Title: Authyo Passwordless Login Author: Konceptwise Digital Media Pvt Ltd Published: 1 January 2026 Last modified: 1 October 2026 --- Search plugins ![](https://ps.w.org/authyo-passwordless-login/assets/banner-772x250.png?rev=3520880) ![](https://ps.w.org/authyo-passwordless-login/assets/icon-256x256.png?rev=3430366) # Authyo Passwordless Login By [Konceptwise Digital Media Pvt Ltd](https://profiles.wordpress.org/konceptwise/) [Download](https://downloads.wordpress.org/plugin/authyo-passwordless-login.1.0.11.zip) * [Details](https://en-gb.wordpress.org/plugins/authyo-passwordless-login/#description) * [Reviews](https://en-gb.wordpress.org/plugins/authyo-passwordless-login/#reviews) * [Installation](https://en-gb.wordpress.org/plugins/authyo-passwordless-login/#installation) * [Development](https://en-gb.wordpress.org/plugins/authyo-passwordless-login/#developers) [Support](https://wordpress.org/support/plugin/authyo-passwordless-login/) ## Description Authyo Passwordless Login is a WordPress login security plugin that protects your site with brute-force protection, IP blacklisting, security activity logs, XML-RPC blocking, REST API protection, and a custom login URL. All security features work immediately after activation — no API keys or account registration needed. Optionally, add Authyo API credentials to enable passwordless OTP login where users log in with a one-time password sent to their email instead of a traditional password. **Security features that work without API keys:** * **Brute-force protection** — Limit login attempts per IP and username with progressive lockout durations. Repeat offenders are automatically blacklisted. * **IP Manager** — Whitelist trusted IPs and blacklist attackers. Includes search, filter, pagination, and per-page selector for large lists. * **Security activity logs** — Track every login, logout, failed attempt, lockout, and blocked access. Includes request URL tracking, date filters, search, and CSV export. * **Disable XML-RPC** — Block xmlrpc.php requests at the server level using .htaccess rules. Removes X-Pingback headers and XML-RPC discovery links. Falls back to PHP blocking on Nginx. * **REST API Protection** — Restrict access to WordPress REST API endpoints for unauthenticated users. Prevents data enumeration and unauthorized access while keeping essential endpoints functional. * **Custom login URL** — Hide wp-login.php behind a custom URL slug to prevent automated attacks. * **Blocked IP logging** — Every access attempt from blacklisted or locked-out IPs is logged with IP address, user agent, and request URL. **Passwordless login features (requires free Authyo API keys):** * **Email OTP login** — Users receive a one-time password via email and log in without a traditional password. * **Google Authenticator fallback** — Server-side verified 2FA as a backup method after multiple OTP attempts. * **Secure login tokens** — Cryptographically generated, single-use, browser-bound tokens that expire after 5 minutes. * **AJAX-powered login** — Smooth login experience with no page reloads. ### Video Tutorial Learn how Authyo Passwordless Login works: ### How It Works **Security (works immediately after activation):** 1. Activate the plugin — brute-force protection and security logs start automatically 2. Go to Authyo Passwordless > Settings > Security tab 3. Enable XML-RPC Protection, REST API Protection, and Custom Login URL as needed 4. Visit Authyo Passwordless > Security Logs and IP Manager to monitor activity and manage IPs **Passwordless login (requires API keys):** 1. User enters their email on the WordPress login page 2. A one-time password (OTP) is sent to their email 3. User enters the OTP code 4. WordPress logs the user in automatically — no password required ### External Services This plugin connects to Authyo’s external API only for passwordless login and Google Authenticator features. All security features (brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, custom login URL) work locally without any external service. **OTP Authentication:** * User email address is sent to Authyo API when requesting an OTP * OTP code and Mask ID are sent to Authyo API for verification **Google Authenticator Verification:** * During setup (Google Auth tab), the admin’s email address is sent from your server to the Authyo API to create the authenticator link and return a QR code * The 6-digit authenticator code and the admin’s or user’s email address are sent from your server to the Authyo API for verification * No Authyo script is loaded in the browser; all calls are made server-side **Usage Tracking (Opt-In Only):** If the user explicitly opts in, plugin version, WordPress version, and site URL are sent when settings are saved. Deactivation feedback is sent when the plugin is deactivated. No tracking data is sent without user consent. **Authentication Flow:** * After OTP verification, the plugin generates a secure single-use token using WordPress core functions * Token is browser-bound using a hashed User-Agent signature to prevent session hijacking * Token is stored