gpaterno

A lot of web sites, even well known ones (newspapers, telcos, …) adopts 
WordPress as their CMS. WordPress is a great platform, however it 
can happen that password leaking or guessing might lead to unauthorized 
access to the platform. A potential attacker can be therefore able to 
change articles, part of the web site and/or make the website unavailable, 
with image and economic damages for a company or for a blogger. 
This is even more true if your website is not SSL protected.
SecurePass is a SaaS service offering an easy and affordable solution 
for One Time Passwords (OTP) and strong authentication in general. They 
offer 5 users for free included with their standard (=basic) account, which 
is more than enough for standard blogs and web sites. Companies can purchase 
additional users, if needed.
More information on the section “Setup and configure SecurePass” in Other Notes. 
To open a SecurePass account go to http://www.secure-pass.net/open
<h3>Setup and configure SecurePass</h3>
If you don’t own already an account with SecurePass, you can sign-up for a new account here: http://www.secure-pass.net/open
Note: Use “misec2011” as promo code, it will give you an entitlement for using 
SecurePass up to 10 users for 2 years free-of-charge. Without any promo code, 
you will have 5 users for 20 years for free. It depends on what you need (more users or more years).
Connect to the admin interface on https://admin.secure-pass.net 
and create a new device (basically a RADIUS client).
In the admin interface, go to the “Device” section and add a new device. 
You will need to set the public IP Address of the server, a fully qualified 
domain name (FQDN), and the secret password for the radius authentication. 
It’s ok if your web server is behind a firewall and/or NAT, ensure that 
your server has rights to send (and receive) RADIUS authentication requests, 
i.e. UDP port 1812.
<h3>Further reading</h3>
<ul>
<li>
This plugin web site: 
https://github.com/gpaterno/wp-securepass/
</li>
<li>
SecurePass web site: 
http://www.secure-pass.net/
</li>
<li>
UK on-line shop for SecurePass (they sell hardware tokens): 
http://shop.nervinesecurity.com/
</li>
</ul>

SecurePass authentication

This is a plugin to autheticate users through the SecurePass One Time Passwords service.

Khubaib Mehmood

Tired of cleaning up fake user registrations from spam bots? KhubaibTech OTP Registration Shield is a lightweight yet powerful security plugin that adds a crucial layer of verification to your WordPress registration form.
Instead of relying on complex CAPTCHAs, this plugin requires users to prove they have access to the email address they are using. It’s a simple, user-friendly process that is incredibly effective at blocking automated spam bots.
How It Works
<ol>
<li>A “Verification Code” field is added to your default WordPress registration form.</li>
<li>The user enters their username and email, then clicks “Send Verification Code.”</li>
<li>A secure one-time password (OTP) is sent to their email.</li>
<li>The user enters the code to complete their registration.</li>
</ol>
This ensures that only users with valid, accessible email addresses can register, drastically reducing spam and improving the quality of your user base.
Key Features:
<ul>
<li>Blocks Spam Bots: Stops automated scripts that create fake user accounts.</li>
<li>Verifies Real Emails: Ensures that every registered user has a valid email address.</li>
<li>Simple for Users: A clean, straightforward verification step.</li>
<li>Lightweight & Secure: No heavy scripts or third-party dependencies. Uses secure WordPress transients and nonces.</li>
<li>Customizable Email: Easily edit the email subject and body from the settings page.</li>
<li>Seamless Integration: Works automatically with the default WordPress registration form.</li>
</ul>

KhubaibTech OTP Registration Shield

Protect your WordPress registration form from spam bots by requiring new users to verify their email with a secure one-time code.

SecurePass authentication vs KhubaibTech OTP Registration Shield