內容簡介
softenggmanoj Email OTP Login for User Manager 外掛為 WP User Manager 的前端登入表單增加了一個電子郵件驗證步驟。使用者在輸入有效的帳號和密碼後，會收到一次性驗證碼，必須輸入該碼才能完成登入，增強了網站的安全性。
【主要功能】
• 電子郵件一次性密碼 (OTP) 驗證
• 與 WP User Manager 前端登入表單相容
• 六位數 OTP 碼
• OTP 碼以雜湊形式安全儲存
• 可配置的 OTP 到期時間
• 限制錯誤 OTP 嘗試次數
外掛標籤
開發者團隊
② 後台搜尋「softenggmanoj Email OTP Login for User Manager」→ 直接安裝（推薦）
原文外掛簡介
Email OTP Login for User Manager adds an additional email verification step to the frontend login form provided by WP User Manager.
After a user enters valid username and password credentials, the plugin generates a one-time verification code and sends it to the user’s registered email address. The user must enter the verification code before the WordPress login is completed.
The plugin is designed for websites using WP User Manager where additional verification is required for frontend user logins.
Features
Email-based one-time password (OTP) verification.
Works with the WP User Manager frontend login form.
Six-digit OTP codes.
OTP codes are stored securely as hashes.
Configurable OTP expiration period.
Limits the number of incorrect OTP attempts.
Invalidates the OTP after the maximum number of failed attempts.
Prevents the WordPress login from being completed until OTP verification succeeds.
Uses WordPress nonces for OTP form security.
Supports WordPress email delivery through wp_mail().
Administrators and other users logging in through the WP User Manager frontend login can use the OTP verification flow.
Does not modify the standard WordPress wp-login.php authentication flow.
Requirements
WordPress 6.0 or later.
PHP 7.4 or later.
WP User Manager.
The website must have working WordPress email delivery configured. For reliable email delivery, an SMTP plugin or another transactional email service may be used.
Usage
After installation, add the following shortcode to the page that will be used for OTP verification:
[softemot_email_otp_login]
When a user successfully submits their username and password through the WP User Manager frontend login form:
The credentials are validated.
A one-time verification code is generated.
The verification code is sent to the user’s registered email address.
The user is redirected to the OTP verification page.
The user enters the verification code.
The WordPress login is completed only after successful OTP verification.
Security
OTP codes are not stored in plain text. The plugin stores a hash of the generated OTP.
OTP verification attempts are limited. When the maximum number of incorrect attempts is reached, the current OTP is invalidated and the user must start the login process again.
The OTP verification form uses a WordPress nonce to help protect the verification request.
Email Delivery
This plugin uses WordPress’s wp_mail() function to send verification codes.
The plugin does not provide an SMTP mail server. If your website does not reliably send WordPress emails, configure an SMTP plugin or transactional email service separately.
