# Authyo Passwordless Login

> Protect your WordPress login with brute-force protection, an IP manager, security logs, XML-RPC and REST API protection and a custom login URL. Optionally add passwordless login by email OTP.

Source: https://authyo.io/authyo-docs/authyo-passwordless-login/

## At a glance

- **What it does:** Secures the WordPress login and adds optional passwordless login with an email one-time password (OTP).
- **Works without an account:** Brute-force protection, IP Manager, security logs, XML-RPC protection, REST API protection and the custom login URL work as soon as you activate the plugin.
- **Needs an Authyo account:** Only for passwordless OTP login and the Google Authenticator fallback. You need an App ID, Client ID and Client Secret.
- **OTP channel:** Email.
- **You need:** WordPress 5.0+ and PHP 7.2+.
- **Settings location:** WordPress admin, under **Authyo Passwordless** (Settings, IP Manager and Security Logs).
- **Shortcode:** `[authyo_login]`, or `authyo_passwordless_login_form()` in a theme template.
- **Get the plugin:** [WordPress.org: Authyo Passwordless Login](https://wordpress.org/plugins/authyo-passwordless-login/)

## Overview

**Authyo Passwordless Login** is a login security plugin for WordPress. It protects your site against brute-force attacks, lets you block or allow specific IP addresses, records login activity, and can hide or block common entry points such as `xmlrpc.php`, the REST API user list and `wp-login.php`.

On top of that, you can switch on passwordless login. Users enter their email address, receive a one-time password (OTP) and are signed in without typing a password. All the security features run on your own server. Only the OTP login and the Google Authenticator fallback use the Authyo service.

- **Brute-force protection:** Limit failed logins per IP address and per username, with lockouts that get longer each time. Repeat offenders can be blacklisted automatically.
- **IP Manager:** Whitelist trusted IPs and blacklist attackers. Search, filter and unlock IPs from one screen.
- **Security logs:** Track logins, logouts, failed attempts, lockouts and blocked access. Filter by date, search, and export to CSV.
- **XML-RPC protection:** Block requests to `xmlrpc.php`, remove the pingback header and hide discovery links.
- **REST API protection:** Stop anonymous visitors from listing users or reading the REST API index. Other plugins’ endpoints keep working.
- **Custom login URL:** Hide `wp-login.php` behind a login address only you know.
- **Passwordless OTP login:** Users sign in with a one-time password sent to their email. Login tokens are single-use and tied to the browser.
- **Google Authenticator fallback:** A backup way for administrators to sign in with an authenticator app if the email code does not work.

## Requirements

- WordPress **5.0** or later and PHP **7.2** or later.
- No account is needed for the security features.
- For passwordless OTP login and Google Authenticator: an **Authyo account** with an application, and its **App ID**, **Client ID** and **Client Secret**.
- For the same features: your website address added as an **Authorized Endpoint** in your Authyo app.

## Installation

The security features start working as soon as the plugin is active.

### Step 1: Install the plugin
Go to **Plugins → Add New**, search for **Authyo Passwordless Login**, then click **Install Now**. You can also upload the plugin ZIP using **Plugins → Add New → Upload Plugin**.

### Step 2: Activate it
Click **Activate**. Brute-force protection and security logs start automatically.

### Step 3: Open the plugin menu
A top-level **Authyo Passwordless** item appears in the WordPress admin menu. It has three pages: **Settings**, **IP Manager** and **Security Logs**.

## Secure your site

These steps need no Authyo account. Open **Authyo Passwordless → Settings**. The settings are grouped in tabs: **General**, **Security**, **Brute-Force**, **API Credentials**, **Google Auth** and **Support**.

### Step 1: Check brute-force protection
Open the **Brute-Force** tab. Protection is on by default. Review the limits and adjust them if you wish. See the settings reference below for what each value does.

### Step 2: Turn on the Security options
Open the **Security** tab and switch on what you need: **Block all XML-RPC requests**, the three REST API and author-scan blocks, and the **Custom Login URL**.

### Step 3: Set a custom login URL (optional)
Switch on the custom login URL and enter a slug, for example `my-secret-login`. Use at least 3 characters: lowercase letters, numbers and hyphens only. Save, then **bookmark your new login address**. The custom login URL needs pretty permalinks, so choose any option except “Plain” in **Settings → Permalinks**.

_With the custom login URL on, `wp-login.php` and `wp-admin` send logged-out visitors to the home page. If you forget the new address, you can restore the default login by disabling the plugin through FTP or your hosting file manager._

### Step 4: Add your own IP to the whitelist
Open **Authyo Passwordless → IP Manager** and add your own IP address to the whitelist, so you cannot lock yourself out. The page shows your current IP address.

