gpaterno

<p>A lot of web sites, even well known ones (newspapers, telcos, …) adopts<br />
WordPress as their CMS. WordPress is a great platform, however it<br />
can happen that password leaking or guessing might lead to unauthorized<br />
access to the platform. A potential attacker can be therefore able to<br />
change articles, part of the web site and/or make the website unavailable,<br />
with image and economic damages for a company or for a blogger.<br />
This is even more true if your website is not SSL protected.</p>
<p>SecurePass is a SaaS service offering an easy and affordable solution<br />
for One Time Passwords (OTP) and strong authentication in general. They<br />
offer 5 users for free included with their standard (=basic) account, which<br />
is more than enough for standard blogs and web sites. Companies can purchase<br />
additional users, if needed.</p>
<p>More information on the section “Setup and configure SecurePass” in Other Notes.<br />
To open a SecurePass account go to http://www.secure-pass.net/open</p>
<h3>Setup and configure SecurePass</h3>
<p>If you don’t own already an account with SecurePass, you can sign-up for a new account here: http://www.secure-pass.net/open</p>
<p>Note: Use “misec2011” as promo code, it will give you an entitlement for using<br />
SecurePass up to 10 users for 2 years free-of-charge. Without any promo code,<br />
you will have 5 users for 20 years for free. It depends on what you need (more users or more years).</p>
<p>Connect to the admin interface on https://admin.secure-pass.net<br />
and create a new device (basically a RADIUS client).</p>
<p>In the admin interface, go to the “Device” section and add a new device.<br />
You will need to set the public IP Address of the server, a fully qualified<br />
domain name (FQDN), and the secret password for the radius authentication.<br />
It’s ok if your web server is behind a firewall and/or NAT, ensure that<br />
your server has rights to send (and receive) RADIUS authentication requests,<br />
i.e. UDP port 1812.</p>
<h3>Further reading</h3>
<ul>
<li>
<p>This plugin web site:<br />
https://github.com/gpaterno/wp-securepass/</p>
</li>
<li>
<p>SecurePass web site:<br />
http://www.secure-pass.net/</p>
</li>
<li>
<p>UK on-line shop for SecurePass (they sell hardware tokens):<br />
http://shop.nervinesecurity.com/</p>
</li>
</ul>


SecurePass authentication

This is a plugin to autheticate users through the SecurePass One Time Passwords service.

noplanman

<p>With WP-OTP you can easily set up 2 Factor Authentication with One Time Passwords for your WordPress login.<br />
This extra layer makes your WordPress site a lot more secure.</p>
<p>The new stealth mode allows for invisible OTP code entry, making your login screen look like any other, no extra OTP code input field.</p>
<h4>Getting started</h4>
<p>After installing and activating the plugin, every user can enable WP-OTP on their profile page.</p>
<p>It’s as easy as scanning the provided QR Code or entering the OTP secret to any OTP generator app.<br />
Then just activate it by entering the generated OTP and voilà, all set up.<br />
Now, the login requires an OTP code to succeed.</p>
<p>Each user gets their own secret key to authenticate with, giving them control over their login security.</p>
<h4>Development</h4>
<p>This plugin is completely open source and a work of passion.<br />
If you would like to be part of it and join in, make your way over to the <a href="https://git.feneas.org/noplanman/wp-otp" rel="nofollow ugc">project page</a> now.<br />
Also, if you have an idea you would like to see in this plugin or if you’ve found a bug, please <a href="https://git.feneas.org/noplanman/wp-otp/issues/new" rel="nofollow ugc">let me know</a>.</p>
<h4>Configuration</h4>
<ul>
<li><code>WP_OTP_STEALTH</code>: Set this to <code>true</code> to enable stealth OTP mode.</li>
</ul>
<h4>Filters</h4>
<p>There are a multitude of filters to be adjusted.</p>
<ul>
<li><code>wp_otp_qr_code_provisioning_uri</code>: URI for online QR Code rendering (must contain <code>{PROVISIONING_URI}</code> placeholder for QR Code data).</li>
<li><code>wp_otp_login_form_text</code>: Text for input field on the login screen.</li>
<li><code>wp_otp_login_form_text_sub</code>: Subtext for the input field on the login screen.</li>
<li><code>wp_otp_login_form_invalid_code_text</code>: Error text for an invalid code input on the login screen.</li>
<li><code>wp_otp_code_expiration_window</code>: Set the window of code verification expiration.</li>
<li><code>wp_otp_recovery_codes_count</code>: Number of recovery codes to generate.</li>
<li><code>wp_otp_recovery_codes_length</code>: Length of the recovery codes.</li>
<li><code>wp_otp_secret_length</code>: Length of the secret key.</li>
</ul>
<h4>Minimum requirements</h4>
<p>WordPress 4.6, PHP 7.4.</p>
<h4>Donate / Support</h4>
<p>All <a href="https://noplanman.ch/donate" rel="nofollow ugc">donations</a> are much appreciated, thank you 🙏</p>
<p><a href="https://tidelift.com/subscription/pkg/wordpress-wp-otp?utm_source=wordpress-wp-otp&utm_medium=referral&utm_campaign=readme" rel="nofollow ugc">Get professional support for this plugin with a Tidelift subscription</a><br />
<em>Tidelift helps make open source sustainable for maintainers while giving companies assurances about security, maintenance, and licensing for their dependencies.</em></p>
<h4>Security</h4>
<p>To report a security vulnerability, please use the <a href="https://tidelift.com/security" rel="nofollow ugc">Tidelift security contact</a>. Tidelift will coordinate the fix and disclosure.</p>


WP-OTP

Make your WordPress login extra secure with One Time Passwords.

SecurePass authentication vs WP-OTP