Title: Tomevexa Secure Login Author: Francesco La Mancusa Published: September 22, 2026 Last modified: September 22, 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/tomevexa-secure-login.svg) # Tomevexa Secure Login By [Francesco La Mancusa](https://profiles.wordpress.org/portalelibri/) [Download](https://downloads.wordpress.org/plugin/tomevexa-secure-login.1.1.0.zip) * [Details](https://wordpress.org/plugins/tomevexa-secure-login/#description) * [Reviews](https://wordpress.org/plugins/tomevexa-secure-login/#reviews) * [Installation](https://wordpress.org/plugins/tomevexa-secure-login/#installation) * [Development](https://wordpress.org/plugins/tomevexa-secure-login/#developers) [Support](https://wordpress.org/support/plugin/tomevexa-secure-login/) ## Description Compatible with WordPress 5.8 and later. The minimum PHP version remains 7.4 to preserve secure, predictable authentication behavior across supported installations. Tomevexa Secure Login is distinguished by its privacy-preserving adaptive security model. It can require an additional email OTP after a correct password when a non- administrator signs in from a network that has not yet been trusted. The plugin also provides a front-end login form that can authenticate eligible WordPress users with a one-time numeric code sent to their account email address. The plugin also provides optional password login, configurable password-expiry enforcement, and a local adaptive step-up mode for non-administrator accounts. When adaptive step-up is enabled, a correct password from a network that has not yet been trusted requires an email OTP before access is granted. Administrator accounts remain excluded from the plugin OTP path and password-expiry enforcement. Main features: * Passwordless email OTP login for non-administrator users. * Local passkey login using the WebAuthn/FIDO2 browser standard, with Face ID, Touch ID, Windows Hello, device PINs, and compatible security keys. * Usernameless passkey sign-in with discoverable credentials; up to 10 passkeys can be registered per WordPress account. * Passkey private keys and biometric data never reach WordPress; the plugin stores only credential identifiers, public-key coordinates, counters, and timestamps. * Configurable OTP length, lifetime, resend delay, and maximum verification attempts. * Generic code-request responses to reduce account enumeration. * Request throttling per IP address and per account/email to reduce OTP mail flooding and password brute-force attempts. * OTP values generated with `random_int()` and stored only as WordPress password hashes in temporary transients. * Optional password login from the same front-end form. * Adaptive step-up authentication: after a correct password, unfamiliar networks can require email OTP verification before access is granted. * Privacy-preserving trusted-network recognition: IPv4 /24 or IPv6 /64 network prefixes are converted to salted HMAC hashes; raw IP addresses are not stored in the trusted-network list. * Configurable trusted-network lifetime, with automatic expiry and a maximum of 10 active hashes per user. * Configurable password expiry for non-administrator accounts; set the value to 0 to disable it. * Safe post-login redirects, including optional compatibility with Profile Builder Pro custom redirects when that plugin is active. * Accessible labels, keyboard-operable controls, live status/error regions, visible focus indicators, one-time-code autocomplete, and reduced-motion support. * No external JavaScript, CSS, tracking, telemetry, or third-party API calls. * Translation-ready strings using the WordPress.org translation system. Use the `[tomevexa_secure_login]` shortcode on a page. You can optionally set a redirect destination: ``` [tomevexa_secure_login redirect_url="https://example.com/account/"] ``` The redirect is validated with WordPress redirect-safety functions. If a `redirect_to` parameter is supplied by WordPress, the plugin can also honor that safe destination. #### Email delivery OTP messages are sent with the standard WordPress `wp_mail()` function. Actual delivery therefore depends on the site’s WordPress mail configuration and hosting environment. The plugin does not connect directly to an external email service. #### Profile Builder compatibility Profile Builder is not required. When Profile Builder Pro is active and its Custom Redirects module is enabled, Tomevexa Secure Login preserves the configured after- login redirect. #### Accessibility The login form uses semantic labels and buttons, keyboard-operable controls, visible focus indicators, polite and assertive live regions for status and errors, a single numeric OTP field compatible with paste and `autocomplete="one-time-code"`, and reduced-motion support. Accessibility also depends on the active theme and surrounding page content. Site owners should test the completed page with keyboard navigation and their preferred assistive technologies. #### Privacy Tomevexa Secure Login does not include analytics, telemetry, advertising, or direct third-party API requests. Passkey registration and verification are performed locally between the browser/authenticator and the WordPress site using WebAuthn; no external authentication service is required. OTP emails are sent through the site’s configured WordPress mail system. Temporary OTP data is stored in WordPress transients and contains a password hash of the OTP, the user ID, expiry time, and attempt count. The OTP itself is not stored in plaintext. When adaptive step-up is enabled, trusted- network recognition stores only salted HMAC hashes derived from reduced network prefixes plus their expiry times in user metadata; the trusted-network list does not store raw IP addresses. ## Installation 1. Upload the `tomevexa-secure-login` folder to `/wp-content/plugins/`, or install the ZIP file from the WordPress Plugins screen. 2. Activate Tomevexa Secure Login. 3. Open Settings > Tomevexa Secure Login. 4. Configure code length, validity, resend delay, maximum attempts, adaptive step- up, trusted-network lifetime, password expiry, and the email template. 