內容簡介
Logliy - Login Protect 提供多種安全的登入方式，包括 Passkeys、電子郵件一次性密碼和魔法連結，並支援選擇性單一登入（SSO）。此外掛專注於登入方法的安全性，並不包含完整的安全套件功能。
【主要功能】
• 支援 Passkey 登入與註冊
• 電子郵件 OTP 登入
• 魔法連結登入
• 選擇性 SSO 登入
• 自訂登入 URL 選項
• 會話長度與管理員閒置超時設定
外掛標籤
開發者團隊
② 後台搜尋「Logliy – Login Protect (Passkey, Email, SSO)」→ 直接安裝（推薦）
原文外掛簡介
Logliy – Login Protect controls how users sign in: Passkeys (WebAuthn) first, with Email one-time codes and Magic Links as fallback, plus optional SSO (OpenID Connect) and an optional password path.
It is not a security suite and not a generic OTP plugin. Keep Wordfence (or similar) for WAF, brute-force lockouts, CAPTCHA, malware scanning, and classic TOTP 2FA. Logliy is the login-method layer on top.
Features
Passkey login and registration (discoverable credentials, Conditional UI where available)
Email OTP login via wp_mail
Magic link (one-click email) login
Optional SSO via OpenID Connect (shown on the login form only when fully configured)
Password login off by default, re-enable site-wide and/or per role / per user
Role-based login/logout redirects
Optional custom login URL (auto-disabled if WPS Hide Login or similar is active)
Session length, Remember-me duration, admin idle timeout, logout everywhere
Users overview (Passkeys + last login)
Optional custom login logo, brand, background, and footer
Modern login UI on wp-login.php
WooCommerce classic + Blocks My Account/Checkout login forms
Cloudflare Turnstile compatible (verifies tokens on Passkey / Email OTP / Magic Link / SSO login)
REST API namespace logliy/v1
Rate limits for OTP, Passkey, and SSO auth
Wordfence-friendly: fires wp_login_failed / wp_login and uses normal auth cookies
Emergency override: define( 'LOGLIY_ALLOW_PASSWORD', true ); in wp-config.php
Wordfence compatibility
Failed Logliy attempts trigger wp_login_failed so Wordfence lockouts still apply
Successful Logliy logins use wp_set_auth_cookie + wp_login like a normal wp_signon
Wordfence IP lockouts still run during passwordless login; Wordfence Login Security 2FA is skipped for Passkey / Email OTP / Magic Link / SSO (those methods already replace the password)
Wordfence TOTP 2FA continues to apply on the classic password path
Logliy does not remove Wordfence hooks globally — only suspends LS 2FA for the passwordless completion step
Cloudflare Turnstile
When Simple CAPTCHA with Cloudflare Turnstile (or equivalent) is enabled on the WordPress login form, Logliy requires a valid Turnstile token for Email OTP, Passkey, Magic Link, and SSO login. The password path continues to use the Turnstile plugin’s own authenticate check.
WooCommerce
Classic My Account and Checkout login templates
Guest checkout unchanged
Does not block WooCommerce REST / Store API authentication
Optional panel above Checkout and Customer Account blocks for guests
Requirements
PHP 8.1+
WordPress 6.4+
HTTPS for Passkeys (localhost allowed for development)
Composer production dependencies are vendored in release builds (vendor-prefixed/)
External services
This plugin can contact Cloudflare Turnstile only when a compatible Turnstile plugin is active and configured for the WordPress login form. Logliy does not load Turnstile by itself.
When a visitor completes passwordless login (Passkey, Email OTP, Magic Link, or SSO) while Turnstile is required, Logliy sends the Turnstile response token and the visitor IP to Cloudflare’s siteverify API so the challenge can be validated. No other personal data is sent to Cloudflare by Logliy.
This service is provided by Cloudflare: Terms of Use and Privacy Policy.
When SSO (OpenID Connect) is enabled, Logliy contacts the OpenID Provider you configure (Issuer / discovery, token, and JWKS URLs) so visitors can sign in with that identity provider. Logliy does not send login data to FloBa Media. The identity provider receives standard OpenID Connect authentication data (such as the authorization request and, after sign-in, token exchange). Which personal data that provider stores is defined by that provider.
You must register this site’s Redirect URI at the provider and accept that provider’s own terms of service and privacy policy before enabling SSO.
