multi-author blogs</strong> securing contributor access</li>
<li><strong>Any WordPress site</strong> wanting better login security</li>
</ul>
<h4>Admin Features</h4>
<ul>
<li><strong>Global 2FA setting</strong> – Enable for all users</li>
<li><strong>Force 2FA option</strong> – Make it mandatory for selected roles</li>
<li><strong>Role-based configuration</strong> – Choose which roles require 2FA</li>
<li><strong>User profile integration</strong> – Users can enable/disable 2FA individually</li>
<li><strong>Clean admin interface</strong> – Easy to configure and manage</li>
</ul>
<h4>Developer Friendly</h4>
<ul>
<li><strong>Well-documented code</strong> with inline comments</li>
<li><strong>WordPress coding standards</strong> compliant</li>
<li><strong>Hook system</strong> for customization</li>
<li><strong>Lightweight codebase</strong> for easy modification</li>
<li><strong>No external dependencies</strong> – Pure WordPress integration</li>
</ul>
<h4>Security Features</h4>
<ul>
<li><strong>Nonce verification</strong> for all AJAX requests</li>
<li><strong>Input sanitization</strong> and validation</li>
<li><strong>Secure OTP generation</strong> using WordPress built-in functions</li>
<li><strong>Session timeout</strong> protection (10 minutes)</li>
<li><strong>Rate limiting</strong> on resend requests</li>
<li><strong>No plain text storage</strong> of OTP codes</li>
</ul>
<h3>Configuration</h3>
<h4>Global Settings</h4>
<p>Navigate to <strong>Settings > Two-Factor Auth</strong> to configure:</p>
<ul>
<li><strong>Enable 2FA Globally</strong>: Turn on 2FA for all users</li>
<li><strong>Force 2FA for All Users</strong>: Make 2FA mandatory regardless of user preference</li>
<li><strong>Required User Roles</strong>: Select specific roles that must use 2FA</li>
</ul>
<h4>User Settings</h4>
<p>Each user can enable/disable 2FA in their profile:</p>
<ol>
<li>Go to <strong>Users > Profile</strong> (or <strong>Users > Your Profile</strong>)</li>
<li>Find the “Two-Factor Authentication” section</li>
<li>Check “Enable 2FA” to activate for that user</li>
<li>Save the profile</li>
</ol>
<h4>Email Configuration</h4>
<p>The plugin uses WordPress’s built-in <code>wp_mail()</code> function. Ensure your site can send emails properly. Consider using:</p>
<ul>
<li>SMTP plugins for reliable email delivery</li>
<li>Email services like SendGrid, Mailgun, or Amazon SES</li>
<li>Proper SPF/DKIM records for your domain</li>
</ul>
<h3>Support</h3>
<p>For support, feature requests, or bug reports:</p>
<ul>
<li><strong>Plugin Support</strong>: <a href="https://wordpress.org/support/plugin/rat-two-factor-authentication" rel="ugc">WordPress.org Support Forum</a></li>
<li><strong>Documentation</strong>: Available in the plugin’s admin area</li>
<li><strong>Bug Reports</strong>: Please provide detailed information about your setup</li>
</ul>
<h3>Contributing</h3>
<p>We welcome contributions! The plugin follows WordPress coding standards and best practices.</p>
<h3>Privacy Policy</h3>
<p>This plugin:<br />
* Stores minimal user data (2FA preference and temporary OTP hashes)<br />
* Does not send data to external services<br />
* Uses WordPress’s built-in email system<br />
* Follows WordPress privacy guidelines<br />
* Allows data export/erasure as per GDPR requirements</p>
<h3>Technical Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>PHP 7.4 or higher</li>
<li>MySQL 5.6 or higher (or equivalent MariaDB)</li>
<li>Ability to send emails from WordPress</li>
<li>Modern web browser with JavaScript enabled</li>
</ul>
<h3>Credits</h3>
<p>Developed with ❤️ by the Rat Plugins team, focused on creating lightweight, powerful, and user-friendly WordPress plugins.</p>
<h3>License</h3>
<p>This plugin is licensed under the GPL v2 or later.</p>
<blockquote>
<p>This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.</p>
<p>This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.</p>
</blockquote>


Rat Two-Factor Authentication

Lightweight and powerful Two-Factor Authentication plugin for WordPress with email-based OTP verification.

rijensky

<p>OtpPal lets your WordPress site send and verify OTP (One-Time Password) messages via WhatsApp. This plugin enables secure phone number verification for your WordPress forms, helping prevent spam and ensuring legitimate user submissions.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>WhatsApp OTP Delivery</strong>: Send one-time passwords directly to users via WhatsApp</li>
<li><strong>Form Plugin Integrations</strong>: Seamless integration with various wordpress form plugins for phone verification</li>
<li><strong>Flexible Phone Input</strong>: Support for both international and national phone number formats</li>
<li><strong>Easy Configuration</strong>: Simple setup through WordPress admin panel</li>
<li><strong>Secure Verification</strong>: Server-side validation ensures secure OTP verification</li>
<li><strong>Rate Limiting</strong>: Built-in protection against abuse (OtpPal.com)</li>
<li><strong>Customizable UI</strong>: Clean, responsive lightbox interface for OTP input</li>
</ul>
<p><strong>Use Cases:</strong></p>
<ul>
<li>Passwordless Logins</li>
<li>Verify phone numbers in contact forms</li>
<li>Prevent spam submissions with phone verification</li>
<li>Ensure legitimate user contact information</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Navigate to <strong>OtpPal > Settings</strong> in your WordPress admin panel</li>
<li>Enter your OtpPal <strong>API key</strong></li>
<li>Choose your preferred <strong>Phone Format</strong>:
<ul>
<li>International: Users enter phone numbers with country code (e.g., +1234567890)</li>
<li>National: Users enter phone numbers without country code (e.g., 1234567890)</li>
</ul>
</li>
<li>If using National format, select a <strong>Default Country</strong> for phone number validation</li>
<li>Click <strong>Save Settings</strong></li>
</ol>
<h3>Usage</h3>
<p>Enable passwordless login by embedding the login button anywhere on your site with the [otppal_login] shortcode.<br />
Add an in-form verifiable phone input using the otppal_phone input, or add a verification modal using the otppal_verify input.<br />
You can customize the appearance of the login button and the verification modal in the plugin’s config.</p>
<p><strong>OtpPal supports CF7, Elementor Pro, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable Forms, SureForms</strong><br />
If you need another integration, please to contact us.</p>
<p>OtpPal will automatically:</p>
<ul>
<li>Initialize the embedded phone widget using your global OtpPal settings (phone format, default country).</li>
<li>Intercept the form submission, open the OTP modal, and only submit after successful verification.</li>
<li>
<p>Write the verified phone number into a hidden field so your form plugin receives it like any other field.</p>
</li>
<li>
<p>Use <strong>either</strong> <code>otppal_phone</code> <strong>or</strong> <code>otppal_verify</code> in a single form – never use both.</p>
</li>
</ul>
<h3>Support</h3>
<p>For support, please visit the plugin’s support forum or contact the plugin author.</p>


OtpPal

Client-side plugin for OtpPal – Send and verify OTPs via WhatsApp.

Rat Two-Factor Authentication vs OtpPal