r0bodev

<p>Titan Social Login adds OAuth-based sign-in to WordPress so visitors can use their existing social accounts instead of creating new passwords.</p>
<h4>Included providers</h4>
<ul>
<li>Amazon</li>
<li>Facebook</li>
<li>Google</li>
<li>X (Twitter)</li>
<li>Microsoft</li>
</ul>
<h4>Key features</h4>
<ul>
<li>Adds login buttons to the WordPress login, registration, and lost password screens.</li>
<li>Optional social login on comment forms.</li>
<li>Account linking inside WordPress user profiles.</li>
<li>Shortcodes: [tsl_login], [tsl_account_links].</li>
<li>Popup or same-window authentication, configurable for desktop and mobile.</li>
<li>Custom redirect after login or first registration.</li>
<li>Design controls for layout, spacing, labels, and button styles.</li>
<li>Placeholder emails for providers that do not return an email address.</li>
</ul>
<p>This plugin uses external OAuth providers for authentication. See the “External Services” section for details.</p>
<h4>Privacy</h4>
<p>Titan Social Login does not collect or send any usage telemetry. OAuth requests go directly to the enabled provider during login. The plugin stores its configuration in your WordPress database.</p>
<h4>Additional features in the Pro version</h4>
<ul>
<li>30+ OAuth providers including Apple, Discord, GitHub, Steam, Telegram, Twitch, Spotify, and more.</li>
<li>Premium integrations for WooCommerce, BuddyPress, Ultimate Member, and Easy Digital Downloads.</li>
<li>Statistics dashboard to monitor social login performance.</li>
<li>Premium updates and priority support.</li>
</ul>
<p>Pro version and pricing: <a href="https://titan.r0bo.dev/#pro" rel="nofollow ugc">https://titan.r0bo.dev/#pro</a><br />
Demo: <a href="https://titan.r0bo.dev/wp-login.php" rel="nofollow ugc">https://titan.r0bo.dev/wp-login.php</a></p>
<h3>External Services</h3>
<p>Titan Social Login connects to third-party OAuth providers to authenticate users. Requests are made only when an administrator enables a provider and a user clicks a login button.</p>
<p>Data sent during OAuth:<br />
– Authorization request: client_id, redirect_uri, response_type, scope, state<br />
– Token exchange: code, client_id, client_secret (if required), redirect_uri<br />
– Profile request: access_token</p>
<p>Data received from providers:<br />
– Provider user ID, name, email address, and profile picture (when available)</p>
<p>Services used:<br />
– Google OAuth API (accounts.google.com, oauth2.googleapis.com, www.googleapis.com). Terms: https://policies.google.com/terms Privacy: https://policies.google.com/privacy<br />
– Facebook Login (www.facebook.com, graph.facebook.com). Terms: https://www.facebook.com/legal/terms Privacy: https://www.facebook.com/privacy/policy<br />
– Amazon Login (www.amazon.com, api.amazon.com). Terms: https://www.amazon.com/gp/help/customer/display.html?nodeId=508088 Privacy: https://www.amazon.com/gp/help/customer/display.html?nodeId=468496<br />
– Microsoft identity platform (login.microsoftonline.com, graph.microsoft.com). Terms: https://www.microsoft.com/servicesagreement Privacy: https://privacy.microsoft.com/privacystatement<br />
– X (Twitter) OAuth 2.0 (twitter.com, api.twitter.com). Terms: https://twitter.com/en/tos Privacy: https://twitter.com/en/privacy</p>
<p>No external requests are made unless the provider is enabled and a user initiates login.</p>
<h3>License</h3>
<p>PHP code (and any JS that links to WordPress APIs) is licensed under the GNU General Public License v2.0 or later (GPL-2.0-or-later). See /license.txt.<br />
Brand icons in /assets/images/icons are trademarks of their respective owners and are included for identification purposes only. See /THIRD-PARTY-NOTICES.txt.<br />
Trademarks belong to their respective owners; this plugin is not affiliated with or endorsed by them.</p>