temporarily in WordPress transients (5-minute expiry) and deleted immediately after use **Data Storage:** * OTP session data stored temporarily in WordPress transients (10-minute expiry) * Login tokens stored temporarily in WordPress transients (5-minute expiry, single- use) * Security logs stored in a custom database table with configurable retention * IP whitelist and blacklist stored in a custom database table * No user data is permanently stored beyond security logs **Service URLs:** * API: [https://app.authyo.io/api/v1/](https://app.authyo.io/api/v1/) **Terms of Service:** [https://authyo.io/terms-service](https://authyo.io/terms-service) ** Privacy Policy:** [https://authyo.io/privacy-policy](https://authyo.io/privacy-policy) ## Screenshots [⌊Authyo WordPress Passwordless Login⌉⌊Authyo WordPress Passwordless Login⌉[ Authyo WordPress Passwordless Login [⌊Authyo WordPress Passwordless Login Admin Panel⌉⌊Authyo WordPress Passwordless Login Admin Panel⌉[ Authyo WordPress Passwordless Login Admin Panel ## Installation 1. Upload the `authyo-passwordless-login` folder to `/wp-content/plugins/` 2. Activate the plugin from the Plugins menu 3. Security features start working immediately 4. For passwordless login: go to Authyo Passwordless > Settings and enter your Authyo API credentials from [authyo.io](https://authyo.io) ## FAQ ### Do I need API keys to use the security features? No. Brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, and custom login URL all work without any API keys. You only need Authyo API keys for the passwordless OTP login feature. ### How does brute-force protection work? The plugin tracks failed login attempts per IP address and per username. After exceeding the configured threshold, the IP or username is temporarily locked out. Each subsequent lockout lasts longer (progressive durations). Repeat offenders can be automatically blacklisted permanently. ### What does REST API Protection do? It restricts access to WordPress REST API endpoints for unauthenticated users. By default, WordPress exposes REST API endpoints like /wp-json/wp/v2/users that can reveal usernames and other site data. When enabled, only logged-in users can access the REST API while essential public endpoints continue to work normally. ### What does XML-RPC protection do? It blocks all requests to xmlrpc.php at the server level using .htaccess rules on Apache and LiteSpeed servers. On Nginx servers, a PHP-level fallback handles the blocking. It also removes the X-Pingback header and XML-RPC discovery links. Whitelisted IPs are exempt. ### How does passwordless login work? Users enter their email address on the login page, receive a one-time password via email, enter the OTP code, and are logged in automatically. No password is needed. Requires Authyo API keys. ### How do I manage blocked IPs? Go to Authyo Passwordless > IP Manager. You can search by IP or label, filter, and paginate through whitelisted and blacklisted IPs. The page also shows active lockouts with options to unlock or permanently blacklist IPs. ### I blocked my own IP and can’t reach the login page. What do I do? Add `define( 'AUTHYO_DISABLE_IP_BLOCKING', true );` to your wp-config.php file. This temporarily turns off all IP blacklisting and lockouts. Log in, remove your IP from Authyo Passwordless > IP Manager (or whitelist it), then delete the line from wp-config.php again. ### My site is behind Cloudflare or a reverse proxy. Will lockouts work correctly? Yes. The plugin uses the connecting IP address, which cannot be faked. When a request really comes from a Cloudflare edge server it uses the `CF-Connecting-IP` header, and when it comes from a proxy on a private network it uses the `X-Forwarded-For` header, so each visitor is recognised individually. Private and unknown addresses are never locked out or blacklisted, so a shared proxy address cannot lock out all your visitors. For other setups, use the `authyo_passwordless_client_ip` filter to return the real visitor IP. ### Are OTP and authenticator codes protected against guessing? Yes. Each OTP or Google Authenticator session allows 5 attempts, each account allows 10 attempts per 15 minutes and 30 per day, and each email address can request at most 5 OTP emails per 15 minutes. These limits apply even when brute-force protection is turned off. The login form also answers the same way whether or not an email address has an account, so it cannot be used to discover accounts. ### Can I use this with custom login pages? Yes. Use the shortcode `[authyo_login]` on any page, or call `authyo_passwordless_login_form()` in your theme templates. ### Is this plugin secure? Yes. The plugin implements multiple security layers including XML-RPC blocking at server level, REST API protection, brute-force protection with progressive lockouts, nonce verification for all AJAX requests, cryptographically secure token generation, browser-bound single-use tokens, server-side Google Authenticator verification, open redirect prevention, and blocked IP logging. ## Reviews There are no reviews for this plugin. ## Contributors