About this plugin
LoginBerry bundles account verification, two-factor authentication (2FA), passwordless login, login logs, and optional last-login tracking. Each feature can be enabled or disabled independently. Outgoing codes are delivered by email.
The plugin works for standard WordPress sites. When WooCommerce is active, additional customer- and order-related options are available (for example 2FA on the My Account login form and optional account activation tied to orders).
User-facing behavior (when features are enabled)
- Account verification: After registration, the user signs in and completes activation on the configured activation page using a six-digit code sent by email.
- Two-factor authentication: After a successful username and password, the user enters a second code sent by email. Per-role modes are Required, Optional, or Disabled.
- Passwordless login: On wp-login.php, eligible roles may request a one-time email code instead of entering a password.
- Login logs: Success and failure records are listed in the WordPress admin.
- Last-login tracking: Successful login times can be recorded and displayed in a Last Login column under Users → All Users.
Authentication codes are email-based; end users do not install a separate authenticator app for the flows described here.
Account verification
- New accounts receive a six-digit activation code by email.
- After fifteen failed activation attempts, the account is locked until an administrator intervenes.
- Administrators can resend codes, activate accounts manually, and unlock accounts from Users → All Users.
Two-factor authentication (2FA)
- Per-role setting: Required, Optional, or Disabled.
- Optional mode allows users to enable 2FA from the profile when permitted by role.
- Supported on wp-login.php and on the WooCommerce My Account login form.
Passwordless login
Let users log in without a password – just enter a username or email and receive a one-time login code. Improves user experience while maintaining strong security through email verification.
- Toggle between password and passwordless login on wp-login.php
- One-time email codes on wp-login.php, controlled per role.
- When both passwordless login and 2FA are enabled for the same role, the passwordless flow does not require a separate 2FA step (email possession is already verified).
WooCommerce
- Optional automatic account activation when an WooCommerce order is created.
- Optional restriction so that only paid orders trigger activation.
- Integration points include classic checkout, block checkout (Store API), and paid-order completion hooks, as implemented in the plugin.
Login logs
Monitor all login activity on your site. Essential for detecting suspicious behavior and meeting security compliance requirements for e-commerce stores.
- Records successful and failed login attempts
- Logs username, email, IP address, and timestamp
- Stores login history in a dedicated database table for more efficient querying as the log grows
- View, search, filter, and delete logs from a dedicated admin page
- Optionally track each user’s most recent successful login and show it under Users → All Users
- Identify patterns of brute force attacks and suspicious login activity
- Audit trail for security compliance and fraud investigation
Last-login tracking can be enabled independently of full login logging under BerrySecure → LoginBerry → Login Logs.
Admin interface
- Centralized settings under BerrySecure → LoginBerry, with separate screens per feature.
Email templates
HTML email templates for activation, 2FA, and passwordless login ship in the plugin templates/ directory. To override, copy the desired template into the active theme or child theme under templates/loginberry/ (see each template file header for the exact path).
Email delivery
Reliable outbound email is required for codes to arrive. Typical setups use the hosting provider’s mail relay, a transactional email API (for example Brevo, Mailchimp Transactional / Mandrill, Postmark, SendGrid, Amazon SES), or a WordPress plugin that sends mail via SMTP or a provider API. Test delivery with a real signup or code request before relying on the feature in production.
Typical use cases
- Reducing unwanted or automated registrations and limiting abuse of disposable email addresses.
- Verifying that a customer or member controls the email address on file.
- Adding a second factor after password entry for selected roles.
- Reviewing login success and failure history in the admin.
- WooCommerce: applying optional post-order account activation, including a paid-order-only mode where configured.
Roadmap
LoginBerry is a brand new plugin and we are improving it quickly based on real user feedback. If you have ideas, feature requests, or run into a theme-specific styling issue, we would love to hear from you.
Planned work includes:
- Configurable failed-attempt limits (instead of the fixed fifteen for activation lockout)
- Custom activation page URL
- Custom redirect URL after successful verification
- Rate limiting on code verification attempts
- Social login options
- Improved styling flexibility and theme compatibility
Feedback and compatibility reports are welcome via the plugin support channels. New features are prioritized based on user feedback.