rishav001

<p>Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.</p>
<p>Features include:</p>
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
<p>Security highlights:</p>
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
<p>Security limitations:</p>
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
<p>Reliability notes:</p>
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
<p>This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.</p>
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>


Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

ipqualityscore

<p>IPQualityScore Fraud Detection and Fraud Prevention Tools identify malicious behavior and fraudulent activity on your site. These features include Proxy & VPN Detection, Email Address Verification, Disposable Email Detection, Device Fingerprinting, & Payment Screening. This plugin can work on any page of your site and also supports scoring WooCommerce transactions to prevent fraudulent orders and even fake submissions with Gravity Forms.</p>
<p>Block bots & users hiding behind proxies, spoofed connections, and invalid email addresses. Automate quality control, prevent frequent abusers, fraudulent orders, and instantly improve your user quality!</p>
<h4>Validate Page Hits, Registrations, Logins, Comments, and Transactions</h4>
<p>Use the plugin settings to deploy fraud fighting tools on important parts of your WordPress site including all pages or specifically selected pages & posts. Validate page loads, user registrations, logins, and comments by checking if the user is behind a proxy or VPN connection, using an invalid email, or using a disposable email service. Additionally, score transactions through WooCommerce to prevent chargebacks.</p>
<h4>Block Proxies & Anonymized Connections</h4>
<p>Accurately prevent and block low quality connections that are frequently used by abusers and malicious users. Minimize false-positives so your site’s user experience is not negatively impacted.</p>
<h4>Block Bots & Non-Human Traffic</h4>
<p>Easily filter bots and non-human traffic which may be causing click fraud, fake account, SPAM, or fraudulent orders. IPQS can filter bots in real-time to only allow real human traffic to your site.</p>
<h4>5,000 FREE Lookups Per Month</h4>
<p>Perfect for sites and companies of all sizes, all IPQualityScore accounts get 5,000 FREE queries per month to evaluate our service and block fraudulent users.</p>
<h4>WooCommerce Order Support</h4>
<p>IPQualityScore’s plugin optionally supports WooCommerce transactions to block or flag suspicious orders that are likely to result in a chargeback. Receive a Real-Time Fraud Score for each order based on billing and shipping details, IP reputation, email reputation, device reputation, transaction details, and similar factors which combine into a highly accurate risk profile. Learn more about how we fight and prevent <a href="https://www.ipqualityscore.com/solutions/payment-fraud" rel="nofollow ugc">Payment Fraud</a>.</p>
<h4>Prevent Fraudulent Behavior & Abuse</h4>
<ul>
<li>Fraud Prevention & Fraud Scoring</li>
<li>The Most Accurate Proxy Detection Including VPN & Tor Detection</li>
<li>Email Address Verification and Disposable Email Detection</li>
<li>Device Fingerprinting – Detect Compromised and Spoofed Devices</li>
<li>Machine Learning Algorithm Tailored to Your Audience</li>
<li>Custom Rules, Whitelisting, & Blacklisting</li>
<li>Email Alerts for Fraudulent Actions</li>
<li>Supports WooCommerce Transactions</li>
<li>Blocks Fake & Fraudulent Orders</li>
<li>5,000 Free Queries Per Month</li>
<li>Supports Gravity Forms</li>
</ul>
<h4>Get a Free Account</h4>
<p>Protect your site from fraud and abuse, create a free account at <a href="https://www.ipqualityscore.com/create-account" title="https://www.ipqualityscore.com/create-account" rel="nofollow ugc">https://www.ipqualityscore.com/create-account</a> or register directly through the plugin!</p>
<h4>Third Party Services</h4>
<p>This plugin uses <a href="https://developers.google.com/chart/" rel="nofollow ugc">Google Charts</a> to display data in graphs, such as lookups, transactions, and score breakdowns.</p>


IPQualityScore Fraud Detection

IPQualityScore Fraud Detection and Fraud Prevention Tools identify malicious behavior and fraudulent activity featuring Proxy & VPN Detection &amp …

Rishav AuthNova OTP vs IPQualityScore Fraud Detection