VerifyPro Email OTP for WooCommerce

VerifyPro Email OTP for WooCommerce provides seamless email OTP verification for WooCommerce checkout and customer registration. Block bot orders, eliminate spam user registrations, and ensure valid customer data before orders or accounts are created.

Key Features

• 60-Second Anti-Spam Cooldown: Built-in client-side and server-side rate limiting to prevent email spamming and abuse.
• Guest-Only Verification: Option to bypass OTP verification for logged-in customers.
• COD-Only Verification: Restrict OTP verification exclusively to Cash on Delivery orders to eliminate fake COD orders (RTO loss) while keeping prepaid checkouts fast.
• Registration Form Protection: Verify customer email addresses on the WooCommerce My Account registration page prior to account creation.
• Granular Admin Customization: Dedicated settings under WooCommerce > Settings > Accounts & Privacy to configure OTP expiration duration, email subject, email heading, and brand accent color.
• Modern Executive UI: Clean, responsive security widget featuring inline SVGs, formatted numeric OTP inputs, dynamic brand accents, and clear status banners.
• HPOS Compatible: Fully compatible with WooCommerce High-Performance Order Storage (HPOS).
• Zero Third-Party Dependencies: Generates, stores, and validates OTP codes entirely on your server using native WordPress transients and sessions.

How It Works

1. Customer enters their email address at checkout or on the registration form.
2. The verification card smoothly appears with dynamic brand styling.
3. The customer clicks “Send Verification Code” and receives an email via your site’s standard mail handler.
4. The customer inputs the code and clicks “Verify Code”.
5. Upon successful verification, the form unlocks and the customer completes checkout or registration.

Security & Standards

• Nonce validation across all AJAX requests.
• Strict input sanitization and output escaping.
• Transient-based server storage with automatic expiration and cleanup.
• Compatible with WordPress and WooCommerce coding standards.

Privacy & Data

VerifyPro does not collect, store permanently, or transmit any data to external services. All processing happens on your own server.

• Verification codes: Each code is stored in a WordPress transient (in your site’s database) for the configured expiry time, and deleted after successful verification or expiry. Resend cooldown markers are transients that expire after 60 seconds. Transient keys use a hash of the email address, not the address itself.
• Verification status: Whether a visitor has verified their email is kept in the WooCommerce session, together with the verified email address. WooCommerce identifies the session with its own standard session cookie (wp_woocommerce_session_*). VerifyPro does not set any other cookies and has no tracking or analytics.
• Sending the code: The verification email is sent with wp_mail() through your site’s configured mail handler. If you use an external SMTP or email delivery service, the email is delivered through that service according to its own privacy policy. VerifyPro itself makes no external requests.