ShivWeb Login Verification

ShivWeb Login Verification adds two-factor authentication (2FA) to your WordPress login using email codes. A user signs in with their password as usual, then the plugin emails them a short login code and holds the session until the code is entered. Someone who has stolen a password but cannot open the user’s inbox stays locked out.

There is no authenticator app to set up, no external service to sign up for, and no API keys. Codes are sent through your site’s own email, so any SMTP plugin you already use handles delivery, and everything runs on your server.

How a login works

1. The user enters their username and password as normal.
2. The plugin emails them a one time code (OTP) and holds the session.
3. They type the code on the verification screen and continue exactly where they were going.

Choose who needs a code

Enforcement is role based. Tick the roles that should verify and leave the rest alone. By default only the Customer role is gated, so a store can protect shopper accounts without changing how the team logs in. Users can also mark a browser as trusted for a number of days you choose, so regulars are not asked for a code on every visit.

Built so you cannot lock yourself out

Enforcement stays off until you prove email delivery works: the plugin asks you to send yourself a test code and enter it before the feature can be switched on. So a broken mailer can never lock everyone out. And if anything ever goes wrong later, one line in wp-config.php or one WP-CLI command turns everything off and releases every held session immediately.

Works with WooCommerce, including the block checkout

Most login verification plugins add a field to the login form. The WooCommerce block checkout never shows that field, because it signs customers in through the Store API in the background. This plugin works differently: it verifies the session after login, on the server, so wp-login.php, wp-admin, My Account, the classic checkout and the block checkout are all covered by the same check. Nothing depends on the browser, so it cannot be skipped by calling an endpoint directly.

Email verification at registration

Optionally require new sign-ups to confirm their email address with a code before their first session works. A small popup verifies the address right on the register form, checkout registrations are verified just after, and abandoned unverified accounts are cleaned up automatically after a grace period.

Features

• Two-factor authentication with email login codes, no authenticator app needed
• Role based enforcement: choose exactly which user roles must verify
• WooCommerce ready: My Account, classic checkout, and the block checkout
• Trusted devices: remember a browser for a number of days you choose
• Email verification for new registrations, with automatic cleanup
• Rate limiting on every layer: resend cooldown, attempt lockout, and per-account send caps
• Customizable email template and on-screen messages
• No external service, no API keys, no per-message fees, no tracking
• Recovery built in: a wp-config.php constant and WP-CLI commands

Recovery

If you ever lock yourself out, add define( 'SWLV_DISABLE_OTP', true ); to wp-config.php, or run wp swlv disable with WP-CLI. Both release every held session immediately. To unstick a single user (send limit reached, mailbox typo), run wp swlv reset-user <id|login|email>.