The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →You can add phone-number login with one-time passwords (OTPs) to WordPress using an authentication plugin and an SMS provider. A practical starting point is OTP Login With Phone Number, OTP Verification: install and activate it, configure Firebase or a supported SMS gateway in Login Settings, then add its [idehweb_lwp] shortcode to a login page. It also documents WooCommerce integration for My Account, checkout, and registration.
Choose a plugin and OTP delivery method
The plugin you choose determines where phone login appears and which SMS services you can connect. Compare the options against your site’s needs rather than assuming every provider or integration behaves the same way.
| Option | What its documentation describes | Best fit |
|---|---|---|
| OTP Login With Phone Number, OTP Verification | Phone and email OTP, shortcodes, WooCommerce, LearnPress, page builders, multisite, Firebase, Twilio, regional SMS providers, and a Custom API option. | A general WordPress site that needs several login placements or gateway choices. |
| xootix OTP Login & Register Woocommerce | Phone field and AJAX OTP login for WooCommerce; listed providers include Firebase, Twilio, Amazon, MSG91, Textlocal, and Unifonic. | A store prioritizing phone-based login and registration in WooCommerce. |
| Firebase | Managed phone-authentication flow that sends a unique code by SMS; requires configuration in Firebase. | A site owner who prefers Firebase’s managed authentication flow and accepts its data-processing terms. |
| Twilio Verify or another SMS provider | Commercial SMS/API option; provider coverage, sender rules, and pricing depend on destination and current provider terms. | A team that wants to select and manage an SMS provider directly. |
| Custom API | The primary plugin documents a gateway URL, GET or POST, headers, a JSON body, and ${code} as the OTP placeholder. |
A site with an existing gateway or a need for custom routing. |
Provider prices and country availability are not stable across destinations and time. Confirm current pricing, supported countries, sender requirements, and applicable terms with the provider before choosing a gateway.
Install and configure phone OTP login
Use a staging copy first if possible. This keeps configuration mistakes and checkout changes away from live customers while you verify the full login flow.
Recommended Free Tools
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Back up the site, then install the plugin from the WordPress directory or its ZIP file and activate it.
- In the WordPress dashboard, open the plugin’s Login Settings.
- Select Firebase, Twilio, another supported gateway, or Custom API, then enter the credentials and gateway details required by that service. Send a test SMS if the plugin or provider offers a test option.
- Enable phone login and, if needed, phone registration. Choose whether OTP replaces the default WordPress login or appears alongside it.
- To create a standalone login page, add
[idehweb_lwp]to the page content. For a WooCommerce store, configure the plugin’s WooCommerce integration for My Account, checkout, and registration rather than assuming the shortcode alone changes checkout. - Set country-code handling, phone-number storage and normalization, redirects after login, resend cooldowns, and attempt limits.
- On staging, test valid and incorrect codes, expired codes, resending, lockout, new-user registration, existing-user login, and the checkout flow before enabling it on the live site.
Configure Firebase before serving users
For Firebase, enable the Phone sign-in provider and set an SMS region policy in the Firebase project. Firebase’s Android documentation says the default region policy for new projects allows no regions, so explicitly allow the countries where your users are located: Firebase phone authentication for Android. The plugin’s setup screens and the Firebase console must both be configured correctly for users to receive codes.
Firebase also limits SMS messages sent to a single phone number within a period to help prevent abuse. A user who requests codes repeatedly may therefore be unable to receive another immediately; account for this in your resend guidance and support process. See Firebase Authentication limits.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Account for privacy, security, and recovery
Phone numbers are sensitive personal data. Firebase says numbers submitted for authentication are sent to and stored by Google to improve spam and abuse prevention across Google services, including Firebase. Disclose this processing and obtain appropriate user consent: Firebase phone authentication for Android.
- Protect the login endpoint: Use HTTPS and enable rate limiting, lockout, and maximum-attempt controls. The primary plugin’s changelog documents OTP rate limiting, lockout, configurable maximum attempts, and invalidation after too many wrong attempts: plugin listing and changelog.
- Limit unwanted requests: Consider resend cooldowns, reCAPTCHA, and country restrictions where the selected plugin and provider support them. Login Me Now documents these controls for its Firebase/Twilio flow: Login Me Now.
- Plan for number changes: Provide a way for a verified user to update a lost or changed number, and a recovery route for users who can no longer receive texts. Do not make SMS the only recovery route unless you have a support process for account lockouts.
- Minimize retained data: Store only the phone information and authentication records the site needs, and define how long they are kept.
SMS delivery depends on carrier, destination, sender rules, provider coverage, and current service conditions. Test with numbers in the countries you serve; successful configuration in one country does not establish delivery everywhere.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
![FIDO U2F Security Key, Thetis [Aluminum Folding Design] Universal Two Factor Authentication USB (Type A) for Extra Protection in Windows/Linux/Mac OS, Gmail, Facebook, Dropbox, SalesForce, GitHub](https://m.media-amazon.com/images/I/414cv-4SxrL._SL160_.jpg)
- Protect Online Account - Offer a strong factor authentication to your online account. Never lose your accounts through password theft, phishing, hacking or keylogging scams.
- Universal Compatibility - The Thetis U2F key can be used on any websites which support U2F protocol with the latest Chrome installed on your Windows, Mac OS or Linux. (Important Note: Not compatible with any email clients including Apple Mail, Mozilla Thunderbird or Microsoft Outlook)
- FIDO-U2f-Certified - Safety is our priority. Certified by world's largest Ecosystem for Standards-based, interoperable Authentication. Only support U2F protocol (No UAF or OTP). Provide low-cost and simple solution with high security.
- Extremly Durable - Designed with a 360° rotating metal cover that shields the USB connector when not in use. Also, crafted from a durable aluminum alloy to protect the Key from drops, bumps and scratches.
- Portable Design - Compact, ultra-portable design allows you to take your FIDO key anywhere you need it.
Does phone OTP work with WooCommerce checkout?
The primary plugin documents integration with WooCommerce My Account, checkout, and registration. The xootix plugin is also specifically aimed at WooCommerce OTP login and registration. Check the selected plugin’s current settings and test your exact checkout path on staging: guest checkout, returning customers, account creation, and any custom checkout fields can behave differently depending on the store configuration.
Check current plugin compatibility
Plugin versions and compatibility claims change. At the time reflected in the 2026 WordPress.org listing, the primary plugin showed version 1.8.72 and “Tested up to” WordPress 7.0.4: WordPress.org plugin listing. Check the live listing, changelog, and your installed WordPress version before deployment; a directory compatibility label is not a substitute for testing your site’s theme, plugins, and checkout.
Quick Recap
Rank #4
- MULTI-APPLICATION SECURITY KEY FOR ENTERPRISE USE: Supports FIDO2 passkeys, U2F, Smart Card (PIV), and OTP for flexible authentication across enterprise environments.
- PHISHING-RESISTANT AUTHENTICATION: Enables passwordless login with secure credential storage and PIN-based user verification.
- COMPATIBLE WITH ENTERPRISE SYSTEMS: Works with FIDO2, WebAuthn, U2F, PIV, and OTP across enterprise, cloud, and identity infrastructure.
- DRIVERLESS FIDO2 AUTHENTICATION: FIDO2 works natively with modern browsers and platforms. Additional software may be required for PIV or OTP
- USB AND NFC CONNECTIVITY: Supports authentication via USB-C and NFC. No batteries or drivers required for FIDO2.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