and Developers “Authyo Passwordless Login” is open source software. The following people have contributed to this plugin. Contributors * [ Konceptwise Digital Media Pvt Ltd ](https://profiles.wordpress.org/konceptwise/) [Translate “Authyo Passwordless Login” into your language.](https://translate.wordpress.org/projects/wp-plugins/authyo-passwordless-login) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/authyo-passwordless-login/), check out the [SVN repository](https://plugins.svn.wordpress.org/authyo-passwordless-login/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/authyo-passwordless-login/) by [RSS](https://plugins.trac.wordpress.org/log/authyo-passwordless-login/?limit=100&mode=stop_on_copy&format=rss). ## Change Log #### 1.0.11 * Fixed: Logout did not work when a custom login URL was enabled * Fixed: Failed-attempt counters did not reset after the configured time window * Security: Real visitor IP detected behind Cloudflare and private-network proxies; private addresses are never locked out or auto-blacklisted * Security: OTP and Google Authenticator forms no longer reveal which email addresses have accounts * Security: Daily limit on incorrect codes per account * Security: Login links are bound to the browser that completed verification * Security: REST user-enumeration block can no longer be bypassed; users sitemap and oEmbed author URLs hidden when author scanning is blocked * Security: Custom login URL no longer shown to logged-out visitors in login links * Security: Security log flooding protection, safer debug logging and more precise XML-RPC blocking * New: “Hide Login Links” option (Security tab). On for new installs; sites updating from 1.0.10 keep their current login links until they turn it on * Upgrade: Automatic blacklist entries for private/proxy addresses created by earlier versions are removed (manually added entries are kept) #### 1.0.10 * New: Google Authenticator setup with live status, per-administrator setup and an overview of all administrators * New: Google Authenticator login option shown only to accounts that have set it up * Improved: Plugin settings moved to a top-level “Authyo Passwordless” admin menu * Security hardening for OTP verification, login tokens and the custom login URL * Bug fixes and performance improvements #### 1.0.9 * Performance improvements #### 1.0.8 * Performance improvements #### 1.0.7 * Performance improvements and stability enhancements #### 1.0.6 * Added REST API Protection to restrict unauthorized access to WordPress REST API endpoints #### 1.0.5 * Added XML-RPC protection with server-level .htaccess blocking and PHP fallback * Added request URL tracking in security logs * Added blocked IP logging for blacklisted and locked-out access attempts * Added search and pagination to IP Manager with per-page selector (20, 50, 100) * Added whitelist and blacklist count summary in IP Manager * Added server-side verification for Google Authenticator * Migrated IP whitelist/blacklist data from wp_options to a dedicated database table * Improved login token security and validation * Improved redirect security across login flows * Fixed “page not found” issue with custom login URL after OTP verification * Fixed database compatibility with MySQL strict mode * Fixed database upgrade reliability on various server environments * Multiple security hardening improvements * General bug fixes and performance improvements #### 1.0.4 * Added new security logs feature #### 1.0.3 * Added video tutorial to readme * Improved Google Authenticator fallback logic to hide on non-existent users * Minor bug fixes #### 1.0.2 * Added two factor authenticator as backup method * Performance improvements #### 1.0.1 * Performance improvements * Screenshot addon #### 1.0.0 * Initial release * Passwordless login with OTP verification * Secure token-based authentication * WordPress login page integration * Custom login shortcode * Admin settings page * AJAX-powered login flow ## Meta * Version **1.0.11** * Last updated **2 weeks ago** * Active installations **10+** * WordPress version ** 5.0 or higher ** * Tested up to **7.1.3** * PHP version ** 7.2 or higher ** * Language * [English (US)](https://wordpress.org/plugins/authyo-passwordless-login/) * Tags * [brute force protection](https://en-gb.wordpress.org/plugins/tags/brute-force-protection/) [disable xmlrpc](https://en-gb.wordpress.org/plugins/tags/disable-xmlrpc/)[login security](https://en-gb.wordpress.org/plugins/tags/login-security/) [passwordless login](https://en-gb.wordpress.org/plugins/tags/passwordless-login/) [rest api security](https://en-gb.wordpress.org/plugins/tags/rest-api-security/) * [Advanced View](https://en-gb.wordpress.org/plugins/authyo-passwordless-login/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/authyo-passwordless-login/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/authyo-passwordless-login/reviews/) ## Contributors * [ Konceptwise Digital Media Pvt Ltd ](https://profiles.wordpress.org/konceptwise/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/authyo-passwordless-login/)