Logliy - Login Protect (Passkey, Email, SSO)
| 开发者 | flobamedia |
|---|---|
| 更新时间 | 2026年9月9日 07:27 |
| PHP版本: | 8.1 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
Logliy - Login Protect controls how users sign in: Passkeys (WebAuthn) first, with Email one-time codes and Magic Links as fallback, plus optional SSO (OpenID Connect) and an optional password path.
It is not a security suite and not a generic OTP plugin. Keep Wordfence (or similar) for WAF, brute-force lockouts, CAPTCHA, malware scanning, and classic TOTP 2FA. Logliy is the login-method layer on top.
Features
- Passkey login and registration (discoverable credentials, Conditional UI where available)
- Email OTP login via
wp_mail - Magic link (one-click email) login
- Optional SSO via OpenID Connect (shown on the login form only when fully configured)
- Password login off by default, re-enable site-wide and/or per role / per user
- Role-based login/logout redirects
- Optional custom login URL (auto-disabled if WPS Hide Login or similar is active)
- Session length, Remember-me duration, admin idle timeout, logout everywhere
- Users overview (Passkeys + last login)
- Optional custom login logo, brand, background, and footer
- Modern login UI on
wp-login.php - WooCommerce classic + Blocks My Account/Checkout login forms
- Cloudflare Turnstile compatible (verifies tokens on Passkey / Email OTP / Magic Link / SSO login)
- REST API namespace
logliy/v1 - Rate limits for OTP, Passkey, and SSO auth
- Wordfence-friendly: fires
wp_login_failed/wp_loginand uses normal auth cookies - Emergency override:
define( 'LOGLIY_ALLOW_PASSWORD', true );inwp-config.php
- Failed Logliy attempts trigger
wp_login_failedso Wordfence lockouts still apply - Successful Logliy logins use
wp_set_auth_cookie+wp_loginlike a normalwp_signon - Wordfence IP lockouts still run during passwordless login; Wordfence Login Security 2FA is skipped for Passkey / Email OTP / Magic Link / SSO (those methods already replace the password)
- Wordfence TOTP 2FA continues to apply on the classic password path
- Logliy does not remove Wordfence hooks globally — only suspends LS 2FA for the passwordless completion step
authenticate check.
WooCommerce
- Classic My Account and Checkout login templates
- Guest checkout unchanged
- Does not block WooCommerce REST / Store API authentication
- Optional panel above Checkout and Customer Account blocks for guests
- PHP 8.1+
- WordPress 6.4+
- HTTPS for Passkeys (localhost allowed for development)
- Composer production dependencies are vendored in release builds (
vendor-prefixed/)
安装:
- Upload the
logliyfolder to/wp-content/plugins/ - Activate Logliy - Login Protect (Passkey, Email, SSO)
- Open Settings → Logliy
- Register a Passkey on your profile and/or test Email OTP before relying on passwordless-only mode
- Optionally enable SSO under the SSO tab (login form shows it only when fully configured)
- Optionally set a custom login logo / brand name under General
- Optionally enable password login again under General
常见问题:
How do I enable SSO?
Open Settings → Logliy → SSO. Enable SSO and enter your OpenID Provider Issuer URL, Client ID, and Client Secret. Register the shown Redirect URI at the provider. The SSO tab appears on the login form only when those three fields are set. ID tokens must be signed with RS256. New WordPress users are not created unless you turn on Create users.
I locked myself out
Add to wp-config.php:
define( 'LOGLIY_ALLOW_PASSWORD', true );
Then sign in with your password and adjust Logliy settings.
Does this replace Wordfence?
No. Logliy is the login method layer. Wordfence remains your WAF / lockout / scanner layer.
Application Passwords / WP-CLI / XML-RPC
Application Passwords and WP-CLI are not blocked by the password policy. With password login off, XML-RPC authentication with the account password is blocked by default (affects the WordPress mobile app, Jetpack, and some backup tools). Enable Allow XML-RPC passwords under Logliy → General if a tool still requires it. Prefer Application Passwords when the client supports them.
更新日志:
0.1.1
- Fix: SSO no longer fails with “denied” when Cloudflare Turnstile is enabled on the login form
- Optional SSO login via OpenID Connect (authorization code + PKCE). Shown on the login form only when fully configured.
- Plugin name updated to include SSO
- Tested up to WordPress 7.1
- Remove arbitrary custom CSS from settings (use Additional CSS instead)
- Enqueue remember-me check via login.js; drop inline script tag
- Document Cloudflare Turnstile as an external service (terms + privacy)
- Stop bundling .po/.mo and vendor PHPUnit helpers; include composer.json
- WordPress.org loads translations automatically (no load_plugin_textdomain)
- Limit admin notices to Logliy settings / profile screens
- Ignore leftover Turnstile DB options when the Captcha plugin is not active (fixes false CAPTCHA block)
- Show plugin version on settings page; remove duplicate “settings saved” notice
- Captcha only required when Cloudflare Turnstile is enabled and configured; sites without Captcha are not blocked
- Fix Advanced settings save (nested import form) and add Save button at top
- Settings import/export (JSON) for cloning config between sites
- Vendor namespaces prefixed with Strauss (Logliy) to avoid Symfony conflicts
- Passwordless login skips Wordfence 2FA (lockouts still apply); Wordfence 2FA remains on password path
- Optional “Allow XML-RPC passwords” (off by default) when password login is disabled
- Atomic rate-limit DB table (no option-lock); OTP HMAC bound to user; safer settings import
- Security: password policy applies to XML-RPC; REST exemption limited to Application Passwords
- Security: passwordless login runs authenticate / wp_authenticate_user before cookies (Wordfence lockouts)
- Privacy: system font stack instead of Google Fonts CDN
- Hardening: account cooldown/rate-limit responses no longer enumerate users; atomic rate-limit buckets; OTP HMAC
- Fix: Divi fatal when hiding wp-admin (no theme 404 template during early init)
- Magic link, custom login URL, redirects, sessions, users overview, WC blocks, branding extras
- Initial pre-release: Passkeys, Email OTP, password policy (default off), wp-login + WooCommerce classic
- Admin settings, profile Passkey management, Cloudflare Turnstile compatibility
- Optional login branding (logo / name / tagline); DE/EN i18n
- Auth hardening: no OTP enumeration, redirect validation, Turnstile token verify, rate limits