Propusk Login by Phone with VK ID and Yandex ID (406-FZ)

In Russian the plugin is called «Вход 406-ФЗ». Propusk is an independent plugin by wp-addon.ru and is not affiliated with, endorsed or sponsored by VK or Yandex; VK ID and Yandex ID are trademarks of their owners. Since 1 December 2023, Federal Law No. 406-FZ of 31 July 2023, which amended the law "On Information" (149-FZ), allows website owners to authorize users from Russia only by a Russian phone number, through Gosuslugi (ESIA), the Unified Biometric System, or a Russian information system with verified users such as VK ID or Yandex ID. Registration by e-mail alone does not meet this requirement. Since 7 July 2026, article 13.55 of the Russian Code of Administrative Offences sets fines for letting users sign in through foreign services (Google, Apple ID, foreign e-mail): 500,000–700,000 RUB for companies. Propusk adds these login methods to a regular WordPress site:

• Phone number — the visitor enters a Russian mobile number and confirms it with a code sent by SMS, or by calling a free number (the call is dropped automatically). Works with the SMS.ru service.
• VK ID — login with a VK, OK or Mail.ru account (OAuth 2.1 with PKCE, no client secret is stored).
• Yandex ID — login with a Yandex account.
• Automatic registration — if there is no account with this phone or VK ID / Yandex ID yet, it is created on first login, but only when "Anyone can register" is enabled in Settings → General. New accounts always get a role without editing rights (Subscriber or a similar read-only role such as Customer). Name, e-mail and phone are taken from the service when the user allows it.
• Turn off e-mail-only registration — the WordPress registration form shows only the new methods.
• Password login for staff only — optionally, only administrators and editors keep logging in with a password; everyone else uses the phone, VK ID or Yandex ID.
• Profile section — users link and unlink their phone, VK ID and Yandex ID in their profile, so existing accounts can switch to the new methods.
• Shortcode [propusk] — put the login block on any page.
• Protection — a user is signed in only after the phone code (or call) is confirmed or VK ID / Yandex ID returns a verified account; the OAuth state is bound to the browser and to the current user, linking from the profile requires a nonce. Codes are stored hashed, expire in 5 minutes, allow 5 attempts, can be resent after a minute, and the number of codes per phone and per IP address is limited per hour. Administrator accounts are never linked automatically by e-mail.

The plugin is free and has no limits. An optional paid add-on, "Propusk Pro", is sold separately on wp-addon.ru and adds login through the MAX messenger, WooCommerce My Account and checkout integration, SMSC and SMS Aero, a second login step for administrators, a login journal and a pop-up login button. The free plugin does not contain any locked features. The plugin does not provide legal advice and does not guarantee compliance; it gives you the login methods listed in the law.

1.0.3

• Plugin name changed to "Propusk Login by Phone with VK ID and Yandex ID (406-FZ)".
• New accounts are created only when "Anyone can register" is enabled in WordPress, and only with read-only roles.
• VK ID / Yandex ID login state is bound to the browser and the current user; linking from the profile requires a nonce.
• The registration page style is added with wp_add_inline_style(); the login block HTML is no longer filterable.

1.0.2

• Code cleanup after Plugin Check: the WP-ADDON menu no longer uses shared hooks.

1.0.1

• The plugin page moved to the shared WP-ADDON admin menu together with other wp-addon.ru plugins.

1.0.0

• First release.