rishav001

<p>Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.</p>
<p>Features include:</p>
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
<p>Security highlights:</p>
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
<p>Security limitations:</p>
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
<p>Reliability notes:</p>
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
<p>This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.</p>
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>


Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

quickemailverification

<p>An email verification plugin by <a href="http://quickemailverification.com" rel="nofollow ugc">QuickEmailVerification</a> enables you to validate and verify the email address existence in real time, before you actually send them an email. Its unique email verification system is composed of multiple different validations starting from syntax checking to the end users’ mailbox existence checking. It not only detects invalid email addresses but also detects many other types of poor email addresses which could negatively impact the email deliverability and harm your sender reputation.</p>
<p>This plugin need a QuickEmailVerification API key to verify. You can get it from <a href="https://quickemailverification.com/apisettings" title="Get your API key" rel="nofollow ugc">API settings</a> page of QuickEmailVerification service.</p>
<h4>Key features</h4>
<ul>
<li>Email address syntax checking</li>
<li>Domain/MX records checking</li>
<li>Role address detection</li>
<li>Disposable email address (DEA) detection</li>
<li>Free email service detection</li>
<li>Typo detection and suggestion</li>
<li>Accept all email checking</li>
<li>Mailbox existence checking</li>
</ul>
<h4>Supported form Plugins</h4>
<ul>
<li>Contact Form 7</li>
<li>Formidable forms</li>
<li>Ninja forms</li>
<li>WooCommerce</li>
<li>WPForms</li>
<li>Profile Builder</li>
<li>Contact Form by BestWebSoft</li>
<li>Ultimate Member registration form</li>
<li>Fluent Forms</li>
<li>WPEverest forms</li>
<li>MailPoet</li>
<li>Theme My Login</li>
<li>WP-Members</li>
<li>Visual Form Builder</li>
<li>PlanSo forms</li>
<li>Buddypress registration form</li>
<li>Any other form which uses the is_email() function</li>
</ul>
<p>This plugin works either with “is_email()” function or with any other supported form plugins. So if any supported form plugin is enabled, “is_email()” hook will automatically be disabled.</p>
<p>To know more about email verification results, please have a look at the <a href="http://docs.quickemailverification.com/getting-started/understanding-email-verification-result" rel="nofollow ugc">QuickEmailVerification knowledge base</a>.</p>


QuickEmailVerification

The QuickEmailVerification email verification plugin to avoid fake, bad and nonexistent emails.

Rishav AuthNova OTP vs QuickEmailVerification