Title: MyOTP Phone Verification Author: rayasoren Published: September 25, 2026 Last modified: September 25, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/myotp-phone-verification.svg) # MyOTP Phone Verification By [rayasoren](https://profiles.wordpress.org/rayasoren/) [Download](https://downloads.wordpress.org/plugin/myotp-phone-verification.1.0.0.zip) * [Details](https://wordpress.org/plugins/myotp-phone-verification/#description) * [Reviews](https://wordpress.org/plugins/myotp-phone-verification/#reviews) * [Installation](https://wordpress.org/plugins/myotp-phone-verification/#installation) * [Development](https://wordpress.org/plugins/myotp-phone-verification/#developers) [Support](https://wordpress.org/support/plugin/myotp-phone-verification/) ## Description MyOTP Phone Verification sends a one-time code to a visitor’s phone and checks it before they can continue. It uses the MyOTP.App API (https://myotp.app), one key for SMS, WhatsApp and Telegram. What it does: * WooCommerce checkout: a Send code button under the billing phone. The order cannot be placed until the billing number is verified. Optionally only for guests. * WordPress registration: a phone field with the same flow on wp-login.php?action =register. The verified number is saved as user meta `myotp_verified_phone`. * Shortcode `[myotp_verify]`: the same widget on any page. Fires a `myotp:verified` event on `document` with the number in `event.detail.phone`. * Settings page (Settings > MyOTP): API key, channel, code length, validity, brand, and a Send test code button. How it stays safe: * The API key never leaves the server. The browser talks to admin-ajax.php only. * Every AJAX call carries a nonce. Admin actions check `manage_options`. * Send limits, enforced together with atomic counters: 5 codes per visitor, 10 per client IP, 3 per destination number, each per 10 minutes, plus a site-wide ceiling (default 100, setting and `myotp_pv_site_hourly_cap` filter). The site- wide count uses a fixed one-hour window that starts at the first send, so up to twice the ceiling can go out across a window boundary. It exists to bound what an attacker with many addresses and many numbers can make the site spend. A code that was not billed (provider answered 409 or a server error) is not counted against it. * A visitor can only verify the code they requested: the challenge reference from the provider is stored with the pending record and sent back on every check. If the provider still has an active code that this visitor did not request, a fresh code is sent for this visitor instead (still within every send limit). * 5 wrong codes put this visitor on a 15-minute cooldown for that number. Sending and checking are both refused for that visitor while it lasts; other visitors are not affected, and nothing is keyed on the phone number alone, so nobody can lock a number’s owner out. Only a provider answer of “wrong code” counts; an expired code, a network failure or a provider error never does. * A verification is valid for 30 minutes and is claimed by exactly one checkout or one registration at validation time, then consumed when the order or account exists. If checkout fails after validation (a declined payment, for example) the visitor verifies again. * Phone numbers are reduced to digits before they are sent. Leading zeros are kept. Not in this version: the WooCommerce block checkout. The classic shortcode checkout is supported. #### External service This plugin sends the phone number a visitor enters to the MyOTP.App API at https:// api.myotp.app to deliver a one-time code and to check the code the visitor types. No other data is sent. MyOTP.App privacy policy: https://myotp.app/privacy-policy/. Terms: https://myotp.app/term-condition/. #### Data stored on your site * A cookie `myotp_pv_sid` (random id, one day) so a guest’s verification can be tied to their browser. * Rows in the options table (`myotp_pv_kv_` prefix, not autoloaded): rate-limit counters (a row lives for one window after the last send it counted: 10 minutes, site-wide 1 hour), the pending number with its code reference and attempt count( kept for the configured code validity, at most 4 hours), a 15-minute per-visitor cooldown row after five wrong codes, and the verified number (30 minutes). Expired rows are removed on the next read of that row and by a daily WP-Cron sweep (` myotp_pv_sweep`). WP-Cron runs on page visits, so on a quiet site the sweep can run later than scheduled. * Order meta `_myotp_verified_phone` on each verified WooCommerce order. * User meta `myotp_verified_phone` on each account registered through the verified form. Uninstalling removes the settings, the scheduled sweep, the counters, the pending records and the verified records. Order meta and user meta are part of your customer records and are kept. The plugin registers suggested text for your privacy policy under Settings > Privacy. ## Installation 1. Upload the `myotp-phone-verification` folder to `/wp-content/plugins/`, or upload the zip from Plugins > Add New > Upload Plugin. 2. Activate the plugin. 3. Sign up at https://myotp.app/sign-up/ and copy an API key from User API Keys in the dashboard. 4. Go to Settings > MyOTP, paste the key, pick a channel and save. 5. Send a test code to your own number from the same page. ## FAQ ### What format do phone numbers need? Country code first, digits only, no plus sign. 14155550123, not +1 (415) 555-0123. The plugin strips spaces, dashes and the plus sign before sending. ### Does it work with the WooCommerce block checkout? No. This version hooks the classic checkout (the `[woocommerce_checkout]` shortcode page). Block checkout support is planned. ### Can logged-in customers skip verification? Yes. Tick “Only for guests” under WooCommerce checkout in Settings > MyOTP. ### How do I react to a successful verification from the shortcode? Listen for the event: ``` document.addEventListener('myotp:verified', function (e) { console.log(e.detail.phone); }); ``` ### I am behind a reverse proxy or CDN. Does the per-IP limit work? The plugin reads REMOTE_ADDR only, because forwarding headers can be forged by the client. Behind a proxy that address may be the proxy itself, so every visitor shares one per-IP bucket and the site-wide hourly ceiling is the real backstop. If your host guarantees a trusted header, return the real address from the `myotp_pv_client_ip` filter. ### Does each test send cost credits? Yes. A test send is a real send. ### Where does the API key live? In the `myotp_pv_options` option, on the server only. It is shown masked on the settings page and removed on uninstall. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “MyOTP Phone Verification” is open source software. The following people have contributed to this plugin. Contributors * [ rayasoren ](https://profiles.wordpress.org/rayasoren/) [Translate “MyOTP Phone Verification” into your language.](https://translate.wordpress.org/projects/wp-plugins/myotp-phone-verification) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/myotp-phone-verification/), check out the [SVN repository](https://plugins.svn.wordpress.org/myotp-phone-verification/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/myotp-phone-verification/) by [RSS](https://plugins.trac.wordpress.org/log/myotp-phone-verification/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release. WooCommerce classic checkout, registration form, `[myotp_verify]` shortcode, settings page with test send. ## Meta * Version **1.0.0** * Last updated **21 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [otp](https://wordpress.org/plugins/tags/otp/)[phone verification](https://wordpress.org/plugins/tags/phone-verification/) [sms verification](https://wordpress.org/plugins/tags/sms-verification/)[whatsapp](https://wordpress.org/plugins/tags/whatsapp/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/myotp-phone-verification/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/myotp-phone-verification/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/myotp-phone-verification/reviews/) ## Contributors * [ rayasoren ](https://profiles.wordpress.org/rayasoren/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/myotp-phone-verification/)