Tomevexa Secure Login

Compatible with WordPress 5.8 and later. The minimum PHP version remains 7.4 to preserve secure, predictable authentication behavior across supported installations. Tomevexa Secure Login is distinguished by its privacy-preserving adaptive security model. It can require an additional email OTP after a correct password when a non-administrator signs in from a network that has not yet been trusted. The plugin also provides a front-end login form that can authenticate eligible WordPress users with a one-time numeric code sent to their account email address. The plugin also provides optional password login, configurable password-expiry enforcement, and a local adaptive step-up mode for non-administrator accounts. When adaptive step-up is enabled, a correct password from a network that has not yet been trusted requires an email OTP before access is granted. Administrator accounts remain excluded from the plugin OTP path and password-expiry enforcement. Main features:

• Passwordless email OTP login for non-administrator users.
• Local passkey login using the WebAuthn/FIDO2 browser standard, with Face ID, Touch ID, Windows Hello, device PINs, and compatible security keys.
• Usernameless passkey sign-in with discoverable credentials; up to 10 passkeys can be registered per WordPress account.
• Passkey private keys and biometric data never reach WordPress; the plugin stores only credential identifiers, public-key coordinates, counters, and timestamps.
• Configurable OTP length, lifetime, resend delay, and maximum verification attempts.
• Generic code-request responses to reduce account enumeration.
• Request throttling per IP address and per account/email to reduce OTP mail flooding and password brute-force attempts.
• OTP values generated with random_int() and stored only as WordPress password hashes in temporary transients.
• Optional password login from the same front-end form.
• Adaptive step-up authentication: after a correct password, unfamiliar networks can require email OTP verification before access is granted.
• Privacy-preserving trusted-network recognition: IPv4 /24 or IPv6 /64 network prefixes are converted to salted HMAC hashes; raw IP addresses are not stored in the trusted-network list.
• Configurable trusted-network lifetime, with automatic expiry and a maximum of 10 active hashes per user.
• Configurable password expiry for non-administrator accounts; set the value to 0 to disable it.
• Safe post-login redirects, including optional compatibility with Profile Builder Pro custom redirects when that plugin is active.
• Accessible labels, keyboard-operable controls, live status/error regions, visible focus indicators, one-time-code autocomplete, and reduced-motion support.
• No external JavaScript, CSS, tracking, telemetry, or third-party API calls.
• Translation-ready strings using the WordPress.org translation system.

Use the [tomevexa_secure_login] shortcode on a page. You can optionally set a redirect destination: [tomevexa_secure_login redirect_url="https://example.com/account/"] The redirect is validated with WordPress redirect-safety functions. If a redirect_to parameter is supplied by WordPress, the plugin can also honor that safe destination. Email delivery OTP messages are sent with the standard WordPress wp_mail() function. Actual delivery therefore depends on the site's WordPress mail configuration and hosting environment. The plugin does not connect directly to an external email service. Profile Builder compatibility Profile Builder is not required. When Profile Builder Pro is active and its Custom Redirects module is enabled, Tomevexa Secure Login preserves the configured after-login redirect. Accessibility The login form uses semantic labels and buttons, keyboard-operable controls, visible focus indicators, polite and assertive live regions for status and errors, a single numeric OTP field compatible with paste and autocomplete="one-time-code", and reduced-motion support. Accessibility also depends on the active theme and surrounding page content. Site owners should test the completed page with keyboard navigation and their preferred assistive technologies. Privacy Tomevexa Secure Login does not include analytics, telemetry, advertising, or direct third-party API requests. Passkey registration and verification are performed locally between the browser/authenticator and the WordPress site using WebAuthn; no external authentication service is required. OTP emails are sent through the site's configured WordPress mail system. Temporary OTP data is stored in WordPress transients and contains a password hash of the OTP, the user ID, expiry time, and attempt count. The OTP itself is not stored in plaintext. When adaptive step-up is enabled, trusted-network recognition stores only salted HMAC hashes derived from reduced network prefixes plus their expiry times in user metadata; the trusted-network list does not store raw IP addresses.

1.1.0

• Added local WebAuthn/FIDO2 passkeys with usernameless passwordless sign-in.
• Added passkey registration and removal in the WordPress user profile.
• Requires HTTPS for passkey operations and user verification (PIN/biometric/device verification).
• Passkey authentication verifies RP ID, origin, challenge, user presence, user verification, ES256 signatures, and authenticator counters.

1.0.0

• Initial Tomevexa Secure Login release.
• Added accessible email OTP authentication for non-administrator users.
• Added optional password login and configurable password expiry.
• Added local adaptive step-up verification for password logins from networks that have not yet been trusted.
• Added privacy-preserving trusted-network recognition using salted hashes of reduced network prefixes with configurable expiry.
• Added layered rate limiting, attempt limits, hashed OTP storage, and generic code-request responses.
• Added optional Profile Builder Pro custom-redirect compatibility.
• Prepared all user-facing strings for translation through WordPress.org.