[WordPress] 外掛分享： Delowar OTP Login and Two-Factor Authentication

外掛標籤

開發者團隊

📦 歷史版本下載

1.0.3trunk

原文外掛簡介

One Time Password (OTP) Login & Two Factor Authentication (2FA) is a powerful, secure, and modern authentication platform designed for WordPress and WooCommerce.
Empower your visitors to log in instantly without passwords, safeguard administrator and member accounts with multi-channel Two-Factor Authentication (2FA), and protect your WooCommerce store against fake orders and COD fraud through real-time SMS & WhatsApp phone verification.
Designed with an elegant, responsive Sky Blue SaaS user interface, high-performance database indexing, and bank-grade cryptographic standards, Delowar OTP Login & 2FA provides a seamless experience for both users and site administrators.
🚀 Key Features

⚡ Passwordless OTP Login: Allow members to log in instantly using an email address or mobile phone number via secure, single-use passcodes.
📝 OTP Account Registration: Clean multi-step user registration with real-time phone/email verification and automatic role assignment.
🛡️ Universal Two-Factor Authentication (2FA):

TOTP Authenticator Apps: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and Apple Keychain.
SMS & WhatsApp 2FA: Send verification codes directly to the user’s mobile device.
Email 2FA: Reliable fallback delivery via WordPress standard email.
Role-Based Enforcement: Mandate 2FA for Administrators, Editors, or all user roles.
Remember Trusted Devices: Optional 30-day device trust to balance convenience with top-tier security.
Emergency Backup Codes: Single-use cryptographic recovery codes for account recovery if a device is lost.

🛒 WooCommerce Checkout Phone Verification:

Inline or popup verification card on the checkout page.
Require verification for Guest buyers, Logged-in customers, or both.
Automatically bypass verification for previously verified customer accounts.
Admin order verification status badge inside the WooCommerce Orders screen.
Drastically reduce Cash on Delivery (COD) order fraud and spam checkout submissions.

📲 Multi-Channel Delivery Providers:

SMS Gateways: Twilio, Vonage (Nexmo), MSG91, and a Universal Custom HTTP / Webhook Gateway.
WhatsApp Gateways: Twilio WhatsApp API & Meta (Facebook) Cloud WhatsApp Business API.
Email: Native WordPress wp_mail with customizable HTML templates.

🌐 Universal Custom HTTP / Webhook SMS Gateway:

Connect any local or global SMS gateway provider in the world!
Full support for HTTP GET and POST methods (JSON or Form URL-encoded).
Configurable custom HTTP request headers (Bearer tokens, API keys, basic auth).
Dynamic placeholders: {phone}, {otp}, and {message}.

🔒 Bank-Grade Cryptographic Security:

CSPRNG Generation: Generated via cryptographically secure random integers (random_int).
Salted Hashes Only: All OTPs are stored strictly as salted SHA-256 hashes (wp_hash()). Zero plaintext tokens exist in the database.
Constant-Time Verification: Verification uses hash_equals() to prevent timing side-channel attacks.
Sliding-Window Rate Limiting: Multi-tiered rate limiters protecting against IP-based and identifier-based brute-force attempts.
Configurable Cooldowns & Expirations: Set custom token lifetimes (e.g. 5 minutes) and resend wait times.

🎨 Modern SaaS UI / UX:

Smooth segmented 6-digit input boxes with auto-focus, backspace jumping, and paste handling.
Country flag and international dial code picker with auto-detection.
Live circular countdown timers for OTP expiry and resend cooldowns.
Dark mode compatibility and customizable brand accent colors.

📊 Comprehensive Audit Logging:

Detailed logs tracking all authentication events (login_success, login_failed, otp_sent, 2fa_challenged, totp_verified, order_verified).
Filter logs by date range, channel, provider, status, or search identifier.
One-click CSV export and automated daily log retention pruning.

🧪 Developer Friendly & Test Mode:

Built-in Test Mode with dispatch simulation to test entire authentication flows without consuming SMS credits.
Clean, modular object-oriented codebase adhering to WordPress Coding Standards (WPCS).

📦 Supported Channels & Gateways

SMS Gateways:

Twilio: Global enterprise SMS delivery.
Vonage (formerly Nexmo): Reliable worldwide SMS messaging.
MSG91: High-speed SMS delivery for India and international routes.
Custom HTTP / Webhook Gateway: Connect any regional gateway (e.g., RouteMobile, Infobip, Textlocal, Sinch, Mobily, etc.).

WhatsApp Business API:

Twilio WhatsApp: Official Twilio WhatsApp Messaging Sandbox & Production.
Meta Cloud WhatsApp Business API: Direct integration with Meta Graph API.

Authenticator Apps (TOTP):

Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, Duo.

Email Delivery:

WordPress native wp_mail() compatible with SMTP plugins (WP Mail SMTP, Post SMTP, FluentSMTP).

