T2F Two-Screen Login Form

Most front-end login forms put the email and password on one screen. Big consumer

sites (Amazon, Google, PayPal…) split it in two: you type your email, press

Continue, and only then are you asked for your password.

T2F Two-Screen Login Form brings that flow to WordPress as a shortcode you can drop on

any page:

[two_step_login]

How it works

• Step 1 — identifier. The visitor enters their email (optionally username too)

and presses Continue. By default this transition happens entirely in the

browser — no server request — so the endpoint only ever sees the final submit.

• Step 2 — password. The email is shown with a Change link back to step 1.

The visitor enters their password, optionally ticks Remember me, and signs in.

• On success the browser is redirected (to?redirect_to= if present and on-site,

otherwise to the page you configure — the WooCommerce account page by default,

or the site home).

Everything happens without a full page reload until the final redirect.

Keeping the load down

Because step 1 is resolved client-side, a normal sign-in makes exactly one

php call. Failed password attempts are rate-limited per IP address

and per email in a short rolling window before WordPress authentication runs,

and an off-screen honeypot field plus a minimum fill-time check drop obvious bot

submissions without the (CPU-heavy) password hash. Together these keep

credential-stuffing traffic from turning the login page into a load problem.

(When Unknown accounts is set to reveal missing accounts, step 1 still needs a

)

Privacy

By default the two possible step-1 responses are identical whether or not an account

exists, and failed logins return a single generic message — so the form cannot be

used to discover which email addresses have accounts. A setting lets you turn on

explicit “no account found” messages if you prefer Amazon’s behaviour.

Settings (Settings → Two-Screen Login)

• First step accepts — email only, or email or username.

• Unknown accounts — stay silent (default) or say when no account matches.

• Rate limiting — throttle repeated failed logins per IP / email (on by default).

• Redirect after login — a URL, or blank for the account page / home.

• Lost-password URL — a URL, or blank for the default WordPress reset page.

For developers

add_filter( 'tslf_redirect_url', function ( $url ) { return home_url( '/dashboard/' ); } ); add_filter( 'tslf_lostpassword_url', function ( $url ) { return '/forgot/'; } ); add_filter( 'tslf_template', function ( $path, $name, $args ) { return $path; }, 10, 3 ); add_filter( 'tslf_logged_in_notice', function ( $html, $user ) { return $html; }, 10, 2 ); add_action( 'tslf_logged_in', function ( $user ) { /*... */ } );

// Abuse mitigation. add_filter( 'tslf_throttle', function ( $c ) { $c['id_max'] = 5; return $c; } ); // window, ip_max, id_max add_filter( 'tslf_min_fill_ms', function () { return 2000; } ); add_filter( 'tslf_client_ip', function ( $ip ) { return $_SERVER['HTTP_CF_CONNECTING_IP']?? $ip; } );

php )

can be swapped with the tslf_template filter. Style hooks are plain classes

tslf-submit ) and CSS custom

properties ( --tslf-accent, --tslf-border, …).

Notes & limitations

• This is a front-end form for a page of your choosing. It does not replace

php or change wp-admin.

• No social login, no 2FA — those are separate concerns handled by other plugins.

• If you serve the login page from a full-page cache, exclude it (or its nonce may

age out for logged-out visitors after ~12 hours).

• Translations (including Brazilian Portuguese) are managed on

org, not bundled with the plugin. The text domain is

t2f-two-screen-login.