nicunarcisbodea

narcisbodea

<p>SMSTunnel transforms your Android phone into a powerful SMS gateway for WordPress.</p>
<h4>Key Features</h4>
<ul>
<li>Use Your Own Phone – No third-party SMS gateway costs</li>
<li>Two-Factor Authentication – Secure WordPress login with SMS 2FA</li>
<li>End-to-End Encryption – Messages encrypted with RSA keys</li>
<li>Quick Setup – Scan QR code from the mobile app</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to external services to provide certain functionality. Below are the details of each service:</p>
<h4>SMSTunnel API</h4>
<ul>
<li><strong>Purpose</strong>: Core service that enables the plugin to communicate with the SMSTunnel mobile app for sending SMS messages from your phone</li>
<li><strong>When data is sent</strong>: During Quick Setup (when pairing via QR code), when sending SMS messages, and when verifying API connections</li>
<li><strong>Data sent</strong>:
<ul>
<li>During setup: Site URL, site token (random identifier), admin email (for account creation)</li>
<li>When sending SMS: Phone number, message content (encrypted if E2E is enabled), API key for authentication</li>
</ul>
</li>
<li><strong>Service provider</strong>: SMSTunnel.io (NARBOWEB SRL)</li>
<li><strong>Privacy Policy</strong>: https://smstunnel.io/privacy</li>
<li><strong>Terms of Service</strong>: https://smstunnel.io/terms</li>
</ul>
<h4>SMSTunnel Authentication</h4>
<ul>
<li><strong>Purpose</strong>: Optional sign-in via Google, Facebook, or email to link your SMSTunnel account with WordPress</li>
<li><strong>When data is sent</strong>: Only when the admin uses the “Connect with Google/Facebook/Email” options on the plugin settings page</li>
<li><strong>Data sent</strong>:
<ul>
<li>Google/Facebook: Redirects to smstunnel.io/auth/google or smstunnel.io/auth/facebook with a callback URL and CSRF state token</li>
<li>Email login: Email and password sent to smstunnel.io/api/v1/auth/login</li>
<li>After authentication: Fetches user profile from smstunnel.io/auth/me and creates an API key via smstunnel.io/api/v1/api-keys</li>
</ul>
</li>
<li><strong>Service provider</strong>: SMSTunnel.io (NARBOWEB SRL)</li>
<li><strong>Privacy Policy</strong>: https://smstunnel.io/privacy</li>
<li><strong>Terms of Service</strong>: https://smstunnel.io/terms</li>
</ul>
<p><strong>Note</strong>: QR codes are generated locally using an embedded JavaScript library (qrcode.min.js). No external QR code generation services are used. All SMS messages are sent through your own Android phone – the SMSTunnel server only acts as a relay to connect WordPress with your phone.</p>


SMSTunnel

Send SMS messages directly from WordPress using your own Android phone as the SMS gateway.

TechArk Solutions

Yogesh Damasiya

<p>LoginArmor adds an extra layer of protection to WordPress logins by requiring a one-time verification code after a valid username and password are entered.</p>
<h4>Key features</h4>
<ul>
<li>Email-based one-time passcodes for WordPress logins</li>
<li>Apply 2FA to selected user roles</li>
<li>Apply 2FA to specific users</li>
<li>Optional grace period before activation is enforced</li>
<li>Recovery codes for backup access</li>
<li>Customizable email subject and login code email template</li>
<li>Optional debug logging to <code>wp-content/uploads/loginarmor-email-2fa/loginarmor-debug.log</code></li>
<li>Automatic log rotation to prevent unbounded log file growth</li>
<li>Compatible with WordPress application passwords and REST API clients</li>
<li>Dedicated settings screen inside the WordPress admin</li>
</ul>
<h4>How it works</h4>
<ol>
<li>A user enters a valid username and password.</li>
<li>LoginArmor sends a one-time code to the user’s email address.</li>
<li>The user enters the code to complete login.</li>
<li>If needed, the user can use a recovery code instead.</li>
</ol>
<h4>Recovery codes</h4>
<p>The plugin includes recovery codes as a backup login option. Codes are stored securely as hashes in user meta. Plaintext codes are shown only temporarily so users can save or download them once.</p>
<h4>Grace period</h4>
<p>You can optionally set a grace period in days. During the grace period, eligible users can continue signing in while they complete activation. After the grace period ends, 2FA is enforced.</p>
<h4>No external service required</h4>
<p>LoginArmor uses WordPress email delivery and does not require a third-party 2FA service.</p>
<h4>Developer notes</h4>
<p>The plugin exposes a filter for sites running behind a reverse proxy (Cloudflare, load balancers, etc.) that need to supply the real visitor IP:</p>
<pre><code>add_filter( 'la2fa_get_client_ip', function( $ip ) {
    return $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['REMOTE_ADDR'] ?? 'unknown';
} );
</code></pre>
<p>Without this filter the plugin behaves exactly as before — it reads <code>REMOTE_ADDR</code> by default.</p>
<h3>Privacy</h3>
<p>LoginArmor does not connect to an external third-party verification service.</p>
<p>The plugin may process and store the following data on your WordPress site:</p>
<ul>
<li>Email-based one-time passcodes for login verification</li>
<li>Recovery code hashes stored in user meta</li>
<li>Optional debug log entries in <code>wp-content/uploads/loginarmor-email-2fa/loginarmor-debug.log</code></li>
<li>Temporary transients used for login, cooldown, and verification flow</li>
</ul>
<p>This data stays on your site unless your own email delivery system or hosting stack routes it elsewhere.</p>


LoginArmor – Email 2FA


Great plugin! Easy to set up, works exactly as expected, and provides a secure email-based 2FA solution for WordPress. Reliable, lightweight, and user-friendly. Highly recommended!


Good Plugin

Add secure email-based 2FA authentication to WordPress logins with OTP verification, recovery codes, a grace period, and flexible user targeting.

SMSTunnel vs LoginArmor – Email 2FA