gpaterno

A lot of web sites, even well known ones (newspapers, telcos, …) adopts 
WordPress as their CMS. WordPress is a great platform, however it 
can happen that password leaking or guessing might lead to unauthorized 
access to the platform. A potential attacker can be therefore able to 
change articles, part of the web site and/or make the website unavailable, 
with image and economic damages for a company or for a blogger. 
This is even more true if your website is not SSL protected.
SecurePass is a SaaS service offering an easy and affordable solution 
for One Time Passwords (OTP) and strong authentication in general. They 
offer 5 users for free included with their standard (=basic) account, which 
is more than enough for standard blogs and web sites. Companies can purchase 
additional users, if needed.
More information on the section “Setup and configure SecurePass” in Other Notes. 
To open a SecurePass account go to http://www.secure-pass.net/open
<h3>Setup and configure SecurePass</h3>
If you don’t own already an account with SecurePass, you can sign-up for a new account here: http://www.secure-pass.net/open
Note: Use “misec2011” as promo code, it will give you an entitlement for using 
SecurePass up to 10 users for 2 years free-of-charge. Without any promo code, 
you will have 5 users for 20 years for free. It depends on what you need (more users or more years).
Connect to the admin interface on https://admin.secure-pass.net 
and create a new device (basically a RADIUS client).
In the admin interface, go to the “Device” section and add a new device. 
You will need to set the public IP Address of the server, a fully qualified 
domain name (FQDN), and the secret password for the radius authentication. 
It’s ok if your web server is behind a firewall and/or NAT, ensure that 
your server has rights to send (and receive) RADIUS authentication requests, 
i.e. UDP port 1812.
<h3>Further reading</h3>
<ul>
<li>
This plugin web site: 
https://github.com/gpaterno/wp-securepass/
</li>
<li>
SecurePass web site: 
http://www.secure-pass.net/
</li>
<li>
UK on-line shop for SecurePass (they sell hardware tokens): 
http://shop.nervinesecurity.com/
</li>
</ul>

SecurePass authentication

This is a plugin to autheticate users through the SecurePass One Time Passwords service.

rijensky

OtpPal lets your WordPress site send and verify OTP (One-Time Password) messages via WhatsApp. This plugin enables secure phone number verification for your WordPress forms, helping prevent spam and ensuring legitimate user submissions.
Key Features:
<ul>
<li>WhatsApp OTP Delivery: Send one-time passwords directly to users via WhatsApp</li>
<li>Form Plugin Integrations: Seamless integration with various wordpress form plugins for phone verification</li>
<li>Flexible Phone Input: Support for both international and national phone number formats</li>
<li>Easy Configuration: Simple setup through WordPress admin panel</li>
<li>Secure Verification: Server-side validation ensures secure OTP verification</li>
<li>Rate Limiting: Built-in protection against abuse (OtpPal.com)</li>
<li>Customizable UI: Clean, responsive lightbox interface for OTP input</li>
<li>Integration Guide: Built-in documentation for every supported form plugin and login option, with a public page and admin access under My OtpPal</li>
</ul>
Use Cases:
<ul>
<li>Passwordless Logins</li>
<li>Verify phone numbers in contact forms</li>
<li>Prevent spam submissions with phone verification</li>
<li>Ensure legitimate user contact information</li>
</ul>
<h3>Configuration</h3>
<ol>
<li>Navigate to OtpPal > Settings in your WordPress admin panel</li>
<li>Enter your OtpPal API key</li>
<li>Choose your preferred Phone Format:
<ul>
<li>International: Users enter phone numbers with country code (e.g., +1234567890)</li>
<li>National: Users enter phone numbers without country code (e.g., 1234567890)</li>
</ul>
</li>
<li>If using National format, select a Default Country for phone number validation</li>
<li>Click Save Settings</li>
</ol>
<h3>Usage</h3>
Enable passwordless login by embedding the login button anywhere on your site with the [otppal_login] shortcode. 
Add an in-form verifiable phone input using the otppal_phone input, or add a verification modal using the otppal_verify input. 
You can customize the appearance of the login button and the verification modal in the plugin’s config.
OtpPal supports CF7, Elementor Pro, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable Forms, SureForms 
If you need another integration, please to contact us.
OtpPal will automatically:
<ul>
<li>Initialize the embedded phone widget using your global OtpPal settings (phone format, default country).</li>
<li>Intercept the form submission, open the OTP modal, and only submit after successful verification.</li>
<li>
Write the verified phone number into a hidden field so your form plugin receives it like any other field.
</li>
<li>
Use either <code>otppal_phone</code> or <code>otppal_verify</code> in a single form – never use both.
</li>
</ul>
Integration Guide
After activation or upgrade, the plugin creates an Integration Guide page on your site (typically at <code>/integration-guide/</code>). You can also embed the guide anywhere with the <code>[otppal_integration_guide]</code> shortcode.
<ul>
<li>Open My OtpPal > Integration Guide in the WordPress admin for step-by-step setup instructions.</li>
<li>Share the public guide URL with your team or customers.</li>
</ul>
<h3>Support</h3>
For support, please visit the plugin’s support forum or contact the plugin author.

OtpPal

Client-side plugin for OtpPal – Send and verify OTPs via WhatsApp.

SecurePass authentication vs OtpPal