Description
This plugin enhances the default WordPress login security by adding a One-Time Password (OTP) verification step via email:
- Users log in with their regular email/username and password.
- If credentials are valid, an OTP is generated and emailed to the user.
- A popup is shown on the same login page (
wp-login.php) to enter the OTP. - Once the correct OTP is entered, the user is logged in.
To help you get started, there’s a comprehensive video tutorial available that guides you through the process of setting.
Features
- Secure login via OTP sent to user’s email.
- Role-based OTP enforcement.
- Uses native wp-login.php form — no custom forms required.
- Session-based OTP handling for security.
- Expiring OTP (default: 40 seconds).
- No third-party dependencies.
Donate
If you find this plugin useful and want to support its development, you can make a donation via the following link:
Your donation helps to ensure that this plugin remains free and receives regular updates!
Credits
The plugin development was supported by [webnotics], [sumitkamboj53]. Contributions and feedback are always welcome.
Documentation and Support
Documentation
For detailed documentation, visit https://webnotics.org/email-otp-login-with-default-login-form/
For support, please contact us at support@webnotics.solutions.
License
This plugin is licensed under the GPLv2 or later.
Screenshots
OTP entry modal on wp-login.php. 
Role-based OTP settings page in WordPress admin. 
Error message when OTP is invalid or expired
Installation
- Upload the plugin files to the
/wp-content/plugins/email-otp-login-with-default-login-formdirectory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the ‘Plugins’ screen in WordPress.
- Navigate to Settings Email OTP Settings to select which user roles require OTP login verification.
FAQ
-
Does this plugin work with custom login forms?
-
No. This plugin is designed to work only with the default
wp-login.phpform. -
Can I enable OTP only for specific roles?
-
Yes. Go to Settings Email OTP Settings and select the roles you want to enforce OTP for.
-
Is the OTP stored securely?
-
OTP is stored in the PHP session temporarily and cleared after use or expiration.
-
What happens if the OTP expires?
-
The user will be redirected back to the login page and asked to log in again.
Reviews
Contributors & Developers
“Email OTP Login with default login form” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Email OTP Login with default login form” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- Initial release with OTP popup, email sending, and expiration logic
1.0.2
Release Date 17th June 2025
* Update email template design *