Tomevexa Secure Login

8 and later. 4 to preserve secure, predictable authentication behavior across supported installations.

Tomevexa Secure Login is distinguished by its privacy-preserving adaptive security model. It can require an additional email OTP after a correct password when a non-administrator signs in from a network that has not yet been trusted.

The plugin also provides a front-end login form that can authenticate eligible WordPress users with a one-time numeric code sent to their account email address.

The plugin also provides optional password login, configurable password-expiry enforcement, and a local adaptive step-up mode for non-administrator accounts. When adaptive step-up is enabled, a correct password from a network that has not yet been trusted requires an email OTP before access is granted. Administrator accounts remain excluded from the plugin OTP path and password-expiry enforcement.

Main features:

• Passwordless email OTP login for non-administrator users.

• Local device-passkey login using WebAuthn/FIDO2, with Face ID, Touch ID, Windows Hello, device PINs, and supported Android authenticators.

• Email-first passkey sign-in using the device authenticator; up to 10 passkeys can be registered per WordPress account. USB/NFC keys can be registered and managed, but the current front-end sign-in flow requests internal authenticators only.

• Passkey private keys and biometric data never reach WordPress; the plugin stores only credential identifiers, public-key coordinates, counters, and timestamps.

• Configurable OTP length, lifetime, resend delay, and maximum verification attempts.

• Generic code-request responses to reduce account enumeration.

• OTP request throttling per IP and email address. Failed-password limits apply to an email/IP pair in a 15-minute window; account and IP counters also provide administrator diagnostics and alerts.

• OTP values generated with random_int() and stored only as WordPress password hashes in temporary transients.

• Optional password login from the same front-end form.

• Adaptive step-up authentication: after a correct password, unfamiliar networks can require email OTP verification before access is granted.

• Privacy-preserving trusted-network recognition: IPv4 /24 or IPv6 /64 network prefixes are converted to salted HMAC hashes; raw IP addresses are not stored in the trusted-network list.

• Configurable trusted-network lifetime, with automatic expiry and a maximum of 10 active hashes per user.

• Configurable password expiry for non-administrator accounts; set the value to 0 to disable it.

• Safe post-login redirects, including optional compatibility with Profile Builder Pro custom redirects when that plugin is active.

• Accessible labels, keyboard-operable controls, live status/error regions, visible focus indicators, one-time-code autocomplete, and reduced-motion support.

• No external JavaScript, CSS, tracking, telemetry, or third-party API calls.

• Translation support through the WordPress.org translation system. Some Profile Builder accessibility labels currently use Italian text.

• Independently configurable password, email-code, and passkey methods; disabling email OTP also disables adaptive email step-up.

• Front-end passkey management with [tomevexa_passkeys] and an optional device-passkey setup invitation after password or email-code login.

• Daily password-renewal reminders, latest email send/verification status, and an inactive-profile report using Tomevexa activity and valid WP Last Login timestamps.

• Optional integration with existing All-In-One Security (AIOS) network lockouts and Profile Builder account approval.

Use the [tomevexa_secure_login] shortcode on a page. You can optionally set a redirect destination:

com/account/"]

The redirect is validated with WordPress redirect-safety functions. If a redirect_to parameter is supplied by WordPress, the plugin can also honor that safe destination.

Email delivery

OTP messages are sent with the standard WordPress wp_mail() function. Actual delivery therefore depends on the site’s WordPress mail configuration and hosting environment. The plugin does not connect directly to an external email service.

Profile Builder compatibility

Profile Builder is not required. When Profile Builder Pro is active and its Custom Redirects module is enabled, Tomevexa Secure Login preserves the configured after-login redirect.

Accessibility

The login form uses semantic labels and buttons, keyboard-operable controls, visible focus indicators, polite and assertive live regions for status and errors, a single numeric OTP field compatible with paste and autocomplete="one-time-code", and reduced-motion support.

Accessibility also depends on the active theme and surrounding page content. Site owners should test the completed page with keyboard navigation and their preferred assistive technologies.

Privacy

Tomevexa Secure Login does not include analytics, telemetry, advertising, or direct third-party API requests. Passkey registration and verification are performed locally between the browser/authenticator and the WordPress site using WebAuthn; no external authentication service is required. OTP emails are sent through the site’s configured WordPress mail system.

Temporary OTP data is stored in WordPress transients and contains a password hash of the OTP, the user ID, expiry time, and attempt count. The OTP itself is not stored in plaintext. When adaptive step-up is enabled, trusted-network recognition stores only salted HMAC hashes derived from reduced network prefixes plus their expiry times in user metadata; the trusted-network list does not store raw IP addresses.

For administrator troubleshooting, the latest IP used with an email after a failed password attempt is stored in a transient for 15 minutes. Login result reason codes, keyed by a salted email HMAC, are retained for up to 24 hours. Up to 20 block alerts containing the attempted email and IP are stored for at most 24 hours or until an administrator archives them.

The plugin also stores the last observed authenticated activity timestamp in user metadata, updated at most once per day, and the most recent email send/OTP verification status for administrator review. The plugin-owned user metadata and settings are retained on uninstall by default. Administrators can instead save the permanent-cleanup choice before deleting the plugin; that choice removes the settings, six plugin-owned user metadata types, and plugin-owned database transients.

Short-lived diagnostics and challenges use WordPress transients and expire according to their configured lifetimes. The browser stores a localStorage preference, keyed by an encoded email address, when the user dismisses the passkey setup invitation; clearing the site data removes that preference.