rishav001

Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.
Features include:
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
Security highlights:
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
Security limitations:
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
Reliability notes:
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>

Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

Forge12 Interactive GmbH

Double Opt-In adds a mandatory email verification step to your Contact Form 7 and Avada forms. 
When a visitor submits your form, the original mail is not sent immediately. Instead, the plugin:
<ol>
<li>Stores the submission in a secure database table.</li>
<li>Sends a confirmation email with a unique, time-limited link.</li>
<li>Only after the visitor clicks that link is the original form mail delivered.</li>
</ol>
This ensures:
<ul>
<li>Only valid, verified email addresses reach your inbox.</li>
<li>GDPR / DSGVO requirements are met with proper consent tracking, IP logging, and data retention.</li>
<li>Your database stays clean and reliable — no fake or mistyped addresses.</li>
</ul>
Seamless integration with Contact Form 7 and Avada Forms. 
Enable Double Opt-In per form, customize confirmation emails with a visual editor, and manage data retention with ease.
<h4>How It Works</h4>
<ol>
<li>A visitor fills out your Contact Form 7 or Avada form and clicks submit.</li>
<li>The plugin intercepts the submission, stores the form data, and generates a unique hash.</li>
<li>A confirmation email is sent to the visitor’s email address containing a verification link.</li>
<li>The visitor clicks the link. The plugin verifies the hash, marks the opt-in as confirmed, and sends the original form mail (as if the form was just submitted).</li>
<li>The confirmed opt-in is logged in the admin dashboard with timestamps and IP addresses for full GDPR compliance.</li>
</ol>
<h4>Quick Start</h4>
<a href="https://www.forge12.com/blog/so-verwendest-du-das-double-opt-in-fuer-contact-form-7/" rel="nofollow ugc">Read the Quick Guide</a>
<h4>Free Features</h4>
<ul>
<li>Visual Email Editor — drag & drop block-based email template editor with live preview and mobile preview</li>
<li>Double Opt-In for Contact Form 7 — per-form activation with full CF7 integration</li>
<li>Double Opt-In for Avada Forms — works with Avada’s built-in form builder (Note: Moving to Pro in version 3.8.0)</li>
<li>Centralized Form Settings — manage all form integrations from a single admin panel</li>
<li>Email Template Presets — choose from pre-built templates or create your own</li>
<li>Send Test Email — preview your confirmation emails before going live</li>
<li>Custom Confirmation Pages — redirect users to a specific page after confirmation</li>
<li>Dynamic Conditions — enable opt-in based on user input (e.g. only when a checkbox is checked)</li>
<li>Resend Confirmation — resend the confirmation email from the admin dashboard</li>
<li>Delete Confirmation Modal — safety dialog before deleting an opt-in record to prevent accidental deletion</li>
<li>GDPR Consent Export — export individual consent records as JSON or CSV directly from the opt-in detail view</li>
<li>CAPTCHA Compatibility — automatically bypasses Forge12 Captcha, Google reCAPTCHA, and hCaptcha during opt-in confirmation to ensure mail delivery</li>
<li>Rate Limiting — configurable IP and email rate limits to prevent abuse</li>
<li>Error Redirect Page — redirect users to a custom page when an opt-in error occurs (rate limit, invalid email)</li>
<li>Token Expiry — confirmation links expire after a configurable time period</li>
<li>GDPR Data Storage — tracks Form ID, Email, Registration/Confirmation Date & IP, Consent Text</li>
<li>GDPR Anonymization — anonymize personal data instead of deleting it</li>
<li>WordPress Privacy Tools — integrates with WordPress personal data export and erasure requests</li>
<li>Automatic Cleanup — configurable auto-deletion of confirmed and unconfirmed entries</li>
<li>Category System — organize opt-ins into categories for better management</li>
<li>Pagination & Search — search and filter opt-in records in the admin dashboard</li>
<li>Admin Tooltips — contextual help tooltips throughout the admin interface</li>
<li>WordPress Multisite — network-wide activation creates tables on all sites automatically</li>
<li>Developer Hooks — 18 action hooks, 23 filters, and 11 typed events for full extensibility</li>
</ul>
<h4>Pro Features</h4>
Unlock the full potential of Double Opt-In with the <a href="https://www.forge12.com" rel="nofollow ugc">Pro version</a>:
Additional Form Integrations:
<ul>
<li>Double Opt-In for Elementor Forms — seamless integration with Elementor’s form widget</li>
<li>Double Opt-In for WPForms — full support for WPForms submissions</li>
<li>Double Opt-In for Gravity Forms — complete Gravity Forms integration</li>
</ul>
Email Validation & Spam Protection:
<ul>
<li>Unique Email Validation — prevent duplicate submissions per email address (block, silent, or redirect mode)</li>
<li>MX Validation — verify that the email domain has a valid mail server before sending</li>
<li>Domain Blocklist — block disposable and temporary email domains</li>
</ul>
Email & Communication:
<ul>
<li>Double Opt-Out System — unique opt-out links per submission with confirmation emails</li>
<li>Opt-In Reminder System — automatic reminders for unconfirmed opt-ins via cron</li>
<li>Conditional Email Templates — dynamic content blocks based on form data</li>
<li>Multi-Column Layouts — 2-column, 3-column, and sidebar layouts in the email editor</li>
<li>Image & Social Blocks — add images and social media icons to your emails</li>
</ul>
Analytics & Export:
<ul>
<li>Analytics Dashboard — charts and statistics for opt-in/opt-out rates</li>
<li>CSV Export — export all opt-in records for external processing</li>
</ul>
User Management:
<ul>
<li>Auto User Creation — automatically create WordPress users after opt-in confirmation with configurable role assignment</li>
</ul>
Support:
<ul>
<li>Premium Support — priority email support</li>
</ul>
<h3>Privacy & Telemetry</h3>
Starting with version 3.1.0, the Double Opt-In plugin includes optional anonymous telemetry (opt-out). 
This helps us understand which features are used most, so we can improve usability and remove unused complexity.
We never sell or share data. 
Telemetry is used only for product improvement and maintenance.
<h4>Telemetry data collected</h4>
<ul>
<li><code>plugin_slug</code>, <code>plugin_version</code></li>
<li><code>snapshot_date</code></li>
<li><code>settings_json</code> (anonymized plugin settings)</li>
<li><code>features_json</code> (enabled features)</li>
<li><code>created_at</code>, <code>first_seen</code>, <code>last_seen</code></li>
<li><code>counters_json</code> (opt-in/opt-out event counts)</li>
<li><code>wp_version</code>, <code>php_version</code>, <code>locale</code></li>
</ul>
<h4>GDPR / DSGVO Compliance</h4>
<ul>
<li>No personal data, no cookies, no user tracking.</li>
<li>Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest — plugin optimization).</li>
<li>Telemetry is fully optional and can be disabled anytime in Double Opt-In > Settings.</li>
</ul>

Double Opt-In for Contact Form 7 & Avada – Secure, GDPR-Compliant Email Verification

Protect your forms with GDPR-compliant Double Opt-In. Ensure valid emails, prevent fake signups, and stay compliant with Contact Form 7 and Avada.

Rishav AuthNova OTP vs Double Opt-In for Contact Form 7 & Avada – Secure, GDPR-Compliant Email Verification