HDWebmobile OTP Login

HDWebmobile OTP Login adds a “Log in with a one-time code” option next to the normal password login on your My Account page. A customer enters their email, receives a 6-digit code, and enters it to log in — creating an account automatically if they don’t have one yet. It’s an addition to the existing password login, not a replacement.

What makes it different

• No SMS gateway, API key or third-party service. Codes are sent with WordPress’s own email, so no customer data leaves your site and there is nothing extra to pay for or sign up to.
• Built for WooCommerce’s My Account login. It adds a one-time-code option next to the normal password login instead of replacing it, so existing customers keep logging in the way they always have.
• Security first. A login session can only be created after the code has been verified — the exact step a weak OTP login gets wrong (see below).
• Free, with every feature included. There is no paid tier or upgrade.

Security by design

The most dangerous mistake an OTP login can make is a login handler that never actually confirms the OTP code was verified before creating a session — trusting a client-submitted email or phone number alone (CWE-287, Improper Authentication), which would let anyone log in as any user, including administrators, just by submitting their target’s email address. This plugin closes that failure mode by construction:

• A session is created from exactly one place in this plugin’s code, reached only after HDOTP_Repository::verify_and_consume() has already returned true — there is no second path, flag, or shortcut that can produce a login.
• The verification check compares a securely-hashed digest of the submitted code against the stored digest using hash_equals() (constant-time, so response timing can’t leak how many digits were correct) — never a plaintext comparison, and never trusting the submitted email by itself.
• The raw code is never stored anywhere; only an HMAC-SHA256 digest (keyed with WordPress’s own wp_salt('auth')) is kept, so reading the database can never recover a working code.
• Every code is single-use (consumed immediately on a correct match), expires after 10 minutes, and locks out after 5 incorrect attempts — closing off brute-forcing a 6-digit code long before it becomes practical.
• Requesting a new code invalidates any previous outstanding code for that email, so there is never more than one valid code at a time.

Key Features

• “Log in with a one-time code” option alongside the normal password login on My Account
• Automatically creates an account for a new email after the code is verified
• Single-use, time-limited, attempt-limited codes — no external SMS/OTP service required, works entirely over email
• Simple enable/disable toggle under WooCommerce > HDWebmobile > OTP Login

Limitations (please read before installing)

• Email-based codes only in this version — no SMS/phone verification
• Does not replace or remove the existing password login; it’s offered as an alternative

Enjoying this plugin?

If it helps your site, please consider leaving an honest review on WordPress.org — it helps other WordPress users find it. Found a problem or have an idea? Please open a support topic first so it can be fixed.

How to Use

1. Customer requests a code

On the My Account login page, a customer clicks “Log in with a one-time code”, enters their email, and clicks “Send code”.

2. Customer receives and enters the code

A 6-digit code arrives by email. The customer enters it and clicks “Verify and log in” — they’re logged in immediately (or a new account is created for them if they didn’t have one).

3. Turn it off if you don’t need it

Under WooCommerce > HDWebmobile > OTP Login, uncheck “Enable OTP login” to hide the option and disable the feature entirely.