內容簡介
ShivWeb Login Verification 為您的 WordPress 登入流程增加雙重驗證（2FA），透過電子郵件發送登入代碼，確保即使密碼被竊取，未經授權的使用者也無法登入。此外掛無需設置身份驗證應用程式或外部服務，簡化了安全性流程。
【主要功能】
• 透過電子郵件提供雙重驗證代碼
• 角色基礎的驗證設定
• 完全支援 WooCommerce 登入流程
• 記住信任的裝置，減少重複驗證
• 新註冊用戶的電子郵件驗證
• 自訂電子郵件模板與螢幕訊息
外掛標籤
開發者團隊
原文外掛簡介
ShivWeb Login Verification adds two-factor authentication (2FA) to your WordPress login using email codes. A user signs in with their password as usual, then the plugin emails them a short login code and holds the session until the code is entered. Someone who has stolen a password but cannot open the user’s inbox stays locked out.
There is no authenticator app to set up, no external service to sign up for, and no API keys. Codes are sent through your site’s own email, so any SMTP plugin you already use handles delivery, and everything runs on your server.
How a login works
The user enters their username and password as normal.
The plugin emails them a one time code (OTP) and holds the session.
They type the code on the verification screen and continue exactly where they were going.
Choose who needs a code
Enforcement is role based. Tick the roles that should verify and leave the rest alone. By default only the Customer role is gated, so a store can protect shopper accounts without changing how the team logs in. Users can also mark a browser as trusted for a number of days you choose, so regulars are not asked for a code on every visit.
Built so you cannot lock yourself out
Enforcement stays off until you prove email delivery works: the plugin asks you to send yourself a test code and enter it before the feature can be switched on. So a broken mailer can never lock everyone out. And if anything ever goes wrong later, one line in wp-config.php or one WP-CLI command turns everything off and releases every held session immediately.
Works with WooCommerce, including the block checkout
Most login verification plugins add a field to the login form. The WooCommerce block checkout never shows that field, because it signs customers in through the Store API in the background. This plugin works differently: it verifies the session after login, on the server, so wp-login.php, wp-admin, My Account, the classic checkout and the block checkout are all covered by the same check. Nothing depends on the browser, so it cannot be skipped by calling an endpoint directly.
Email verification at registration
Optionally require new sign-ups to confirm their email address with a code before their first session works. A small popup verifies the address right on the register form, checkout registrations are verified just after, and abandoned unverified accounts are cleaned up automatically after a grace period.
Features
Two-factor authentication with email login codes, no authenticator app needed
Role based enforcement: choose exactly which user roles must verify
WooCommerce ready: My Account, classic checkout, and the block checkout
Trusted devices: remember a browser for a number of days you choose
Email verification for new registrations, with automatic cleanup
Rate limiting on every layer: resend cooldown, attempt lockout, and per-account send caps
Customizable email template and on-screen messages
No external service, no API keys, no per-message fees, no tracking
Recovery built in: a wp-config.php constant and WP-CLI commands
Recovery
If you ever lock yourself out, add define( 'SWLV_DISABLE_OTP', true ); to wp-config.php, or run wp swlv disable with WP-CLI. Both release every held session immediately. To unstick a single user (send limit reached, mailbox typo), run wp swlv reset-user
