Authyo | OTP

Menu
Menu
Login & security

Authyo Passwordless Login

Protect your WordPress login with brute-force protection, an IP manager, security logs, XML-RPC and REST API protection and a custom login URL. Optionally add passwordless login by email OTP.

  • WordPress 5.0+
  • PHP 7.2+
  • Security features need no account
  • Updated
Get the plugin
  1. Install Activate the plugin. Protection starts right away.
  2. Secure your site Turn on the XML-RPC, REST API and custom login URL options.
  3. Add OTP login Connect your Authyo account to log in without a password.

At a glance

What it does
Secures the WordPress login and adds optional passwordless login with an email one-time password (OTP).
Works without an account
Brute-force protection, IP Manager, security logs, XML-RPC protection, REST API protection and the custom login URL work as soon as you activate the plugin.
Needs an Authyo account
Only for passwordless OTP login and the Google Authenticator fallback. You need an App ID, Client ID and Client Secret.
OTP channel
Email.
You need
WordPress 5.0+ and PHP 7.2+.
Settings location
WordPress admin, under Authyo Passwordless (Settings, IP Manager and Security Logs).
Shortcode
[authyo_login], or authyo_passwordless_login_form() in a theme template.

Overview

Authyo Passwordless Login is a login security plugin for WordPress. It protects your site against brute-force attacks, lets you block or allow specific IP addresses, records login activity, and can hide or block common entry points such as xmlrpc.php, the REST API user list and wp-login.php.

On top of that, you can switch on passwordless login. Users enter their email address, receive a one-time password (OTP) and are signed in without typing a password. All the security features run on your own server. Only the OTP login and the Google Authenticator fallback use the Authyo service.

  • Brute-force protection

    Limit failed logins per IP address and per username, with lockouts that get longer each time. Repeat offenders can be blacklisted automatically.

  • IP Manager

    Whitelist trusted IPs and blacklist attackers. Search, filter and unlock IPs from one screen.

  • Security logs

    Track logins, logouts, failed attempts, lockouts and blocked access. Filter by date, search, and export to CSV.

  • XML-RPC protection

    Block requests to xmlrpc.php, remove the pingback header and hide discovery links.

  • REST API protection

    Stop anonymous visitors from listing users or reading the REST API index. Other plugins’ endpoints keep working.

  • Custom login URL

    Hide wp-login.php behind a login address only you know.

  • Passwordless OTP login

    Users sign in with a one-time password sent to their email. Login tokens are single-use and tied to the browser.

  • Google Authenticator fallback

    A backup way for administrators to sign in with an authenticator app if the email code does not work.

Requirements

  • WordPress 5.0 or later and PHP 7.2 or later.
  • No account is needed for the security features.
  • For passwordless OTP login and Google Authenticator: an Authyo account with an application, and its App ID, Client ID and Client Secret.
  • For the same features: your website address added as an Authorized Endpoint in your Authyo app.

Installation

The security features start working as soon as the plugin is active.

  1. Install the plugin

    Go to Plugins → Add New, search for Authyo Passwordless Login, then click Install Now. You can also upload the plugin ZIP using Plugins → Add New → Upload Plugin.

  2. Activate it

    Click Activate. Brute-force protection and security logs start automatically.

  3. Open the plugin menu

    A top-level Authyo Passwordless item appears in the WordPress admin menu. It has three pages: Settings, IP Manager and Security Logs.

Secure your site

These steps need no Authyo account. Open Authyo Passwordless → Settings. The settings are grouped in tabs: General, Security, Brute-Force, API Credentials, Google Auth and Support.

  1. Check brute-force protection

    Open the Brute-Force tab. Protection is on by default. Review the limits and adjust them if you wish. See the settings reference below for what each value does.

  2. Turn on the Security options

    Open the Security tab and switch on what you need: Block all XML-RPC requests, the three REST API and author-scan blocks, and the Custom Login URL.

  3. Set a custom login URL (optional)

    Switch on the custom login URL and enter a slug, for example my-secret-login. Use at least 3 characters: lowercase letters, numbers and hyphens only. Save, then bookmark your new login address. The custom login URL needs pretty permalinks, so choose any option except “Plain” in Settings → Permalinks.

    With the custom login URL on, wp-login.php and wp-admin send logged-out visitors to the home page. If you forget the new address, you can restore the default login by disabling the plugin through FTP or your hosting file manager.

