Asif Rahaman

<p><strong>Sparrow Email OTP Verification for Contact Form 7</strong> provides a robust security layer for your website by verifying user email addresses before form submission. This effectively blocks bots, spammers, and malicious actors from flooding your inbox with fake data or invalid leads.</p>
<h3>Why this plugin is different:</h3>
<p>Most existing OTP plugins require you to pay for their proprietary API or use their specific SMTP service to send codes. This often leads to unexpected monthly costs and vendor lock-in.</p>
<p>This plugin is built with a <strong>“Your Server, Your Rules”</strong> philosophy. It sends OTP codes using the native <code>wp_mail()</code> function, meaning it utilizes your website’s default mail configuration or your preferred SMTP service. <strong>There are no extra costs, no hidden fees, and no third-party accounts required.</strong></p>
<h3>Features</h3>
<ul>
<li><strong>Block Bots & Spam:</strong> Ensure every submission comes from a person with a valid, accessible email address.</li>
<li><strong>Conditional Display (New v1.1.0):</strong> Dynamically hide verification elements inside an elegant wrapper box until an email string is typed.</li>
<li><strong>Cost-Effective:</strong> Zero cost to send OTPs—it uses your existing server or SMTP setup.</li>
<li><strong>Privacy First:</strong> No data is sent to external verification APIs; everything stays on your server.</li>
<li><strong>Smart Detection:</strong> Automatically finds the email field in your Contact Form 7 forms.</li>
<li><strong>Security-First Rate Limiting:</strong> Built-in protection to prevent OTP request abuse by limiting users to 3 attempts per 5 minutes per IP address.</li>
<li><strong>Lightweight:</strong> Minimal footprint to ensure your site remains fast and passes Core Web Vitals.</li>
</ul>


Sparrow Email OTP Verification for Contact Form 7

Verify user emails with a secure OTP code to block bots and fake leads. Uses your own SMTP—no API fees, no subscriptions.

rishav001

<p>Rishav AuthNova OTP adds a one-time-password verification layer to core WordPress authentication flows.</p>
<p>Features include:</p>
<ul>
<li>Configurable OTP length and charset (numeric or alphanumeric)</li>
<li>OTP expiry and retry limits with temporary lockouts</li>
<li>Login OTP verification step (after password check)</li>
<li>OTP-gated registration flow</li>
<li>OTP-gated password reset flow</li>
<li>Delivery via wp_mail, SendGrid, and Twilio</li>
<li>OTP storage using hashes (never plaintext)</li>
<li>Resend OTP with cooldown and challenge rotation</li>
</ul>
<p>Security highlights:</p>
<ul>
<li>OTP values are hashed before storage and are never saved as plaintext</li>
<li>OTP hashes use keyed HMAC storage and constant-time verification</li>
<li>OTP challenges expire automatically and enforce retry limits per challenge</li>
<li>Request throttling applies cooldown and exponential backoff per IP and identifier</li>
<li>Lockout windows reduce repeated invalid OTP submissions</li>
<li>Nonces are applied on sensitive form submissions</li>
<li>Public auth responses are intentionally generic to reduce account-enumeration leakage</li>
<li>Delivery uses synchronous-first send with bounded async retry fallback and challenge-level delivery status tracking</li>
</ul>
<p>Security limitations:</p>
<ul>
<li>This plugin does not replace passwords, HTTPS, WAF/rate-limiting at the edge, or secure hosting controls</li>
<li>OTP delivery depends on the configured email/SMS provider uptime and deliverability</li>
<li>Administrators should combine this plugin with standard WordPress hardening and monitoring</li>
</ul>
<p>Reliability notes:</p>
<ul>
<li>OTP delivery is attempted synchronously first to reduce silent failures</li>
<li>If synchronous delivery fails and background delivery is healthy, the plugin schedules bounded retries</li>
<li>If background delivery is unhealthy (for example DISABLE_WP_CRON), fallback queueing is skipped and users receive a retry-safe error</li>
<li>Resend cooldown state is server-authoritative and exposed through a status endpoint used by frontend countdown UX</li>
<li>Background queue payload contains only challenge ID (no raw OTP or destination data)</li>
</ul>
<h3>External Services</h3>
<p>This plugin can connect to third-party services to deliver OTP messages. These services are optional and only used if enabled in plugin settings.</p>
<h4>Twilio (SMS Delivery)</h4>
<ul>
<li>Service: Twilio Programmable Messaging API</li>
<li>Purpose: Send OTP codes by SMS</li>
<li>Data sent: destination phone number, sender phone number, OTP message text, account SID for authentication</li>
<li>Credential handling: Twilio credentials are stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when OTP delivery method includes SMS and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by SMS</li>
<li>Terms of Service: https://www.twilio.com/legal/tos</li>
<li>Privacy Policy: https://www.twilio.com/en-us/legal/privacy</li>
</ul>
<h4>SendGrid (Email Delivery)</h4>
<ul>
<li>Service: SendGrid Mail Send API</li>
<li>Purpose: Send OTP codes by email</li>
<li>Data sent: recipient email address, sender email/name, message subject, OTP message body, API key for authentication</li>
<li>Credential handling: SendGrid API key is stored in WordPress options and used only when sending OTP messages</li>
<li>When sent: when email provider is set to SendGrid and an OTP is generated for login, registration, password reset, or resend</li>
<li>Why sent: to deliver time-sensitive OTP codes to the user by email</li>
<li>Terms of Service: https://sendgrid.com/policies/terms/</li>
<li>Privacy Policy: https://sendgrid.com/policies/privacy/</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Set OTP length, type, expiry, retry limit, and lockout duration.</li>
<li>Choose delivery method: Email, SMS, or Both.</li>
<li>Configure provider credentials for SendGrid and/or Twilio if needed.</li>
<li>Enable or disable OTP on login, registration, and password reset flows.</li>
</ol>


Rishav AuthNova OTP

OTP verification for WordPress login, registration, and password reset using email and SMS delivery.

Sparrow Email OTP Verification for Contact Form 7 vs Rishav AuthNova OTP