### Step 5: Watch the activity
Open **Authyo Passwordless → Security Logs** to see logins, failed attempts and lockouts as they happen.

## How to use it

Once passwordless login is on (see the next section), the login page shows the OTP form. You can also add the form to any page.

### Step 1: Use the login page
With passwordless login switched on, the WordPress login page shows the OTP form. When it is switched off, only the default WordPress login form is shown.

### Step 2: Add the form to a custom page
Create a page, add a Shortcode block with the code below, and publish it.

```
[authyo_login]
```

### Step 3: Add the form to a theme template
Developers can output the form from a theme file with this PHP function.

```
<?php authyo_passwordless_login_form(); ?>
```

### Step 4: What users do
The user enters their email address and requests a code. They receive a one-time password by email, type it in, and are logged in. No password is needed.

### Step 5: Manage blocked IPs
In **IP Manager**, search the whitelist and blacklist, and see the lockouts from the last 24 hours. From there you can unlock an IP or blacklist it permanently.

## Settings reference

Every setting in the plugin, grouped by where you find it. Default values are shown next to the setting name.

### General

- **Enable Passwordless Login**: Show the passwordless login form on the WordPress login page. When off, only the default login form is shown. It needs all three API credentials before it can be turned on.
- **Usage Tracking**: Optional. When ticked, anonymous usage data (plugin version, activation status) is shared to help improve the plugin. No personal data or site content is collected, and you can untick it at any time.

### API Credentials

Needed only for passwordless login and Google Authenticator.

- **Authyo App ID**: The App ID of your Authyo application.
- **Authyo Client ID**: The Client ID of your Authyo application.
- **Authyo Client Secret**: The Client Secret. After saving, the field shows that it is saved. Leave it blank to keep it, or tick the remove option to delete it (this turns passwordless login off).
- **Authorized Endpoint**: In your Authyo app, add your website address as an authorized endpoint. Without it the plugin cannot send or verify OTPs.

### Security: custom login URL

- **Enable custom login URL**: Block direct access to `wp-login.php` and `wp-admin` for logged-out visitors. Needs pretty permalinks.
- **Custom Login Slug**: Your login address, for example `my-secret-login`. At least 3 characters. Only lowercase letters, numbers and hyphens, and it cannot start or end with a hyphen. Some reserved words are not allowed.
- **Hide Login Links**: Login links that WordPress, your theme or other plugins show to logged-out visitors (a “Log in” menu link, the comment form or the Meta widget) point to the home page instead of revealing your custom login URL. On for new installs. Sites updated from version 1.0.10 keep their current links until they turn it on.

### Security: XML-RPC and REST API

- **Block all XML-RPC requests (xmlrpc.php)**: Blocks requests to `xmlrpc.php`, removes the X-Pingback header and hides XML-RPC discovery links. Whitelisted IPs are exempt. On Apache and LiteSpeed it uses `.htaccess` rules, and on Nginx a PHP fallback.
- **Block unauthenticated access to /wp/v2/users**: Stops anonymous visitors from listing usernames through the REST API. Logged-in users and whitelisted IPs are not affected.
- **Block unauthenticated access to the REST API index (/wp-json/)**: Hides the list of available REST routes from anonymous visitors.
- **Block unauthenticated access to author archives (?author=N)**: Stops attackers finding usernames through addresses such as `/?author=1`. Anonymous visitors are sent to the home page.

### Brute-Force

Failed logins are counted per IP address and per username. When a limit is reached, the IP or username is locked out for a while.

- **Enable brute-force login protection** (Default: On): The master switch for lockouts.
- **IP Lockout: failed attempts** (Default: 5): Lock an IP after this many failed logins within the time window.
- **IP Lockout: time window (minutes)** (Default: 30): The period in which failed attempts are counted.
- **Username Lockout: failed attempts** (Default: 10): Lock a username after this many failed logins from any IP. This stops attacks that spread across many IP addresses. Keep it higher than the IP limit.
- **Initial lockout duration (minutes)** (Default: 15): How long the first lockout lasts.
- **Progressive Lockout: multiplier** (Default: ×2): Each new lockout lasts this many times longer than the one before.
- **Maximum lockout duration (minutes)** (Default: 1440 (24 hours)): The longest a lockout can last.
- **Auto-Block Repeat Offenders: after lockouts** (Default: 3): An IP that has been locked out this many times is added to the blacklist permanently. It can be unblocked only from the IP Manager.

