rishav001

<p>Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.</p>
<p>Features include:</p>
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
<p>Security highlights:</p>
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
<p>Security limitations:</p>
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
<p>Reliability notes:</p>
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
<p>This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.</p>
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>


Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

XLPlugins

sandeepsoni214

<p>Woocommerce Email Verification plugin verifies the email address of user by sending the verification link to the email of a user at registration time.</p>
<p>Once the user verifies his identity he can login into his account.</p>
<h3>Woocommerce email verification ensures that:</h3>
<ul>
<li>Order you are getting is not a fraud or fake order.</li>
<li>Admin can manually send a verification email to confirm the buyer’s identity.</li>
<li>Fully customisable verification email is sent.</li>
</ul>
<h3>Why use this plugin?</h3>
<ul>
<li>To verify buyer’s identity</li>
<li>Fight Spam</li>
<li>Have additional details in case of Chargebacks</li>
</ul>
<h3>Learn About Our Premium Plugins:</h3>
<blockquote>
<p><a href="https://xlplugins.com/finale-woocommerce-sales-countdown-timer-discount-plugin/?utm_source=woo-confirmation-email&utm_campaign=wp-repo&utm_medium=readme&utm_term=Finale" rel="nofollow ugc">Finale</a> is the ONLY WooCommerce plugin that allows you to create urgency and scarcity inducing promotional campaigns. Urgency and scarcity are both powerful psychological triggers that motivate shoppers to take fast action and avoid missing out.</p>
<p><a href="https://xlplugins.com/woocommerce-thank-you-page-nextmove/?utm_source=woo-confirmation-email&utm_campaign=wp-repo&utm_medium=readme&utm_term=Nextmove" rel="nofollow ugc">Next Move</a> is a powerful plugin for WooCommerce that allows you to build custom Thank You pages to pull more profits.</p>
<p><a href="https://xlplugins.com/woocommerce-sales-triggers/?utm_source=woo-confirmation-email&utm_campaign=wp-repo&utm_medium=readme&utm_term=SalesTriggers" rel="nofollow ugc">Sales Triggers</a> display time-sensitive deals, low stock warnings, potential savings, sales insights & bullet-proof guarantees on product pages. Built to convert skeptical shoppers to confident buyers.</p>
</blockquote>
<h3>Learn About Our Other Free Plugins:</h3>
<blockquote>
<p><a href="https://wordpress.org/plugins/finale-woocommerce-sales-countdown-timer-discount/" rel="ugc">Finale Lite</a><br />
  <a href="https://wordpress.org/plugins/woo-thank-you-page-nextmove-lite/" rel="ugc">Next Move</a><br />
  <a href="https://wordpress.org/plugins/utm-leads-tracker-lite/" rel="ugc">UTM Leads Tracker</a></p>
</blockquote>
<h3>Features:</h3>
<ul>
<li>Native WooCommerce email template</li>
<li>Customisable email template</li>
<li>WPML Compatibility</li>
<li>Merge tags to customise email</li>
</ul>
<blockquote>
<p>Note: Over the last two weeks, we have gone through a lot of pending support tickets, improved codebase and created a list of new features.</p>
<p><a href="https://xlplugins.com/?utm_source=wc-email-verification&utm_campaign=wp-repo&utm_medium=readme" rel="nofollow ugc">XLPlugins</a> has taken over the development of this plugin. We are improving this plugin and will be pushing out new features soon.<br />
  We thank Sandeep Soni for developing this plugin and allowing us to continue its development.</p>
</blockquote>


User Email Verification for WooCommerce

this is an awesome plugin with. I tried several plugins for woocommerce registration but nothing worked. finally, this plugin did the job well.
but only one problem woocommerce new user mail is triggered along with user activation link email there is no option to add delay to woocommerce mail after most of the plugins have this option.

I appreciate it if this option would be added to the next update.
thankyou for the plugin.

Just saved my day!

Woocommerce Email Verification plugin verifies the email address of user by sending the verification link to the email of a user at registration time.

Rishav AuthNova OTP vs User Email Verification for WooCommerce