  4. Add your own IP to the whitelist

    Open Authyo Passwordless → IP Manager and add your own IP address to the whitelist, so you cannot lock yourself out. The page shows your current IP address.

  5. Watch the activity

    Open Authyo Passwordless → Security Logs to see logins, failed attempts and lockouts as they happen.

How to use it

Once passwordless login is on (see the next section), the login page shows the OTP form. You can also add the form to any page.

  1. Use the login page

    With passwordless login switched on, the WordPress login page shows the OTP form. When it is switched off, only the default WordPress login form is shown.

  2. Add the form to a custom page

    Create a page, add a Shortcode block with the code below, and publish it.

    [authyo_login]

  3. Add the form to a theme template

    Developers can output the form from a theme file with this PHP function.

    <?php authyo_passwordless_login_form(); ?>

  4. What users do

    The user enters their email address and requests a code. They receive a one-time password by email, type it in, and are logged in. No password is needed.

  5. Manage blocked IPs

    In IP Manager, search the whitelist and blacklist, and see the lockouts from the last 24 hours. From there you can unlock an IP or blacklist it permanently.

Settings reference

Every setting in the plugin, grouped by where you find it. Default values are shown next to the setting name.

General 2
Enable Passwordless Login
Show the passwordless login form on the WordPress login page. When off, only the default login form is shown. It needs all three API credentials before it can be turned on.
Usage Tracking
Optional. When ticked, anonymous usage data (plugin version, activation status) is shared to help improve the plugin. No personal data or site content is collected, and you can untick it at any time.
API Credentials 4

Needed only for passwordless login and Google Authenticator.

Authyo App ID
The App ID of your Authyo application.
Authyo Client ID
The Client ID of your Authyo application.
Authyo Client Secret
The Client Secret. After saving, the field shows that it is saved. Leave it blank to keep it, or tick the remove option to delete it (this turns passwordless login off).
Authorized Endpoint
In your Authyo app, add your website address as an authorized endpoint. Without it the plugin cannot send or verify OTPs.
Security: custom login URL 3
Enable custom login URL
Block direct access to wp-login.php and wp-admin for logged-out visitors. Needs pretty permalinks.
Custom Login Slug
Your login address, for example my-secret-login. At least 3 characters. Only lowercase letters, numbers and hyphens, and it cannot start or end with a hyphen. Some reserved words are not allowed.
Hide Login Links
Login links that WordPress, your theme or other plugins show to logged-out visitors (a “Log in” menu link, the comment form or the Meta widget) point to the home page instead of revealing your custom login URL. On for new installs. Sites updated from version 1.0.10 keep their current links until they turn it on.
Security: XML-RPC and REST API 4
Block all XML-RPC requests (xmlrpc.php)
Blocks requests to xmlrpc.php, removes the X-Pingback header and hides XML-RPC discovery links. Whitelisted IPs are exempt. On Apache and LiteSpeed it uses .htaccess rules, and on Nginx a PHP fallback.
Block unauthenticated access to /wp/v2/users
Stops anonymous visitors from listing usernames through the REST API. Logged-in users and whitelisted IPs are not affected.
Block unauthenticated access to the REST API index (/wp-json/)
Hides the list of available REST routes from anonymous visitors.
Block unauthenticated access to author archives (?author=N)
Stops attackers finding usernames through addresses such as /?author=1. Anonymous visitors are sent to the home page.
Brute-Force 8

Failed logins are counted per IP address and per username. When a limit is reached, the IP or username is locked out for a while.

