ShivWeb Login Verification adds two-factor authentication (2FA) to your WordPress login using email codes. A user signs in with their password as usual, then the plugin emails them a short login code and holds the session until the code is entered. Someone who has stolen a password but cannot open the user's inbox stays locked out.<\/p>\n\n
There is no authenticator app to set up, no external service to sign up for, and no API keys. Codes are sent through your site's own email, so any SMTP plugin you already use handles delivery, and everything runs on your server.<\/p>\n\n
Enforcement is role based. Tick the roles that should verify and leave the rest alone. By default only the Customer role is gated, so a store can protect shopper accounts without changing how the team logs in. Users can also mark a browser as trusted for a number of days you choose, so regulars are not asked for a code on every visit.<\/p>\n\n
Enforcement stays off until you prove email delivery works: the plugin asks you to send yourself a test code and enter it before the feature can be switched on. So a broken mailer can never lock everyone out. And if anything ever goes wrong later, one line in wp-config.php or one WP-CLI command turns everything off and releases every held session immediately.<\/p>\n\n
Most login verification plugins add a field to the login form. The WooCommerce block checkout never shows that field, because it signs customers in through the Store API in the background. This plugin works differently: it verifies the session after login, on the server, so wp-login.php, wp-admin, My Account, the classic checkout and the block checkout are all covered by the same check. Nothing depends on the browser, so it cannot be skipped by calling an endpoint directly.<\/p>\n\n
Optionally require new sign-ups to confirm their email address with a code before their first session works. A small popup verifies the address right on the register form, checkout registrations are verified just after, and abandoned unverified accounts are cleaned up automatically after a grace period.<\/p>\n\n
If you ever lock yourself out, add Yes, the email variant: the password is something the user knows, and the code proves control of their mailbox. It is the same email method WordPress's own Two-Factor plugin offers. An authenticator app is stronger in the strict sense, but an email code still stops anyone who only has the password, which is how most accounts are broken into.<\/p><\/dd>\n Yes. The block checkout logs customers in over the Store API, which the plugin refuses for unverified sessions, and a small script guides the shopper to the verification screen.<\/p><\/dd>\n No. All email goes through wp_mail(). Use any SMTP plugin you like for reliable delivery.<\/p><\/dd>\n Affected users cannot verify, but you can always recover with the wp-config.php constant or WP-CLI, both documented above. Administrators are not gated by default.<\/p><\/dd>\n Check the spam folder first. The screen lets you request a new code after a short cooldown. If nothing arrives at all, the site's email delivery is the usual cause: the site owner can go to Settings, then Email Verification, and send themselves a test code. If that fails too, install an SMTP plugin and test again. A single stuck user can always be released with Three things are expected behavior here. Sessions that were already logged in before you enabled enforcement are never challenged, only new logins are. A browser remembered through \"Trust this device\" skips the code until the trust expires. And only the roles you ticked are gated, so check the role of the account you are testing with, and note that administrators are not gated by default.<\/p><\/dd>\n Codes are never stored, not even hashed alone: only keyed hashes live inside the WordPress session record, and they disappear when the session ends. Beyond that the plugin keeps one settings option, per-user send counters and trusted-device hashes in user meta, short-lived self-expiring transients for registration challenges and rate limits, and one cookie for \"Trust this device\". There are no external services and nothing leaves your site. Uninstalling removes all of it. On shared computers, leave \"Trust this device\" unticked.<\/p><\/dd>\n\n<\/dl>\n\n\ndefine( 'SWLV_DISABLE_OTP', true );<\/code> to wp-config.php, or run wp swlv disable<\/code> with WP-CLI. Both release every held session immediately. To unstick a single user (send limit reached, mailbox typo), run wp swlv reset-user <id|login|email><\/code>.<\/p>\n\n\n\n
\n
Is this two-factor authentication?<\/h3><\/dt>\n
Does it work with the WooCommerce block checkout?<\/h3><\/dt>\n
Does it send email through its own service?<\/h3><\/dt>\n
What happens if email delivery breaks after I enable it?<\/h3><\/dt>\n
The code email is not arriving. What should I check?<\/h3><\/dt>\n
wp swlv reset-user<\/code>.<\/p><\/dd>\nI enabled it, but nobody is asked for a code<\/h3><\/dt>\n
What data does the plugin store?<\/h3><\/dt>\n
1.0.0<\/h4>\n\n
\n