WordPress.org
Get WordPress

Plugin Directory

Changeset 3482413


Ignore:
Timestamp:
03/14/2026 08:52:06 AM (3 weeks ago)
Author:
konceptwise
Message:

readme file update

File:
1 edited

Legend:

Unmodified
Added
Removed

  • authyo-passwordless-login/trunk/readme.txt

    r3457064 r3482413  
    11=== Authyo Passwordless Login ===
    22Contributors: konceptwise
    3 Tags: passwordless login, otp login, email otp, wordpress login, secure login
     3Tags: otp login, passwordless login, wordpress otp, email otp, two factor authentication
    44Requires at least: 5.0
    55Tested up to: 6.9
    … …  
    99License URI: https://www.gnu.org/licenses/gpl-2.0.html
    1010
    11 Enable secure passwordless login for WordPress using email OTP. Users log in without passwords via one-time codes sent by Authyo.
    12 
     11Enable secure OTP login for WordPress with passwordless authentication using email-based one-time passwords (OTP) powered by Authyo.
    1312
    1413== Description ==
    1514
    16 Authyo Passwordless Login enables a modern, secure passwordless authentication system for WordPress using email-based one-time passwords (OTP).
    17 Users simply enter their email address, receive an OTP via email, verify the code, and are automatically logged in — no passwords required at any stage.
    18 
    19 This plugin is officially developed and maintained by Konceptwise Digital Media Pvt. Ltd. and uses Authyo’s secure OTP authentication services.
    20 
    21 
    22 = Key Features =
    23 
    24 * Fully passwordless WordPress login using email OTP
     15Authyo Passwordless Login enables secure **OTP login for WordPress** using email-based one-time passwords. It replaces traditional passwords with a modern **passwordless authentication system** that improves login security and simplifies the user experience.
     16
     17Users simply enter their email address, receive a one-time password (OTP), verify the code, and are automatically logged in — no passwords required.
     18
     19This plugin is officially developed and maintained by **Konceptwise Digital Media Pvt. Ltd.** and uses **Authyo's secure OTP authentication infrastructure**.
     20
     21With Authyo Passwordless Login, WordPress administrators can implement **passwordless login**, improve **account security**, and eliminate risks related to password leaks or weak credentials.
     22
     23== Key Features ==
     24
     25* Passwordless login for WordPress using email OTP
    2526* No passwords stored or required
    26 * Secure token-based authentication (single-use, time-limited)
    27 * OTP delivered via Authyo’s secure email service
    28 * **Fallback Method:** You can set your two-factor authentication app as a fallback method if you have trouble with email OTPs.
    29 * Works with default WordPress login page
     27* Secure token-based authentication (single-use and time-limited)
     28* OTP delivered via Authyo's secure email service
     29* **Fallback Method:** Optional two-factor authenticator app if email OTP fails
     30* Works with the default WordPress login page
    3031* AJAX-powered login flow (no page reloads)
    31 * Automatic dashboard redirect after login
    32 * Enable / disable passwordless login anytime
     32* Automatic dashboard redirect after successful login
     33* Enable or disable passwordless login anytime
    3334* Compatible with custom login URL plugins (e.g., WPS Hide Login)
    3435
    35 
    36 = How It Works: =
     36== Use Cases ==
     37
     38This plugin is ideal for:
     39
     40* WordPress sites that want **OTP login instead of passwords**
     41* Improving **WordPress login security**
     42* Enabling **passwordless authentication**
     43* Preventing password brute-force attacks
     44* Membership websites and user portals
     45* Sites that want a **simple two-factor authentication alternative**
     46
     47== How It Works ==
    3748
    38491. User enters their email address on the WordPress login page
    39502. Authyo sends a one-time password (OTP) via email
    40513. User verifies the OTP
    41 4. WordPress logs the user in automatically using a secure, single-use token
    42 
    43 = About Konceptwise & Authyo =
    44 
    45 Konceptwise is the parent company and original developer of this plugin. Authyo is a product developed and owned by Konceptwise that provides secure OTP-based authentication services. This plugin is officially maintained by Konceptwise and uses Authyo to enable passwordless login for WordPress users.
     524. WordPress logs the user in automatically using a secure single-use token
     53
     54No password is required during the login process.
     55
     56== About Konceptwise & Authyo ==
     57
     58Konceptwise Digital Media Pvt. Ltd. is the parent company and original developer of this plugin.
     59
     60**Authyo** is a secure authentication platform developed by Konceptwise that provides OTP-based verification services for websites and applications.
     61
     62This plugin integrates WordPress with Authyo's authentication infrastructure to provide secure passwordless login functionality.
    4663
    4764== Video Tutorial ==
    … …  
    5168https://www.youtube.com/watch?v=cStBvoHTzro
    5269
    53 
    5470== Installation ==
    5571
    … …  
    5773
    58741. Download the plugin files