Enable brute-force login protection Default: On
The master switch for lockouts.
IP Lockout: failed attempts Default: 5
Lock an IP after this many failed logins within the time window.
IP Lockout: time window (minutes) Default: 30
The period in which failed attempts are counted.
Username Lockout: failed attempts Default: 10
Lock a username after this many failed logins from any IP. This stops attacks that spread across many IP addresses. Keep it higher than the IP limit.
Initial lockout duration (minutes) Default: 15
How long the first lockout lasts.
Progressive Lockout: multiplier Default: ×2
Each new lockout lasts this many times longer than the one before.
Maximum lockout duration (minutes) Default: 1440 (24 hours)
The longest a lockout can last.
Auto-Block Repeat Offenders: after lockouts Default: 3
An IP that has been locked out this many times is added to the blacklist permanently. It can be unblocked only from the IP Manager.
Google Auth 4
Set up authenticator
Each administrator sets up their own authenticator app by scanning a QR code and entering the 6-digit code. It works with Google Authenticator, Microsoft Authenticator, Authy, 1Password and other TOTP apps.
Test a code / Remove authenticator
Check that a code is accepted, or remove the authenticator from your account. You need to scan a new QR code to use it again.
Offer Google Authenticator on the login page
Shows the authenticator option only to administrators who have set it up, after their 3rd OTP error or straight away if the OTP service is unavailable. Saved immediately.
Administrators list
See which administrators have an authenticator, and remove one if someone loses their phone. Use Refresh from Authyo to update the status.
IP Manager 4
Whitelisted IPs
IP addresses that are never locked out by brute-force protection and are exempt from the XML-RPC and REST API blocks. Each has a label, who added it and when.
Blacklisted IPs
IP addresses that are blocked permanently and rejected immediately, before any credentials are checked.
Active & Recent Lockouts (last 24 hours)
Shows each locked IP or username, the lockout type, how many times it was locked and when it unlocks. You can unlock it or blacklist it permanently.
Add IP to Whitelist / Blacklist
Enter a valid IPv4 or IPv6 address and an optional label.
Security Logs 4
Log list
Every login, logout, failed attempt, lockout and blocked access, with the IP address, user agent and request URL. Use the search box and the date filters to find entries.
Export CSV
Download the logs for offline use.
Log Manager
The administrator who can change log settings, delete or clear logs, and add, remove or unlock IPs in the IP Manager. Other administrators have view-only access, and can still export the logs. Choose the manager under Security Logs → Log Settings.
Log Retention Default: 90 days
Logs older than this are deleted automatically every day. Choose 30, 60, 90, 180 or 365 days, or never delete.

Turn on passwordless OTP login

This part needs an Authyo account. The OTP is sent to the user’s email address.

  1. Create your Authyo account

    Go to app.authyo.io and create a free account.

  2. Copy your credentials

    Open your applications in the Authyo dashboard and copy the App ID, Client ID and Client Secret. Create an application first if you do not have one.

  3. Add your website as an Authorized Endpoint

    In your Authyo app, find the Authorized Endpoint section and add your website address.

    This is a security feature. Without it the plugin cannot send or verify OTPs.

  4. Enter the credentials in WordPress

    Go to Authyo Passwordless → Settings → API Credentials and fill in the Authyo App ID, Authyo Client ID and Authyo Client Secret, then save.

  5. Enable passwordless login

    Open the General tab, tick Enable Passwordless Login and save. The form now appears on the login page.

  6. Test it

    Open your login page in a private window, enter your email address, and complete the login with the code you receive.

Set up the Google Authenticator fallback

A backup way for administrators to sign in if the email code does not arrive. It needs your Authyo App ID, and your website added as an Authorized Endpoint (see above).

  1. Open the Google Auth tab

    Go to Authyo Passwordless → Settings → Google Auth. If the page asks for your credentials, add them under API Credentials first.

  2. Open your authenticator app

    Install Google Authenticator or any TOTP app on your phone, if you do not have one.

  3. Scan the QR code

    Click Set up authenticator. In the app, tap “+” and choose “Scan a QR code”, then scan the code on the screen.

  4. Enter the 6-digit code

    Type the code the app shows for your site and click Verify and finish. The status changes to Active.

  5. Turn on the login option

    Switch on Offer Google Authenticator on the login page. It is shown only to administrators who have set it up, after their 3rd wrong email code, or straight away if the OTP service is unavailable.

If you are locked out

Two safety exits are built in.

  1. Your IP address was blocked

    Add the line below to your wp-config.php file. It turns off all IP blocking and lockouts. Log in, remove your IP from the blacklist (or whitelist it) in IP Manager, then delete the line again.

    define( 'AUTHYO_DISABLE_IP_BLOCKING', true );

  2. You forgot your custom login URL

    Disable the plugin through FTP or your hosting file manager, for example by renaming the authyo-passwordless-login folder in wp-content/plugins. The default WordPress login returns. Then rename the folder back and set a new address.

Troubleshooting

Most problems have a quick fix. Find your issue below.