External services
This plugin connects to external third-party messaging services to deliver One-Time Passcodes (OTP) via SMS and WhatsApp. The plugin only connects to an external service when that specific provider is configured with API credentials and enabled by the site administrator:

Twilio (SMS & WhatsApp):

What it is and what it is used for: Connects to the Twilio REST API (api.twilio.com) to send One-Time Passcode (OTP) SMS text messages and WhatsApp messages for passwordless login, user registration, Two-Factor Authentication (2FA), and WooCommerce checkout phone verification.
What data is sent and when: Sends the recipient’s mobile phone number, sender ID/phone number, and the OTP verification message text. Data is transmitted to Twilio (api.twilio.com) only when Twilio SMS or Twilio WhatsApp is actively configured by the site administrator and an OTP verification code is requested by a user or customer.
Service Provider: Twilio Inc.
Terms of Service: Twilio Terms of Service
Privacy Policy: Twilio Privacy Policy

Vonage (formerly Nexmo) SMS:

What it is and what it is used for: Connects to the Vonage SMS API (rest.nexmo.com) to send One-Time Passcode (OTP) SMS text messages for passwordless login, user registration, Two-Factor Authentication (2FA), and WooCommerce checkout phone verification.
What data is sent and when: Sends the recipient’s mobile phone number, sender brand/ID, and the SMS message text containing the temporary one-time numeric passcode. Data is transmitted to Vonage (rest.nexmo.com) only when Vonage is actively configured by the site administrator and an OTP verification code is requested by a user.
Service Provider: Vonage Holdings Corp. (Ericsson)
Terms of Service: Vonage Terms of Use
Privacy Policy: Vonage Privacy Policy

MSG91 SMS:

What it is and what it is used for: Connects to the MSG91 OTP API (control.msg91.com) to send One-Time Passcode (OTP) SMS text messages for passwordless login, user registration, Two-Factor Authentication (2FA), and WooCommerce checkout phone verification.
What data is sent and when: Sends the recipient’s mobile phone number, OTP numeric passcode, and optional template identifier. Data is transmitted to MSG91 (control.msg91.com) only when MSG91 is actively configured by the site administrator and an OTP verification code is requested by a user.
Service Provider: Walkover Technologies Pvt. Ltd.
Terms of Service: MSG91 Terms of Use
Privacy Policy: MSG91 Privacy Policy

Meta WhatsApp Cloud API (WhatsApp Business Platform):

What it is and what it is used for: Connects to the Meta Graph API (graph.facebook.com) to dispatch official WhatsApp authentication template messages containing one-time passcodes for passwordless login, user registration, Two-Factor Authentication (2FA), and WooCommerce checkout phone verification.
What data is sent and when: Sends the recipient’s mobile phone number, approved WhatsApp template name, language code, and the dynamic OTP passcode parameter. Data is transmitted to Meta (graph.facebook.com) only when Meta WhatsApp Cloud API is actively configured by the site administrator and an OTP verification code is requested by a user.
Service Provider: Meta Platforms, Inc.
Terms of Service: WhatsApp Business Terms and Meta Platform Terms
Privacy Policy: WhatsApp Privacy Policy and Meta Privacy Policy

Universal Custom HTTP / Webhook SMS Gateway (User-Configured):

What it is and what it is used for: Allows website administrators to integrate any arbitrary third-party SMS gateway or REST API endpoint (such as regional or custom SMS providers) to deliver OTP verification messages.
What data is sent and when: Sends the recipient’s mobile phone number and the OTP verification message text according to the custom endpoint URL (e.g. https://api.example.com/...), HTTP method (GET/POST), request headers, and payload template configured by the administrator. Data is transmitted to the administrator’s designated third-party endpoint only when the Custom HTTP Gateway is selected and an OTP verification request is triggered.
Service Provider: Governed by the respective third-party SMS gateway vendor selected and contracted by the site administrator.
Terms of Service & Privacy Policy: Users and site administrators should consult the terms of use and privacy policy of their configured SMS gateway provider.

Shortcodes
Easily embed forms anywhere on your site using WordPress blocks, Elementor, Divi, or standard shortcodes:

[delowar_otp_login] – Renders the Passwordless OTP Login form.

redirect: Target URL after successful login. (Example: [delowar_otp_login redirect="/my-account/"])
title: Custom form heading. (Example: [delowar_otp_login title="Member Sign In"])

[delowar_otp_register] – Renders the OTP Account Registration form.

redirect: Target URL after account creation. (Example: [delowar_otp_register redirect="/welcome/"])
title: Custom form heading.

[delowar_otp_2fa] – Standalone 2FA challenge form for custom login portals.

[delowar_otp_security] – User profile 2FA dashboard where logged-in members can configure Authenticator Apps (QR code setup), view trusted devices, and generate single-use emergency backup recovery codes.

[delowar_otp_phone_verify] – Standalone mobile phone number verification widget.