    59 2. Upload the authyo-passwordless-login folder to /wp-content/plugins/ directory
    60 3. Activate the plugin through the 'Plugins' menu in WordPress
    61 4. Navigate to Settings > Authyo Passwordless Login to configure the plugin
     752. Upload the `authyo-passwordless-login` folder to `/wp-content/plugins/`
     763. Activate the plugin from the **Plugins** menu in WordPress
     774. Go to **Settings → Authyo Passwordless Login** to configure the plugin
    6278
    6379== External Services ==
    … …  
    8399Purpose:
    84100- To verify ownership of the provided email address through OTP verification
    85 - After successful OTP verification, a secure, browser-bound single-use token is generated
    86 - The token allows WordPress to complete authentication without requiring a password
    87 - Token-based authentication is fully secure, browser-locked, time-limited (5 minutes), and single-use
     101- After successful OTP verification, a secure browser-bound login token is generated
     102- The token allows WordPress to authenticate users without passwords
    88103
    89104Data Storage:
    90105- OTP session data (email, user ID, mask ID) is stored temporarily in WordPress transients (expires after 10 minutes)
    91 - Login tokens are stored temporarily in WordPress transients (expires after 5 minutes, deleted immediately after use)
     106- Login tokens are stored temporarily in WordPress transients (expires after 5 minutes and deleted immediately after use)
    92107- No user data is permanently stored by this plugin
    93108
    … …  
    98113https://authyo.io/privacy-policy
    99114
    100 = Requirements =
     115== Requirements ==
    101116
    102117* WordPress 5.0 or higher
    … …  
    1101251. Sign up for an account at https://authyo.io
    1111262. Log in to your Authyo dashboard
    112 3. Navigate to your app settings
    113 4. Copy your App ID, Client ID, and Client Secret
     1273. Navigate to your application settings
     1284. Copy your **App ID**, **Client ID**, and **Client Secret**
    114129
    115130= Plugin Setup =
    116131
    117 1. Go to Settings > Authyo Passwordless Login in your WordPress admin
    118 2. Check the Enable Passwordless Login checkbox to activate the feature
     1321. Go to **Settings → Authyo Passwordless Login**
     1332. Enable **Passwordless Login**
    1191343. Enter your Authyo API credentials:
    120135   * Authyo App ID
    121136   * Authyo Client ID
    122137   * Authyo Client Secret
    123 4. Click Save Settings
     1384. Click **Save Settings**
    124139
    125140Once configured, the passwordless login form will appear on your WordPress login page.
    … …  
    1331483. Users enter the OTP code to verify their email ownership
    1341494. After successful OTP verification, a secure single-use token is generated
    135 5. Users are automatically redirected and logged in to WordPress
    136 6. No password is ever required - fully passwordless authentication
     1505. WordPress logs the user in automatically
     1516. No password is required
    137152
    138153= Can I use this with custom login pages? =
    139154
    140 Yes, you can use the shortcode [authyo_login] on any page or template, or use the PHP function authyo_passwordless_login_form() in your theme templates.
     155Yes. You can use the shortcode `[authyo_login]` on any page or template.
     156
     157You may also use the PHP function:
     158
     159`authyo_passwordless_login_form()`
     160
     161inside your theme templates.
    141162
    142163= What happens if a user doesn't receive the OTP? =
    143164
    144 Users can click the "Resend OTP" button to request a new OTP code. The OTP expires after 5 minutes (as configured with Authyo). The login token expires after 5 minutes if not used, and is deleted immediately after successful login for security.
     165Users can click **Resend OTP** to request a new code.
     166
     167The OTP expires after 5 minutes. Login tokens also expire after 5 minutes and are deleted immediately after successful login.
    145168
    146169= Is this plugin secure? =
    147170
    148 Yes, the plugin implements multiple security layers:
     171Yes. The plugin implements multiple security layers:
     172
    149173* Nonce verification for all AJAX requests (prevents CSRF attacks)
    150174* Email address validation and user existence verification
    151175* Secure transient storage for OTP sessions (10-minute expiry)
    152176* Cryptographically secure token generation using WordPress core functions
    153 * Browser-bound tokens: Tokens are validated against a hashed User-Agent to prevent cross-browser replay attacks
    154 * Single-use tokens that are deleted immediately after successful login
    155 * Time-limited tokens (5-minute expiry) to prevent long-term exposure
    156 * Token format validation to prevent injection attacks
     177* Browser-bound tokens validated using a hashed User-Agent signature
     178* Single-use tokens deleted immediately after successful login
     179* Time-limited tokens (5-minute expiry)
     180* Replay attack prevention
    157181* Authentication completed using WordPress core authentication mechanisms
    158 * Replay attack prevention through immediate token deletion and User-Agent signature validation
    159 
    160182
    161183== Changelog ==
Note: See TracChangeset for help on using the changeset viewer.