### Google Auth

- **Set up authenticator**: Each administrator sets up their own authenticator app by scanning a QR code and entering the 6-digit code. It works with Google Authenticator, Microsoft Authenticator, Authy, 1Password and other TOTP apps.
- **Test a code / Remove authenticator**: Check that a code is accepted, or remove the authenticator from your account. You need to scan a new QR code to use it again.
- **Offer Google Authenticator on the login page**: Shows the authenticator option only to administrators who have set it up, after their 3rd OTP error or straight away if the OTP service is unavailable. Saved immediately.
- **Administrators list**: See which administrators have an authenticator, and remove one if someone loses their phone. Use **Refresh from Authyo** to update the status.

### IP Manager

- **Whitelisted IPs**: IP addresses that are never locked out by brute-force protection and are exempt from the XML-RPC and REST API blocks. Each has a label, who added it and when.
- **Blacklisted IPs**: IP addresses that are blocked permanently and rejected immediately, before any credentials are checked.
- **Active & Recent Lockouts (last 24 hours)**: Shows each locked IP or username, the lockout type, how many times it was locked and when it unlocks. You can unlock it or blacklist it permanently.
- **Add IP to Whitelist / Blacklist**: Enter a valid IPv4 or IPv6 address and an optional label.

### Security Logs

- **Log list**: Every login, logout, failed attempt, lockout and blocked access, with the IP address, user agent and request URL. Use the search box and the date filters to find entries.
- **Export CSV**: Download the logs for offline use.
- **Log Manager**: The administrator who can change log settings, delete or clear logs, and add, remove or unlock IPs in the IP Manager. Other administrators have view-only access, and can still export the logs. Choose the manager under **Security Logs → Log Settings**.
- **Log Retention** (Default: 90 days): Logs older than this are deleted automatically every day. Choose 30, 60, 90, 180 or 365 days, or never delete.

## Turn on passwordless OTP login

This part needs an Authyo account. The OTP is sent to the user’s email address.

### Step 1: Create your Authyo account
Go to [app.authyo.io](https://app.authyo.io/account/welcome) and create a free account.

### Step 2: Copy your credentials
Open [your applications](https://app.authyo.io/application/userapplication) in the Authyo dashboard and copy the **App ID**, **Client ID** and **Client Secret**. Create an application first if you do not have one.

### Step 3: Add your website as an Authorized Endpoint
In your Authyo app, find the **Authorized Endpoint** section and add your website address.

_This is a security feature. Without it the plugin cannot send or verify OTPs._

### Step 4: Enter the credentials in WordPress
Go to **Authyo Passwordless → Settings → API Credentials** and fill in the **Authyo App ID**, **Authyo Client ID** and **Authyo Client Secret**, then save.

### Step 5: Enable passwordless login
Open the **General** tab, tick **Enable Passwordless Login** and save. The form now appears on the login page.

### Step 6: Test it
Open your login page in a private window, enter your email address, and complete the login with the code you receive.

## Set up the Google Authenticator fallback

A backup way for administrators to sign in if the email code does not arrive. It needs your Authyo App ID, and your website added as an Authorized Endpoint (see above).

### Step 1: Open the Google Auth tab
Go to **Authyo Passwordless → Settings → Google Auth**. If the page asks for your credentials, add them under **API Credentials** first.

### Step 2: Open your authenticator app
Install Google Authenticator or any TOTP app on your phone, if you do not have one.

### Step 3: Scan the QR code
Click **Set up authenticator**. In the app, tap “+” and choose “Scan a QR code”, then scan the code on the screen.

### Step 4: Enter the 6-digit code
Type the code the app shows for your site and click **Verify and finish**. The status changes to **Active**.

### Step 5: Turn on the login option
Switch on **Offer Google Authenticator on the login page**. It is shown only to administrators who have set it up, after their 3rd wrong email code, or straight away if the OTP service is unavailable.

## If you are locked out

Two safety exits are built in.

### Step 1: Your IP address was blocked
Add the line below to your `wp-config.php` file. It turns off all IP blocking and lockouts. Log in, remove your IP from the blacklist (or whitelist it) in **IP Manager**, then delete the line again.

```
define( 'AUTHYO_DISABLE_IP_BLOCKING', true );
```

### Step 2: You forgot your custom login URL
Disable the plugin through FTP or your hosting file manager, for example by renaming the `authyo-passwordless-login` folder in `wp-content/plugins`. The default WordPress login returns. Then rename the folder back and set a new address.

## Troubleshooting

### I blocked my own IP and cannot reach the login page
Add `define( 'AUTHYO_DISABLE_IP_BLOCKING', true );` to `wp-config.php`. Log in, fix the IP lists in **IP Manager**, then remove the line. The steps are in “If you are locked out” above.

### I forgot my custom login URL
Disable the plugin through FTP or the file manager to restore the default login, then set a new address. Always bookmark the custom URL after saving it.