I blocked my own IP and cannot reach the login page
Add define( 'AUTHYO_DISABLE_IP_BLOCKING', true ); to wp-config.php. Log in, fix the IP lists in IP Manager, then remove the line. The steps are in “If you are locked out” above.
I forgot my custom login URL
Disable the plugin through FTP or the file manager to restore the default login, then set a new address. Always bookmark the custom URL after saving it.
My custom login URL shows a “not found” page
The custom login URL needs pretty permalinks. Go to Settings → Permalinks, choose any option other than “Plain”, and save. Check that the slug uses only lowercase letters, numbers and hyphens.
The passwordless login form does not appear
Check that Enable Passwordless Login is ticked in the General tab, and that the App ID, Client ID and Client Secret are all saved. Removing the Client Secret turns passwordless login off.
The OTP is not sent, or I see “Please check your API credentials”
Check the three credentials, make sure your website address is added as an Authorized Endpoint in your Authyo app, and that your Authyo account has credits. Without the authorized endpoint the plugin cannot send or verify OTPs.
I see “OTP already sent. Please wait … second(s)”
A code was requested a moment ago. Wait for the countdown, then request another.
I see “Too many OTP requests for this email address”
Each email address can request at most 5 OTP emails every 15 minutes. Wait 15 minutes and try again.
I see “Too many incorrect codes for this account”
The plugin allows 10 wrong codes per account every 15 minutes and 30 per day. Wait 15 minutes, or until the next day if the daily limit was reached.
I see “Too many incorrect attempts. Please go back and request a new OTP”
Each OTP allows 5 attempts. Request a new code.
I see “OTP session expired”
The code or session timed out. Request a new OTP and enter it promptly.
I see “Security check failed: Browser session mismatch”
The login link is tied to the browser that completed verification. Finish the login in the same browser where you entered the code.
Lockouts affect all my visitors, or my IP shows as private
Your site is probably behind a proxy or load balancer. The plugin never locks out private or unknown addresses. It reads the real visitor IP from Cloudflare (CF-Connecting-IP) and from proxies on a private network (X-Forwarded-For). For other setups, return the real IP with the authyo_passwordless_client_ip filter.
The Google Authenticator option is not on the login page
It is shown only to administrators who have set up an authenticator, and only after their 3rd wrong email code or when the OTP service is unavailable. Check that Offer Google Authenticator on the login page is on.
Logout does not work with the custom login URL
This was a bug in older versions. Update to version 1.0.11 or later.

Frequently asked questions

Do I need API keys for the security features?
No. Brute-force protection, the IP Manager, security logs, XML-RPC protection, REST API protection and the custom login URL all work without an Authyo account. You only need credentials for passwordless OTP login and Google Authenticator.
How does brute-force protection work?
The plugin counts failed logins per IP address and per username. When a limit is reached the IP or username is locked out for a while. Each new lockout lasts longer, and repeat offenders can be blacklisted permanently.
How does passwordless login work?
The user enters their email address, receives a one-time password by email, types it in and is logged in. No password is needed. It requires Authyo credentials.
Are OTP codes protected against guessing?
Yes. Each OTP allows 5 attempts, each account allows 10 wrong codes per 15 minutes and 30 per day, and each email address can request at most 5 OTP emails per 15 minutes. These limits apply even if brute-force protection is turned off. The login form also answers the same way whether or not an email address has an account.
How long are login tokens valid?
After the OTP is verified, the plugin creates a single-use login token that is tied to the browser and expires after 5 minutes. OTP session data is kept for 10 minutes.
What does XML-RPC protection do?
It blocks all requests to xmlrpc.php, removes the X-Pingback header and hides XML-RPC discovery links. Whitelisted IPs are exempt. Anything that relies on XML-RPC, such as some remote publishing tools and apps, stops working unless its IP is whitelisted.
What does REST API protection do?
It stops anonymous visitors from listing users, reading the REST API index and scanning author archives. Logged-in users and whitelisted IPs are not affected, and other plugins’ REST endpoints keep working.
Does it work behind Cloudflare or a proxy?
Yes. The plugin uses the connecting IP address, and reads CF-Connecting-IP for Cloudflare and X-Forwarded-For for proxies on a private network. Private and unknown addresses are never locked out or blacklisted.
Can I use it on a custom login page?
Yes. Use the [authyo_login] shortcode on any page, or call authyo_passwordless_login_form() in a theme template.
Who can delete logs and change IP lists?
Only the designated Log Manager, chosen under Security Logs → Log Settings. Other administrators have view-only access and can still export the logs.
How long are security logs kept?
You choose: 30, 60, 90, 180 or 365 days, or never delete. The default is 90 days.
What data goes to Authyo?
Only the passwordless login and Google Authenticator features contact Authyo. The user’s email address and the OTP are sent for sending and checking the code. All security features run locally on your server.

Still need help?

If you couldn’t find the answer in this guide, submit our support form and the Authyo team will get back to you.

Get support