Title: ShivWeb Login Verification
Author: shivweb
Published: August 24, 2026
Last modified: August 24, 2026
---
Search plugins
# ShivWeb Login Verification
By [shivweb](https://profiles.wordpress.org/shivweb/)
[Download](https://downloads.wordpress.org/plugin/shivweb-login-verification.1.0.0.zip)
* [Details](https://wordpress.org/plugins/shivweb-login-verification/#description)
* [Reviews](https://wordpress.org/plugins/shivweb-login-verification/#reviews)
* [Installation](https://wordpress.org/plugins/shivweb-login-verification/#installation)
* [Development](https://wordpress.org/plugins/shivweb-login-verification/#developers)
[Support](https://wordpress.org/support/plugin/shivweb-login-verification/)
## Description
ShivWeb Login Verification adds two-factor authentication (2FA) to your WordPress
login using email codes. A user signs in with their password as usual, then the
plugin emails them a short login code and holds the session until the code is entered.
Someone who has stolen a password but cannot open the user’s inbox stays locked
out.
There is no authenticator app to set up, no external service to sign up for, and
no API keys. Codes are sent through your site’s own email, so any SMTP plugin you
already use handles delivery, and everything runs on your server.
#### How a login works
1. The user enters their username and password as normal.
2. The plugin emails them a one time code (OTP) and holds the session.
3. They type the code on the verification screen and continue exactly where they were
going.
#### Choose who needs a code
Enforcement is role based. Tick the roles that should verify and leave the rest
alone. By default only the Customer role is gated, so a store can protect shopper
accounts without changing how the team logs in. Users can also mark a browser as
trusted for a number of days you choose, so regulars are not asked for a code on
every visit.
#### Built so you cannot lock yourself out
Enforcement stays off until you prove email delivery works: the plugin asks you
to send yourself a test code and enter it before the feature can be switched on.
So a broken mailer can never lock everyone out. And if anything ever goes wrong
later, one line in wp-config.php or one WP-CLI command turns everything off and
releases every held session immediately.
#### Works with WooCommerce, including the block checkout
Most login verification plugins add a field to the login form. The WooCommerce block
checkout never shows that field, because it signs customers in through the Store
API in the background. This plugin works differently: it verifies the session after
login, on the server, so wp-login.php, wp-admin, My Account, the classic checkout
and the block checkout are all covered by the same check. Nothing depends on the
browser, so it cannot be skipped by calling an endpoint directly.
#### Email verification at registration
Optionally require new sign-ups to confirm their email address with a code before
their first session works. A small popup verifies the address right on the register
form, checkout registrations are verified just after, and abandoned unverified accounts
are cleaned up automatically after a grace period.
#### Features
* Two-factor authentication with email login codes, no authenticator app needed
* Role based enforcement: choose exactly which user roles must verify
* WooCommerce ready: My Account, classic checkout, and the block checkout
* Trusted devices: remember a browser for a number of days you choose
* Email verification for new registrations, with automatic cleanup
* Rate limiting on every layer: resend cooldown, attempt lockout, and per-account
send caps
* Customizable email template and on-screen messages
* No external service, no API keys, no per-message fees, no tracking
* Recovery built in: a wp-config.php constant and WP-CLI commands
#### Recovery
If you ever lock yourself out, add `define( 'SWLV_DISABLE_OTP', true );` to wp-config.
php, or run `wp swlv disable` with WP-CLI. Both release every held session immediately.
To unstick a single user (send limit reached, mailbox typo), run `wp swlv reset-
user `.
## Installation
1. Install and activate the plugin. Nothing is enforced yet.
2. Go to Settings, then Email Verification.
3. Choose the roles that should verify, send yourself a test code, enter it, tick “
Require a code at login”, and save.
## FAQ
### Is this two-factor authentication?
Yes, the email variant: the password is something the user knows, and the code proves
control of their mailbox. It is the same email method WordPress’s own Two-Factor
plugin offers. An authenticator app is stronger in the strict sense, but an email
code still stops anyone who only has the password, which is how most accounts are
broken into.
### Does it work with the WooCommerce block checkout?
Yes. The block checkout logs customers in over the Store API, which the plugin refuses
for unverified sessions, and a small script guides the shopper to the verification
screen.
### Does it send email through its own service?
No. All email goes through wp_mail(). Use any SMTP plugin you like for reliable
delivery.
### What happens if email delivery breaks after I enable it?
Affected users cannot verify, but you can always recover with the wp-config.php
constant or WP-CLI, both documented above. Administrators are not gated by default.
### The code email is not arriving. What should I check?
Check the spam folder first. The screen lets you request a new code after a short
cooldown. If nothing arrives at all, the site’s email delivery is the usual cause:
the site owner can go to Settings, then Email Verification, and send themselves
a test code. If that fails too, install an SMTP plugin and test again. A single
stuck user can always be released with `wp swlv reset-user`.
### I enabled it, but nobody is asked for a code
Three things are expected behavior here. Sessions that were already logged in before
you enabled enforcement are never challenged, only new logins are. A browser remembered
through “Trust this device” skips the code until the trust expires. And only the
roles you ticked are gated, so check the role of the account you are testing with,
and note that administrators are not gated by default.
### What data does the plugin store?
Codes are never stored, not even hashed alone: only keyed hashes live inside the
WordPress session record, and they disappear when the session ends. Beyond that
the plugin keeps one settings option, per-user send counters and trusted-device
hashes in user meta, short-lived self-expiring transients for registration challenges
and rate limits, and one cookie for “Trust this device”. There are no external services
and nothing leaves your site. Uninstalling removes all of it. On shared computers,
leave “Trust this device” unticked.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“ShivWeb Login Verification” is open source software. The following people have
contributed to this plugin.
Contributors
* [ shivweb ](https://profiles.wordpress.org/shivweb/)
[Translate “ShivWeb Login Verification” into your language.](https://translate.wordpress.org/projects/wp-plugins/shivweb-login-verification)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/shivweb-login-verification/),
check out the [SVN repository](https://plugins.svn.wordpress.org/shivweb-login-verification/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/shivweb-login-verification/)
by [RSS](https://plugins.trac.wordpress.org/log/shivweb-login-verification/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.0.0
* Initial release.
## Meta
* Version **1.0.0**
* Last updated **2 days ago**
* Active installations **Fewer than 10**
* WordPress version ** 7.0 or higher **
* Tested up to **7.1**
* PHP version ** 8.2 or higher **
* Tags
* [email verification](https://wordpress.org/plugins/tags/email-verification/)[login security](https://wordpress.org/plugins/tags/login-security/)
[otp](https://wordpress.org/plugins/tags/otp/)[two factor authentication](https://wordpress.org/plugins/tags/two-factor-authentication/)
[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/shivweb-login-verification/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/shivweb-login-verification/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/shivweb-login-verification/reviews/)
## Contributors
* [ shivweb ](https://profiles.wordpress.org/shivweb/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/shivweb-login-verification/)