Email/SMS Verification (OTP)

OTP Login adds a verification code step after users enter their password. They receive a 6-digit code via email or SMS, enter it, and then complete login. No authenticator app required — just the familiar experience users know from banking and other services.

Use Cases#

• Add two-step verification without requiring apps
• Use familiar code-based verification users understand
• Deliver codes via email (built-in) or SMS (Twilio)
• Protect high-value accounts with minimal friction

How It Works#

1. User enters username and password
2. Credentials are verified (correct password required)
3. Module sends 6-digit code via email or SMS
4. User enters code on verification screen
5. Correct code completes login
6. Code expires after configured time

Difference from 2FA#

Settings#

Email Delivery#

Email codes use WordPress’s built-in mail function:

• Works out of the box with no configuration
• Delivery depends on your email setup (SMTP recommended)
• Customize email template in module settings

SMS Delivery (Twilio)#

For SMS delivery, configure Twilio integration:

1. Create a Twilio account
2. Get a phone number with SMS capability
3. Copy Account SID, Auth Token, and Phone Number
4. Enter credentials in module settings
5. Users must have phone numbers in their profiles

Security Features#

Role-Based Verification#

Choose which roles require OTP verification:

• Require for administrators and editors only
• Skip for subscribers to reduce friction
• Apply to all roles for maximum security

Users in non-required roles log in with just their password.

CAPTCHA Integration#

OTP Login integrates with Switchboard CAPTCHA modules to protect the verification form from brute force:

• Cloudflare Turnstile
• Google reCAPTCHA
• Simple CAPTCHA

Enable “Protect OTP Login” in your CAPTCHA module settings.

FAQ#