Propusk Login by Phone with VK ID and Yandex ID (406-FZ)

Description

In Russian the plugin is called «Вход 406-ФЗ». Propusk is an independent plugin by wp-addon.ru and is not affiliated with, endorsed or sponsored by VK or Yandex; VK ID and Yandex ID are trademarks of their owners.

Since 1 December 2023, Federal Law No. 406-FZ of 31 July 2023, which amended the law “On Information” (149-FZ), allows website owners to authorize users from Russia only by a Russian phone number, through Gosuslugi (ESIA), the Unified Biometric System, or a Russian information system with verified users such as VK ID or Yandex ID. Registration by e-mail alone does not meet this requirement.

Since 7 July 2026, article 13.55 of the Russian Code of Administrative Offences sets fines for letting users sign in through foreign services (Google, Apple ID, foreign e-mail): 500,000–700,000 RUB for companies.

Propusk adds these login methods to a regular WordPress site:

• Phone number — the visitor enters a Russian mobile number and confirms it with a code sent by SMS, or by calling a free number (the call is dropped automatically). Works with the SMS.ru service.
• VK ID — login with a VK, OK or Mail.ru account (OAuth 2.1 with PKCE, no client secret is stored).
• Yandex ID — login with a Yandex account.
• Automatic registration — if there is no account with this phone or VK ID / Yandex ID yet, it is created on first login, but only when “Anyone can register” is enabled in Settings → General. New accounts always get a role without editing rights (Subscriber or a similar read-only role such as Customer). Name, e-mail and phone are taken from the service when the user allows it.
• Turn off e-mail-only registration — the WordPress registration form shows only the new methods.
• Password login for staff only — optionally, only administrators and editors keep logging in with a password; everyone else uses the phone, VK ID or Yandex ID.
• Profile section — users link and unlink their phone, VK ID and Yandex ID in their profile, so existing accounts can switch to the new methods.
• Shortcode [propusk] — put the login block on any page.
• Protection — a user is signed in only after the phone code (or call) is confirmed or VK ID / Yandex ID returns a verified account; the OAuth state is bound to the browser and to the current user, linking from the profile requires a nonce. Codes are stored hashed, expire in 5 minutes, allow 5 attempts, can be resent after a minute, and the number of codes per phone and per IP address is limited per hour. Administrator accounts are never linked automatically by e-mail.

The plugin is free and has no limits. An optional paid add-on, “Propusk Pro”, is sold separately on wp-addon.ru and adds login through the MAX messenger, WooCommerce My Account and checkout integration, SMSC and SMS Aero, a second login step for administrators, a login journal and a pop-up login button. The free plugin does not contain any locked features.

The plugin does not provide legal advice and does not guarantee compliance; it gives you the login methods listed in the law.

External services

The plugin connects to the following third-party services only after you enable and configure them on the settings page.

SMS.ru (https://sms.ru/) — sends login codes by SMS and runs phone verification by call.
When a visitor requests a code, the plugin sends the phone number, the text of the message with the code, and the visitor’s IP address (used by SMS.ru for anti-fraud protection) to https://sms.ru/sms/send or https://sms.ru/callcheck/add, and checks the call status at https://sms.ru/callcheck/status. On the settings page the “Check key” button requests the account balance from https://sms.ru/my/balance. Your API key is sent with every request.
Terms of service and personal data processing: https://sms.ru/oferta

VK ID (https://id.vk.com/) — login with a VK account.
When a visitor clicks “VK ID”, they are redirected to https://id.vk.ru/authorize. After the visitor allows access, the plugin exchanges the one-time code for a token at https://id.vk.ru/oauth2/auth and requests the user’s ID, name, e-mail and phone at https://id.vk.ru/oauth2/user_info. Your app ID is sent with these requests.
Terms of use: https://vk.com/terms — Privacy policy: https://vk.com/privacy

Yandex ID (https://yandex.ru/id/) — login with a Yandex account.
When a visitor clicks “Yandex ID”, they are redirected to https://oauth.yandex.ru/authorize. After the visitor allows access, the plugin exchanges the one-time code for a token at https://oauth.yandex.ru/token (your ClientID and Client secret are sent) and requests the user’s ID, name, e-mail and phone at https://login.yandex.ru/info.
Terms of use: https://yandex.ru/legal/rules/ — Privacy policy: https://yandex.ru/legal/confidential/

No data is sent to the plugin author.

Developers

Filters: prps/methods, prps/providers (add your own SMS gateway), prps/valid_phone, prps/button_url, prps/before_login, prps/route, prps/settings_defaults, prps/save_settings, prps/admin_tabs.
Actions: prps/loaded, prps/widget (login block rendered, enqueue your assets), prps/signed_in, prps/registered, prps/linked, prps/admin_tab, prps/provider_fields.
User meta: prps_phone (79XXXXXXXXX), prps_vk, prps_yandex.