T2F Two-Screen Login Form

Description

Most front-end login forms put the email and password on one screen. Big consumer
sites (Amazon, Google, PayPal…) split it in two: you type your email, press
Continue, and only then are you asked for your password.

T2F Two-Screen Login Form brings that flow to WordPress as a shortcode you can drop on
any page:

[two_step_login]

How it works

1. Step 1 — identifier. The visitor enters their email (optionally username too)
   and presses Continue. By default this transition happens entirely in the
   browser — no server request — so the endpoint only ever sees the final submit.
2. Step 2 — password. The email is shown with a Change link back to step 1.
   The visitor enters their password, optionally ticks Remember me, and signs in.
3. On success the browser is redirected (to ?redirect_to= if present and on-site,
   otherwise to the page you configure — the WooCommerce account page by default,
   or the site home).

Everything happens without a full page reload until the final redirect.

Keeping the load down

Because step 1 is resolved client-side, a normal sign-in makes exactly one
admin-ajax.php call. Failed password attempts are rate-limited per IP address
and per email in a short rolling window before WordPress authentication runs,
and an off-screen honeypot field plus a minimum fill-time check drop obvious bot
submissions without the (CPU-heavy) password hash. Together these keep
credential-stuffing traffic from turning the login page into a load problem.

(When Unknown accounts is set to reveal missing accounts, step 1 still needs a
server round trip, since that answer can only come from the database.)

Privacy

By default the two possible step-1 responses are identical whether or not an account
exists, and failed logins return a single generic message — so the form cannot be
used to discover which email addresses have accounts. A setting lets you turn on
explicit “no account found” messages if you prefer Amazon’s behaviour.

Settings (Settings → Two-Screen Login)

• First step accepts — email only, or email or username.
• Unknown accounts — stay silent (default) or say when no account matches.
• Rate limiting — throttle repeated failed logins per IP / email (on by default).
• Redirect after login — a URL, or blank for the account page / home.
• Lost-password URL — a URL, or blank for the default WordPress reset page.

For developers

add_filter( 'tslf_redirect_url', function ( $url ) { return home_url( '/dashboard/' ); } );
add_filter( 'tslf_lostpassword_url', function ( $url ) { return '/forgot/'; } );
add_filter( 'tslf_template', function ( $path, $name, $args ) { return $path; }, 10, 3 );
add_filter( 'tslf_logged_in_notice', function ( $html, $user ) { return $html; }, 10, 2 );
add_action( 'tslf_logged_in', function ( $user ) { /* ... */ } );

// Abuse mitigation.
add_filter( 'tslf_throttle', function ( $c ) { $c['id_max'] = 5; return $c; } ); // window, ip_max, id_max
add_filter( 'tslf_min_fill_ms', function () { return 2000; } );
add_filter( 'tslf_client_ip', function ( $ip ) { return $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $ip; } );

The two step templates (templates/step-identifier.php, templates/step-password.php)
can be swapped with the tslf_template filter. Style hooks are plain classes
(.tslf, .tslf-form, .tslf-step, .tslf-error, .tslf-submit) and CSS custom
properties (--tslf-accent, --tslf-border, …).

Notes & limitations

• This is a front-end form for a page of your choosing. It does not replace
  wp-login.php or change wp-admin.
• No social login, no 2FA — those are separate concerns handled by other plugins.
• If you serve the login page from a full-page cache, exclude it (or its nonce may
  age out for logged-out visitors after ~12 hours).
• Translations (including Brazilian Portuguese) are managed on
  translate.wordpress.org, not bundled with the plugin. The text domain is
  t2f-two-screen-login.