內容簡介
ThreeWay Login 外掛替代了標準 WordPress 登入畫面的第一視圖，提供三種明確的登入選擇，增強了安全性與便利性，讓用戶可以選擇使用密碼金鑰、一次性郵件代碼或傳統密碼登入。
【主要功能】
• 提供三種登入選擇：密碼金鑰、郵件代碼、傳統密碼
• 密碼金鑰使用 WebAuthn 標準，抵禦釣魚攻擊
• 郵件代碼在 10 分鐘內過期，且僅可使用一次
• 用戶可在個人資料中管理密碼金鑰
• 自訂登入郵件主旨及邀請文字
外掛標籤
開發者團隊
原文外掛簡介
ThreeWay Login replaces the first view of the standard WordPress login screen with three clear choices:
Continue with a passkey using Face ID, a fingerprint, or the device screen lock
Receive a one-time 6-digit code by email
Use the classic WordPress password form
Before a passkey is configured, administrators can choose whether email code login or the classic username-and-password form is shown first. After a passkey is created, the same browser shows passkey login as the primary choice. The passkey preference is stored only in that browser. The classic WordPress login remains available at all times.
Passkeys use the WebAuthn standard and create phishing-resistant credentials tied to the website. Private passkey keys remain in the user’s device or passkey provider. Only the public credential is stored in WordPress.
Email codes expire after 10 minutes, can be used once, and allow no more than five verification attempts. The plugin uses neutral responses and request limits to reduce account discovery and automated abuse.
The plugin does not create accounts. Every login method works only for an existing WordPress user.
Passkey management
Signed-in users can add and remove passkeys from their WordPress profile. Sites with a custom account area can place the [threeway_login_passkeys] shortcode on a protected page.
After each new login, users without a passkey can see the setup invitation once. They can create a passkey, close the invitation for that login, or choose not to see it again. It is not shown when the user already has a passkey or has permanently dismissed the invitation.
Settings
Open Settings → ThreeWay Login to choose the default method for browsers without a passkey and to customize the login email subject, introductory text, accent color, and passkey invitation.
Requirements
Passkeys require HTTPS and a browser with WebAuthn support. Local development on localhost is also supported.
Email codes are sent through the standard WordPress wp_mail() function. Reliable delivery depends on the website’s email configuration. A properly configured transactional email or SMTP service is recommended.
Security
Passkey ceremonies verify the website origin, relying-party identifier, challenge, user presence, and device user verification. Only ES256 P-256 passkeys are requested and accepted.
Email codes are generated with a cryptographically secure random-number generator, stored only as site-specific HMAC digests, expire after 10 minutes, become invalid after use, and are replaced when a new code is requested.
All successful methods establish a normal WordPress session through WordPress core authentication cookies and fire the standard wp_login action.
Privacy
The plugin does not operate an external service and does not add tracking. Email delivery is handled by WordPress and any mail provider already configured by the website owner.
The plugin registers suggested text with the WordPress Privacy Policy Guide.
