Linux 软件免费装

在这里免费安装WordPress以及其他软件

Authyo Passwordless Login

开发者 konceptwise
更新时间 2026年1月1日 16:03
PHP版本: 7.2 及以上
WordPress版本: 6.9
版权: GPL v2 or later
版权网址: 版权信息

标签

otp authentication wordpress login wp login passwordless

下载

1.0.0 1.0.1

详情介绍:

Authyo Passwordless Login provides a secure, fully passwordless authentication system for WordPress. Users enter their email address, receive a one-time password (OTP) via email, verify the OTP, and are automatically logged in - no passwords required at any stage. The plugin uses secure, single-use tokens to enable automatic WordPress authentication after OTP verification, providing a seamless and secure login experience. Key Features About Konceptwise & Authyo Konceptwise is the parent company and original developer of this plugin. Authyo is a product developed and owned by Konceptwise that provides secure OTP-based authentication services. This plugin is officially maintained by Konceptwise and uses Authyo to enable passwordless login for WordPress users.

安装:

Manual Installation
  1. Download the plugin files
  2. Upload the authyo-passwordless-login folder to /wp-content/plugins/ directory
  3. Activate the plugin through the 'Plugins' menu in WordPress
  4. Navigate to Settings > Authyo Passwordless Login to configure the plugin
Requirements

屏幕截图:

  • Authyo WordPress Passwordless Login Admin Panel

升级注意事项:

1.0.1 Performance improvements and screenshot addon. 1.0.0 Initial release of Authyo Passwordless Login.

常见问题:

How does passwordless login work?

  1. Users enter their email address on the login page
  2. An OTP code is sent to their email via Authyo
  3. Users enter the OTP code to verify their email ownership
  4. After successful OTP verification, a secure single-use token is generated
  5. Users are automatically redirected and logged in to WordPress
  6. No password is ever required - fully passwordless authentication

Can I use this with custom login pages?

Yes, you can use the shortcode [authyo_login] on any page or template, or use the PHP function authyo_passwordless_login_form() in your theme templates.

What happens if a user doesn't receive the OTP?

Users can click the "Resend OTP" button to request a new OTP code. The OTP expires after 5 minutes (as configured with Authyo). The login token expires after 5 minutes if not used, and is deleted immediately after successful login for security.

Is this plugin secure?

Yes, the plugin implements multiple security layers:

  • Nonce verification for all AJAX requests (prevents CSRF attacks)
  • Email address validation and user existence verification
  • Secure transient storage for OTP sessions (10-minute expiry)
  • Cryptographically secure token generation using WordPress core functions
  • Browser-bound tokens: Tokens are validated against a hashed User-Agent to prevent cross-browser replay attacks
  • Single-use tokens that are deleted immediately after successful login
  • Time-limited tokens (5-minute expiry) to prevent long-term exposure
  • Token format validation to prevent injection attacks
  • Authentication completed using WordPress core authentication mechanisms
  • Replay attack prevention through immediate token deletion and User-Agent signature validation

更新日志:

1.0.1 1.0.0