Logliy – Login Protect controls how users sign in: Passkeys (WebAuthn) first, with Email one-time codes and Magic Links as fallback, plus optional SSO (OpenID Connect) and an optional password path.

It is not a security suite and not a generic OTP plugin. Keep Wordfence (or similar) for WAF, brute-force lockouts, CAPTCHA, malware scanning, and classic TOTP 2FA. Logliy is the login-method layer on top.

Features

Passkey login and registration (discoverable credentials, Conditional UI where available)
Email OTP login via wp_mail
Magic link (one-click email) login
Optional SSO via OpenID Connect (shown on the login form only when fully configured)
Password login off by default, re-enable site-wide and/or per role / per user
Role-based login/logout redirects
Optional custom login URL (auto-disabled if WPS Hide Login or similar is active)
Session length, Remember-me duration, admin idle timeout, logout everywhere
Users overview (Passkeys + last login)
Optional custom login logo, brand, background, and footer
Modern login UI on wp-login.php
WooCommerce classic + Blocks My Account/Checkout login forms
Cloudflare Turnstile compatible (verifies tokens on Passkey / Email OTP / Magic Link / SSO login)
REST API namespace logliy/v1
Rate limits for OTP, Passkey, and SSO auth
Wordfence-friendly: fires wp_login_failed / wp_login and uses normal auth cookies
Emergency override: define( 'LOGLIY_ALLOW_PASSWORD', true ); in wp-config.php

Wordfence compatibility

Failed Logliy attempts trigger wp_login_failed so Wordfence lockouts still apply
Successful Logliy logins use wp_set_auth_cookie + wp_login like a normal wp_signon
Wordfence IP lockouts still run during passwordless login; Wordfence Login Security 2FA is skipped for Passkey / Email OTP / Magic Link / SSO (those methods already replace the password)
Wordfence TOTP 2FA continues to apply on the classic password path
Logliy does not remove Wordfence hooks globally — only suspends LS 2FA for the passwordless completion step

Cloudflare Turnstile

When Simple CAPTCHA with Cloudflare Turnstile (or equivalent) is enabled on the WordPress login form, Logliy requires a valid Turnstile token for Email OTP, Passkey, Magic Link, and SSO login. The password path continues to use the Turnstile plugin’s own authenticate check.

WooCommerce

Classic My Account and Checkout login templates
Guest checkout unchanged
Does not block WooCommerce REST / Store API authentication
Optional panel above Checkout and Customer Account blocks for guests

Requirements

PHP 8.1+
WordPress 6.4+
HTTPS for Passkeys (localhost allowed for development)
Composer production dependencies are vendored in release builds (vendor-prefixed/)

External services

This plugin can contact Cloudflare Turnstile only when a compatible Turnstile plugin is active and configured for the WordPress login form. Logliy does not load Turnstile by itself.

When a visitor completes passwordless login (Passkey, Email OTP, Magic Link, or SSO) while Turnstile is required, Logliy sends the Turnstile response token and the visitor IP to Cloudflare’s siteverify API so the challenge can be validated. No other personal data is sent to Cloudflare by Logliy.

This service is provided by Cloudflare: Terms of Use and Privacy Policy.

When SSO (OpenID Connect) is enabled, Logliy contacts the OpenID Provider you configure (Issuer / discovery, token, and JWKS URLs) so visitors can sign in with that identity provider. Logliy does not send login data to FloBa Media. The identity provider receives standard OpenID Connect authentication data (such as the authorization request and, after sign-in, token exchange). Which personal data that provider stores is defined by that provider.

You must register this site’s Redirect URI at the provider and accept that provider’s own terms of service and privacy policy before enabling SSO.

Logliy – Login Protect (Passkey, Email, SSO)