### My custom login URL shows a “not found” page
The custom login URL needs pretty permalinks. Go to **Settings → Permalinks**, choose any option other than “Plain”, and save. Check that the slug uses only lowercase letters, numbers and hyphens.

### The passwordless login form does not appear
Check that **Enable Passwordless Login** is ticked in the General tab, and that the App ID, Client ID and Client Secret are all saved. Removing the Client Secret turns passwordless login off.

### The OTP is not sent, or I see “Please check your API credentials”
Check the three credentials, make sure your website address is added as an **Authorized Endpoint** in your Authyo app, and that your Authyo account has credits. Without the authorized endpoint the plugin cannot send or verify OTPs.

### I see “OTP already sent. Please wait … second(s)”
A code was requested a moment ago. Wait for the countdown, then request another.

### I see “Too many OTP requests for this email address”
Each email address can request at most 5 OTP emails every 15 minutes. Wait 15 minutes and try again.

### I see “Too many incorrect codes for this account”
The plugin allows 10 wrong codes per account every 15 minutes and 30 per day. Wait 15 minutes, or until the next day if the daily limit was reached.

### I see “Too many incorrect attempts. Please go back and request a new OTP”
Each OTP allows 5 attempts. Request a new code.

### I see “OTP session expired”
The code or session timed out. Request a new OTP and enter it promptly.

### I see “Security check failed: Browser session mismatch”
The login link is tied to the browser that completed verification. Finish the login in the same browser where you entered the code.

### Lockouts affect all my visitors, or my IP shows as private
Your site is probably behind a proxy or load balancer. The plugin never locks out private or unknown addresses. It reads the real visitor IP from Cloudflare (`CF-Connecting-IP`) and from proxies on a private network (`X-Forwarded-For`). For other setups, return the real IP with the `authyo_passwordless_client_ip` filter.

### The Google Authenticator option is not on the login page
It is shown only to administrators who have set up an authenticator, and only after their 3rd wrong email code or when the OTP service is unavailable. Check that **Offer Google Authenticator on the login page** is on.

### Logout does not work with the custom login URL
This was a bug in older versions. Update to version 1.0.11 or later.

## Frequently asked questions

### Do I need API keys for the security features?
No. Brute-force protection, the IP Manager, security logs, XML-RPC protection, REST API protection and the custom login URL all work without an Authyo account. You only need credentials for passwordless OTP login and Google Authenticator.

### How does brute-force protection work?
The plugin counts failed logins per IP address and per username. When a limit is reached the IP or username is locked out for a while. Each new lockout lasts longer, and repeat offenders can be blacklisted permanently.

### How does passwordless login work?
The user enters their email address, receives a one-time password by email, types it in and is logged in. No password is needed. It requires Authyo credentials.

### Are OTP codes protected against guessing?
Yes. Each OTP allows 5 attempts, each account allows 10 wrong codes per 15 minutes and 30 per day, and each email address can request at most 5 OTP emails per 15 minutes. These limits apply even if brute-force protection is turned off. The login form also answers the same way whether or not an email address has an account.

### How long are login tokens valid?
After the OTP is verified, the plugin creates a single-use login token that is tied to the browser and expires after 5 minutes. OTP session data is kept for 10 minutes.

### What does XML-RPC protection do?
It blocks all requests to `xmlrpc.php`, removes the X-Pingback header and hides XML-RPC discovery links. Whitelisted IPs are exempt. Anything that relies on XML-RPC, such as some remote publishing tools and apps, stops working unless its IP is whitelisted.

### What does REST API protection do?
It stops anonymous visitors from listing users, reading the REST API index and scanning author archives. Logged-in users and whitelisted IPs are not affected, and other plugins’ REST endpoints keep working.

### Does it work behind Cloudflare or a proxy?
Yes. The plugin uses the connecting IP address, and reads `CF-Connecting-IP` for Cloudflare and `X-Forwarded-For` for proxies on a private network. Private and unknown addresses are never locked out or blacklisted.

### Can I use it on a custom login page?
Yes. Use the `[authyo_login]` shortcode on any page, or call `authyo_passwordless_login_form()` in a theme template.

### Who can delete logs and change IP lists?
Only the designated Log Manager, chosen under **Security Logs → Log Settings**. Other administrators have view-only access and can still export the logs.

### How long are security logs kept?
You choose: 30, 60, 90, 180 or 365 days, or never delete. The default is 90 days.

### What data goes to Authyo?
Only the passwordless login and Google Authenticator features contact Authyo. The user’s email address and the OTP are sent for sending and checking the code. All security features run locally on your server.

## Support

If this guide does not answer your question, submit the support form: https://authyo.io/support/