rishav001

<p>Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.</p>
<p>Features include:</p>
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
<p>Security highlights:</p>
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
<p>Security limitations:</p>
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
<p>Reliability notes:</p>
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
<p>This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.</p>
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>


Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

zerobounce

<p>Need an email validation tool to block invalid and high-risk emails on your WordPress website?</p>
<p>The ZeroBounce email verification plugin assists users by validating email addresses entered into your registration forms, comments sections, eCommerce shops, and more. Install the plugin, connect your API key, and select the forms you want to monitor with email validation.</p>
<h3>Key Features</h3>
<ul>
<li><strong>Automated real-time email validation</strong> – Automatically prevent selected email types from creating accounts, leaving comments, or signing up</li>
<li><strong>Detect more than 30+ email address types</strong> – Including invalid, abuse, disposable, spam trap, toxic domains, catch-all, and more</li>
<li><strong>Choose what to accept</strong> – Create your own rules for email validation and disallow emails based on status</li>
<li><strong>Email verification for 9 form types</strong> – Easily select which forms you want to protect with email validation</li>
<li><strong>Fast manual email validation</strong> – Verify any email address in the tools section using our interactive form</li>
<li><strong>Email validation API logs</strong> – Keep track of monthly email verifications, including status, sub-status, IP, date, and credits used</li>
</ul>
<h3>Benefits</h3>
<ul>
<li><strong>Keep your email list clean & accurate</strong></li>
<li><strong>Reduce your email bounce rate</strong></li>
<li><strong>Boost your inbox placement</strong></li>
<li><strong>Protect your email sender reputation</strong></li>
<li><strong>Improve email deliverability</strong></li>
<li><strong>Eliminate fraudulent, untrustworthy shoppers</strong></li>
<li><strong>Block spammers and spoofers</strong></li>
<li><strong>Keep your comments section clean</strong></li>
</ul>
<h3>Supported Forms/Plugins</h3>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Ninja Forms</li>
<li>Formidable Forms</li>
<li>WooCommerce</li>
<li>WordPress Post Comments</li>
<li>WordPress Registration</li>
<li>MC4WP: Mailchimp for WordPress</li>
<li>Gravity Forms</li>
<li>Fluent Forms</li>
<li>WS Forms</li>
<li>Mailster Forms</li>
<li>Forminator Forms</li>
</ul>
<p>And more support is being added gradually.</p>


ZeroBounce Email Verification & Validation


I have tested this plugin on several of my personal and business websites, it's awesome. No more spam and fake signups. Service pricing is also decent. Recommended.


Excellent in blocking SPAM


You have a problem with NF form validation. It detects html fields that contains emails (eg mailto links) as email fields and validates those.



if (!empty($value) && is_string($value) && preg_match('/@.+\./', $value) && !str_contains($value, "\n") && !str_contains($value, '\n')) {// rest of the code}



Your approach needs to be changed to:



if (!empty($value) && is_string($value) && preg_match('/@.+\./', $value) && !preg_match('/mailto:/i', $value)) {  $ninjaForm = new Zerobounce_Email_Validator_Form_Public('ninjaforms', $form_data['id']);   // rest of the code}



This should be safer to validate only email addresses (or use a better regex).


Ninja Forms problem

ZeroBounce validates emails on your WordPress site in real-time, blocking invalid and risky emails to improve deliverability and reduce bounce rates.

Rishav AuthNova OTP vs ZeroBounce Email Verification & Validation