XeroWP
Propusk Login by Phone with VK ID and Yandex ID (406-FZ)
Propusk Login by Phone with VK ID and Yandex ID (406-FZ)

Propusk Login by Phone with VK ID and Yandex ID (406-FZ)

0/5 (0 ratings) — active installs Updated Nov 5, 2026
loginphone loginsmsvk idyandex id
Download v1.0.3 Plugin Website
Login page with phone, VK ID and Yandex ID buttons.

Login page with phone, VK ID and Yandex ID buttons.

In Russian the plugin is called «Вход 406-ФЗ». Propusk is an independent plugin by wp-addon.ru and is not affiliated with, endorsed or sponsored by VK or Yandex; VK ID and Yandex ID are trademarks of their owners.

Since 1 December 2023, Federal Law No. 406-FZ of 31 July 2023, which amended the law “On Information” (149-FZ), allows website owners to authorize users from Russia only by a Russian phone number, through Gosuslugi (ESIA), the Unified Biometric System, or a Russian information system with verified users such as VK ID or Yandex ID. Registration by e-mail alone does not meet this requirement.

Since 7 July 2026, article 13.55 of the Russian Code of Administrative Offences sets fines for letting users sign in through foreign services (Google, Apple ID, foreign e-mail): 500,000–700,000 RUB for companies.

Propusk adds these login methods to a regular WordPress site:

  • Phone number — the visitor enters a Russian mobile number and confirms it with a code sent by SMS, or by calling a free number (the call is dropped automatically). Works with the SMS.ru service.
  • VK ID — login with a VK, OK or Mail.ru account (OAuth 2.1 with PKCE, no client secret is stored).
  • Yandex ID — login with a Yandex account.
  • Automatic registration — if there is no account with this phone or VK ID / Yandex ID yet, it is created on first login, but only when “Anyone can register” is enabled in Settings General. New accounts always get a role without editing rights (Subscriber or a similar read-only role such as Customer). Name, e-mail and phone are taken from the service when the user allows it.
  • Turn off e-mail-only registration — the WordPress registration form shows only the new methods.
  • Password login for staff only — optionally, only administrators and editors keep logging in with a password; everyone else uses the phone, VK ID or Yandex ID.
  • Profile section — users link and unlink their phone, VK ID and Yandex ID in their profile, so existing accounts can switch to the new methods.
  • Shortcode [propusk] — put the login block on any page.
  • Protection — a user is signed in only after the phone code (or call) is confirmed or VK ID / Yandex ID returns a verified account; the OAuth state is bound to the browser and to the current user, linking from the profile requires a nonce. Codes are stored hashed, expire in 5 minutes, allow 5 attempts, can be resent after a minute, and the number of codes per phone and per IP address is limited per hour. Administrator accounts are never linked automatically by e-mail.

The plugin is free and has no limits. An optional paid add-on, “Propusk Pro”, is sold separately on wp-addon.ru and adds login through the MAX messenger, WooCommerce My Account and checkout integration, SMSC and SMS Aero, a second login step for administrators, a login journal and a pop-up login button. The free plugin does not contain any locked features.

The plugin does not provide legal advice and does not guarantee compliance; it gives you the login methods listed in the law.

External services

The plugin connects to the following third-party services only after you enable and configure them on the settings page.

SMS.ru (https://sms.ru/) — sends login codes by SMS and runs phone verification by call.
When a visitor requests a code, the plugin sends the phone number, the text of the message with the code, and the visitor’s IP address (used by SMS.ru for anti-fraud protection) to https://sms.ru/sms/send or https://sms.ru/callcheck/add, and checks the call status at https://sms.ru/callcheck/status. On the settings page the “Check key” button requests the account balance from https://sms.ru/my/balance. Your API key is sent with every request.
Terms of service and personal data processing: https://sms.ru/oferta

VK ID (https://id.vk.com/) — login with a VK account.
When a visitor clicks “VK ID”, they are redirected to https://id.vk.ru/authorize. After the visitor allows access, the plugin exchanges the one-time code for a token at https://id.vk.ru/oauth2/auth and requests the user’s ID, name, e-mail and phone at https://id.vk.ru/oauth2/user_info. Your app ID is sent with these requests.
Terms of use: https://vk.com/terms — Privacy policy: https://vk.com/privacy

Yandex ID (https://yandex.ru/id/) — login with a Yandex account.
When a visitor clicks “Yandex ID”, they are redirected to https://oauth.yandex.ru/authorize. After the visitor allows access, the plugin exchanges the one-time code for a token at https://oauth.yandex.ru/token (your ClientID and Client secret are sent) and requests the user’s ID, name, e-mail and phone at https://login.yandex.ru/info.
Terms of use: https://yandex.ru/legal/rules/ — Privacy policy: https://yandex.ru/legal/confidential/

No data is sent to the plugin author.

Developers

Filters: prps/methods, prps/providers (add your own SMS gateway), prps/valid_phone, prps/button_url, prps/before_login, prps/route, prps/settings_defaults, prps/save_settings, prps/admin_tabs.
Actions: prps/loaded, prps/widget (login block rendered, enqueue your assets), prps/signed_in, prps/registered, prps/linked, prps/admin_tab, prps/provider_fields.
User meta: prps_phone (79XXXXXXXXX), prps_vk, prps_yandex.