Titan Social Login

One-click social login and account linking for Amazon, Facebook, Google, X (Twitter), and Microsoft.

oskarhane

<p>Secure WordPress login with this two factor auth. Users will have to enter an One Time Password when they log in.</p>
<h4>Why You Need This</h4>
<p>Users can have common or weak passwords that lets hackers/bots brute-force your WordPress site and gain access to your files and place malware there.<br />
Just like happend not that long ago: <a href="http://techcrunch.com/2013/04/12/hackers-point-large-botnet-at-wordpress-sites-to-steal-admin-passwords-and-gain-server-access/" rel="nofollow ugc">Article on TechCrunch</a></p>
<p>If all sites would have used this plugin, this would never happend.<br />
It doesn’t matter how weak your users passwords are, no one can gain access to your WordPress site<br />
without already having access to the users mobile phone or email inbox (depending on how the user gets his OTP).</p>
<h4>How Does It Work?</h4>
<p>This plugin uses the industry standard algorithm <a href="http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm" rel="nofollow ugc">TOTP</a> or <a href="http://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm" rel="nofollow ugc">HOTP</a> for creating One Time Passwords.<br />
A OTP is valid for a certain time and after that a new code has to be entered.</p>
<p>You can now choose to use third party apps like <a href="http://code.google.com/p/google-authenticator/" rel="nofollow ugc">Google Authenticator</a> which is available for most mobile platforms. You can really use any<br />
third party app that supports TOTP/HOTP that generates 6 digits OTP’s.<br />
Or, as before, you can choose to get your One Time Passwords by email.</p>
<p>Since you have to enter a secret code to third party apps, email is the default way of delivering One Time Passwords. Your<br />
users will have to activate delivery by third party apps themselves.</p>
<h4>Easy To Use</h4>
<p>Just install this plugin and you’re all set. There’s really nothing more to it.<br />
If you want to use a third party app, goto Two Factor Auth in the admin menu and activate it and set up your app.<br />
General settings can be found uner Settings -> Two Factor Auth in admin menu. Settings for each individual user<br />
can be found at the root level of the admin menu, in Two Factor Auth.<br />
A bit more work to get logged in, but a whole lot more secure!</p>
<p>If you use WooCommerce or other plugins that make custom login forms, you will not be able to login through those anymore.<br />
I will be adding a plugin that puts a One Time Password field to WooCommerce. If you use some other plugin that needs<br />
support for this, let me know in the support forum.</p>
<h4>TOTP or HOTP</h4>
<p>Which algorithm you and your users choose doesn’t really matter. The time based TOTP is a bit more secure since a One Time<br />
Password is valid only for a certain amount of time. But this requires the server time to be in sync the clients time (if<br />
the OTP isn’t delivered by email). This is often hard to do with embedded clients and the event based HOTP is then a better choice.<br />
If you have a somewhat slow email server and have chosen email delivery, you might not get the TOTP in time.</p>
<p>Conslusion: Choose which ever you want. TOTP is a little bit safer since OTP:s only are valid for a short period.</p>
<p>Note that email delivery users always uses the site default algorithm, which you can set on the settings page. Third party<br />
apps users can choose which one they want.</p>
<h4>Is this really Two Factor Auth?</h4>
<p>Before version 3.0 this plugin had ‘kind of’ two factor auth where the OTP was delivered to an email address.<br />
Since version 3.0 you can have real two factor auth if you activate the Third Party Apps delivery type.</p>
<p>Read more about <a href="http://oskarhane.com/two-factor-auth-explained/" rel="nofollow ugc">what two factor auth means >></a>.</p>
<p>See http://oskarhane.com/plugin-two-factor-auth-for-wordpress/ for more info.</p>


Two Factor Auth

Secure WordPress login with Two Factor Auth. Users will have to enter an One Time Password when they log in.

Titan Social Login vs Two Factor Auth