5. Add `[tomevexa_secure_login]` to the page that should provide the login form. 6. Make sure the site uses HTTPS if passkey support will be used. 7. Each user who wants to use a passkey can open their WordPress Profile and use the** Tomevexa passkeys** section to register a compatible device or security key. 8. Log out and test every enabled authentication path before using the plugin on a production login page: password, email OTP, adaptive step-up, and passkey login as applicable. ## FAQ ### Does the plugin require Profile Builder? No. Tomevexa Secure Login works with standard WordPress users. Profile Builder Pro integration is limited to preserving its optional custom after-login redirect when available. ### Can administrators log in with an OTP? No. Administrator accounts are deliberately excluded from the OTP path and from password-expiry enforcement. They can continue to use standard WordPress password authentication. ### Do passkeys require an external service? No. Passkey registration and authentication use the browser WebAuthn API and are verified locally by the WordPress site. HTTPS and PHP OpenSSL support are required. Private keys and biometric data remain on the user device. ### How do I register a passkey? While logged in, open your WordPress user Profile and find the **Tomevexa passkeys** section. Select **Register a passkey** and follow the browser or operating-system prompt. Passkey registration requires HTTPS, PHP OpenSSL support, and a WebAuthn- capable browser/authenticator. Up to 10 passkeys can be registered for one WordPress account. ### Where are passkey credentials stored? The authenticator keeps the private key. WordPress stores the credential identifier and public-key material required to verify future sign-ins, together with the authenticator counter and timestamps. The plugin does not receive or store biometric data. ### Can administrators use passkeys? Yes. The administrator exclusion applies to the email OTP path and password-expiry enforcement. An administrator may register and use a passkey from the WordPress user profile. ### What happens if a passkey is unavailable? The existing WordPress password login remains available. Eligible non-administrator users can also use the plugin email OTP flow. Site owners should keep an appropriate recovery method available for privileged accounts. ### What is adaptive step-up authentication? When enabled, a non-administrator who enters the correct password from a network that has not yet been trusted must also enter an email OTP. After successful OTP verification, a salted hash representing that network can be trusted for the configured period. ### Does adaptive step-up store my IP address? The trusted-network list does not store raw IP addresses. The plugin reduces the current address to an IPv4 /24 or IPv6 /64 network prefix and stores a salted HMAC hash of that prefix. The web server and other WordPress components may still process or log IP addresses independently of this plugin. ### Are OTP codes stored in plaintext? No. The generated code is hashed with WordPress password-hashing functions before temporary storage. ### What happens when a password expires? A non-administrator who attempts password authentication with an expired password is directed to reset it. Email OTP login remains available. Set password expiry to 0 in the plugin settings to disable this feature. ### Does the plugin guarantee email delivery? No. It uses WordPress `wp_mail()`. Delivery depends on the site’s mail configuration, hosting environment, and any SMTP or mail-delivery plugin in use. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Tomevexa Secure Login” is open source software. The following people have contributed to this plugin. Contributors * [ Francesco La Mancusa ](https://profiles.wordpress.org/portalelibri/) [Translate “Tomevexa Secure Login” into your language.](https://translate.wordpress.org/projects/wp-plugins/tomevexa-secure-login) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/tomevexa-secure-login/), check out the [SVN repository](https://plugins.svn.wordpress.org/tomevexa-secure-login/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/tomevexa-secure-login/) by [RSS](https://plugins.trac.wordpress.org/log/tomevexa-secure-login/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * Added local WebAuthn/FIDO2 passkeys with usernameless passwordless sign-in. * Added passkey registration and removal in the WordPress user profile. * Requires HTTPS for passkey operations and user verification (PIN/biometric/device verification). * Passkey authentication verifies RP ID, origin, challenge, user presence, user verification, ES256 signatures, and authenticator counters. #### 1.0.0 * Initial Tomevexa Secure Login release. * Added accessible email OTP authentication for non-administrator users. * Added optional password login and configurable password expiry. * Added local adaptive step-up verification for password logins from networks that have not yet been trusted. * Added privacy-preserving trusted-network recognition using salted hashes of reduced network prefixes with configurable expiry. * Added layered rate limiting, attempt limits, hashed OTP storage, and generic code-request responses. * Added optional Profile Builder Pro custom-redirect compatibility. * Prepared all user-facing strings for translation through WordPress.org. ## Meta * Version **1.1.0** * Last updated **17 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [login](https://wordpress.org/plugins/tags/login/)[otp](https://wordpress.org/plugins/tags/otp/) [passkeys](https://wordpress.org/plugins/tags/passkeys/)[passwordless](https://wordpress.org/plugins/tags/passwordless/) [webauthn](https://wordpress.org/plugins/tags/webauthn/) * [Advanced View](https://wordpress.org/plugins/tomevexa-secure-login/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/tomevexa-secure-login/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/tomevexa-secure-login/reviews/) ## Contributors * [ Francesco La Mancusa ](https://profiles.wordpress.org/portalelibri/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/tomevexa-secure-login/)