by Konceptwise Digital Media Pvt Ltd 1 (0 reviews)

Authyo Passwordless Login

Name: Authyo Passwordless Login
Author: Konceptwise Digital Media Pvt Ltd

WordPress login security with brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, and passwordless OTP login.

Authyo Passwordless Login ranks #46,260 among WordPress.org plugins with 10+ active installations, is #662 of 1,659 in the Authentication category, a 1/5 rating from 0 reviews, and was last updated Oct 1, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.0.11 Current Version v1.0.11

Updated 1 month ago Last Update on 01 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#662 of 1,659 in Authentication Top 50% by installs

View on WordPress.org

Rank

#46,260

— No change

Active Installs

10+

-41.2%

KW Avg Position

0.7 better

Downloads

267

+3 today

Support Resolved

— No change

Rating

20%

Review 1 out of 5

1 (0 reviews)

Next Milestone 20

Total Progress 50%

10+ 20+

23,087

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 5 more installs to reach 20+

Rank Changes

Current #46,260

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

1.0

0 reviews

Overall 20%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.0.11
Last Updated: Oct 01, 2026
Requires WP: 5.0+
Tested Up To: 7.1
PHP Version: 7.2 or higher
Author: Konceptwise Digital Media Pvt Ltd

Support & Rating

Rating: ★ ☆ ☆ ☆ ☆ 1
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

brute force protection disable xmlrpc login security passwordless login rest api security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

All-In-One Security (AIOS) – Security and Firewall

MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites

700K+ installs

#86

View all Authentication plugins

Frequently Asked Questions

Common questions about Authyo Passwordless Login

No. Brute-force protection, IP manager, security logs, XML-RPC protection, REST API protection, and custom login URL all work without any API keys. You only need Authyo API keys for the passwordless OTP login feature.

The plugin tracks failed login attempts per IP address and per username. After exceeding the configured threshold, the IP or username is temporarily locked out. Each subsequent lockout lasts longer (progressive durations). Repeat offenders can be automatically blacklisted permanently.

It restricts access to WordPress REST API endpoints for unauthenticated users. By default, WordPress exposes REST API endpoints like /wp-json/wp/v2/users that can reveal usernames and other site data. When enabled, only logged-in users can access the REST API while essential public endpoints continue to work normally.

It blocks all requests to xmlrpc.php at the server level using .htaccess rules on Apache and LiteSpeed servers. On Nginx servers, a PHP-level fallback handles the blocking. It also removes the X-Pingback header and XML-RPC discovery links. Whitelisted IPs are exempt.

Users enter their email address on the login page, receive a one-time password via email, enter the OTP code, and are logged in automatically. No password is needed. Requires Authyo API keys.

Go to Authyo Passwordless > IP Manager. You can search by IP or label, filter, and paginate through whitelisted and blacklisted IPs. The page also shows active lockouts with options to unlock or permanently blacklist IPs.

Add define( 'AUTHYO_DISABLE_IP_BLOCKING', true ); to your wp-config.php file. This temporarily turns off all IP blacklisting and lockouts. Log in, remove your IP from Authyo Passwordless > IP Manager (or whitelist it), then delete the line from wp-config.php again.

Yes. The plugin uses the connecting IP address, which cannot be faked. When a request really comes from a Cloudflare edge server it uses the CF-Connecting-IP header, and when it comes from a proxy on a private network it uses the X-Forwarded-For header, so each visitor is recognised individually. Private and unknown addresses are never locked out or blacklisted, so a shared proxy address cannot lock out all your visitors. For other setups, use the authyo_passwordless_client_ip filter to return the real visitor IP.

Yes. Each OTP or Google Authenticator session allows 5 attempts, each account allows 10 attempts per 15 minutes and 30 per day, and each email address can request at most 5 OTP emails per 15 minutes. These limits apply even when brute-force protection is turned off. The login form also answers the same way whether or not an email address has an account, so it cannot be used to discover accounts.

Yes. Use the shortcode [authyo_login] on any page, or call authyo_passwordless_login_form() in your theme templates.