| 开发者 | mksddn |
|---|---|
| 更新时间 | 2026年6月11日 16:17 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
issue_session: true).issue_token: true; cookie not set by default on REST login)./wp-content/plugins/ directory.[mksddn_reddy_login].wp-login.php fallback).Use the MKSDDN_REDDY_BOT_TOKEN constant in wp-config.php on production sites. The settings page field is a development fallback and should not replace secure server-side configuration in live environments.
This usually happens when Protect site content is enabled but no valid login page is selected. Create a page with [mksddn_reddy_login], choose it in Login page, and save settings.
/wp-login.php?No. It adds a Reddy OTP login flow via shortcode and REST endpoints. Standard WordPress login may still be available unless you restrict it separately.
Yes. On first successful OTP login the plugin creates a WordPress user mapped to the Reddy ID and stores the mapping in user meta.
Send issue_token: true in the login request, then pass the returned token in the Authorization: Bearer header. REST login does not set a WordPress cookie unless you also send issue_session: true. Use the login shortcode or issue_session: true when the browser needs access to Protect site content pages.
issue_token returns a Bearer token for REST API clients. issue_session sets the WordPress auth cookie. Shortcode login always sets a cookie. REST login sets a cookie only when issue_session is true (default false). Headless integrations should use issue_token without issue_session so site content stays locked until an explicit cookie login.
All plugin Bearer tokens for that WordPress user are revoked and WordPress session tokens are destroyed. The user must complete OTP login again. Deleting the WordPress account does not permanently block the Reddy ID; a successful OTP login can recreate the account.
The plugin rate-limits OTP send and login attempts per Reddy ID and client IP. Wait for the limit window to expire or adjust limits in Settings > Reddy Auth.
It optionally checks Origin or Referer on plugin REST routes only. Empty list = no restriction (default). Non-empty list = browser apps must call from a listed URL. It does not replace OTP, rate limits, or Bearer auth—headers can be spoofed.
Allowed request sources is configured and the request has no matching Origin/Referer. Add your frontend URL to the list, send a matching Origin header from server clients, leave the list empty for backends, or use the mksddn_reddy_is_request_url_allowed filter.
Settings in WordPress options, Reddy ID mapping in user meta, Bearer token hashes in a custom database table, and OTP/rate-limit state in transients. Raw OTP codes and raw tokens are not stored.
If uninstall cleanup runs, plugin-owned options, user meta, custom tables, and transients are removed according to uninstall.php.
GET|POST /auth/intent-status and POST /auth/complete-intent endpoints for polling one-click flow.POST /auth/button-callback for Reddy bot inline button callbacks (HMAC-verified).mksddn_reddy_auth_failure action on every failed OTP, intent, or finalize step.mksddn_reddy_transport_failed and mksddn_reddy_transport_response actions.mksddn_reddy_send_payload filter to modify the Reddy bot request payload before delivery.message for generic failures changed from "Invalid credentials." to "Unable to process authentication request.". The code field is unchanged. Clients should rely on code, not message.
message changed from the Reddy API text to "Too many requests. Try again later.".monolith_lock_enabled) now redirects to wp-login.php when no login page is configured (previously redirected to home_url('/')). Sites with monolith lock on but no login page set will now land on WP login.mksddn_reddy_otp_message filter: the default message passed as the first argument now depends on delivery mode. When delivery_mode is link_only, the message uses the magic link template (no {code}). Custom filter handlers should check the delivery context if they manipulate the message.mksddn_reddy_otp_message still overrides the final OTP text after the admin template is applied.mksddn_reddy_bot_test_message for customizing the connection test message.issue_session parameter (default false); use issue_token for Bearer auth. Shortcode login still sets a cookie._mksddn_reddy_id user meta mapping.edit_posts (administrator, editor) bypass Reddy-only lock without OTP.mksddn_reddy_content_lock_bypass to customize lock bypass per user./auth/logout REST endpoint.