About this plugin
Logliy – Login Protect controls how users sign in: Passkeys (WebAuthn) first, with Email one-time codes and Magic Links as fallback, plus optional SSO (OpenID Connect) and an optional password path.
It is not a security suite and not a generic OTP plugin. Keep Wordfence (or similar) for WAF, brute-force lockouts, CAPTCHA, malware scanning, and classic TOTP 2FA. Logliy is the login-method layer on top.
Features
- Passkey login and registration (discoverable credentials, Conditional UI where available)
- Email OTP login via wp_mail
- Optional email address/domain allowlists with local-part wildcards for Email Code / Magic Link
- Shared account, IP and site email limits; atomic single-use codes and links
- Optional SSO email and signed group/role restrictions
- Security log with configurable retention and up to 10000 events
- Opt-in notifications for account, plugin, user and Logliy settings changes
- Magic link (one-click email) login
- Optional SSO via OpenID Connect (shown on the login form only when fully configured)
- Password login off by default, re-enable site-wide and/or per role / per user
- Role-based login/logout redirects
- Optional custom login URL (auto-disabled if WPS Hide Login or similar is active)
- Session length, Remember-me duration, admin idle timeout, session list and individual/all-session revocation
- Passkey count and last login in the standard WordPress Users list
- Optional custom login logo, brand, background, and footer
- Modern login UI on wp-login.php
- WooCommerce classic + Blocks My Account/Checkout login forms
- Cloudflare Turnstile compatible (verifies tokens on Passkey / Email OTP / Magic Link / SSO login)
- REST API namespace logliy/v1
- Rate limits for OTP, Passkey, and SSO auth
- Wordfence-friendly: fires wp_login_failed / wp_login and uses normal auth cookies
- Emergency override: define( 'LOGLIY_ALLOW_PASSWORD', true ); in wp-config.php
Wordfence compatibility
- Failed Logliy attempts trigger wp_login_failed so Wordfence lockouts still apply
- Successful Logliy logins use wp_set_auth_cookie + wp_login like a normal wp_signon
- Wordfence IP lockouts still run during passwordless login; Wordfence Login Security 2FA is skipped for Passkey / Email OTP / Magic Link / SSO (those methods already replace the password)
- Wordfence TOTP 2FA continues to apply on the classic password path
- Logliy does not remove Wordfence hooks globally — only suspends LS 2FA for the passwordless completion step
Cloudflare Turnstile
When Simple CAPTCHA with Cloudflare Turnstile (or equivalent) is enabled on the WordPress login form, Logliy requires a valid Turnstile token for Email OTP, Passkey, Magic Link, and SSO login. The password path continues to use the Turnstile plugin’s own authenticate check.
WooCommerce
- Classic My Account and Checkout login templates
- Guest checkout unchanged
- Does not block WooCommerce REST / Store API authentication
- Optional panel above Checkout and Customer Account blocks for guests
Requirements
- PHP 8.1+
- WordPress 6.4+
- HTTPS for Passkeys (localhost allowed for development)
- Composer production dependencies are vendored in release builds ( vendor-prefixed/ )
External services
This plugin can contact Cloudflare Turnstile only when a compatible Turnstile plugin is active and configured for the WordPress login form. Logliy does not load Turnstile by itself.
When a visitor completes passwordless login (Passkey, Email OTP, Magic Link, or SSO) while Turnstile is required, Logliy sends the Turnstile response token and the visitor IP to Cloudflare’s siteverify API so the challenge can be validated. No other personal data is sent to Cloudflare by Logliy.
This service is provided by Cloudflare: Terms of Use and Privacy Policy.
When SSO (OpenID Connect) is enabled, Logliy contacts the OpenID Provider you configure (Issuer / discovery, token, and JWKS URLs) so visitors can sign in with that identity provider. Logliy does not send login data to FloBa Media. The identity provider receives standard OpenID Connect authentication data (such as the authorization request and, after sign-in, token exchange).
Which personal data that provider stores is defined by that provider.
You must register this site’s Redirect URI at the provider and accept that provider’s own terms of service and privacy policy before enabling SSO.