MyOTP Phone Verification

Description

MyOTP Phone Verification sends a one-time code to a visitor’s phone and checks it before they can continue. It uses the MyOTP.App API (https://myotp.app), one key for SMS, WhatsApp and Telegram.

What it does:

• WooCommerce checkout: a Send code button under the billing phone. The order cannot be placed until the billing number is verified. Optionally only for guests.
• Apple Pay, Google Pay and other express wallet buttons: choose to allow those orders without a code, to hold them until the shopper verifies after paying, or to block them.
• WordPress registration: a phone field with the same flow on wp-login.php?action=register. The verified number is saved as user meta myotp_verified_phone.
• Shortcode [myotp_verify]: the same widget on any page. Fires a myotp:verified event on document with the number in event.detail.phone.
• Settings page (Settings > MyOTP): API key, channel, code length, validity, brand, and a Send test code button.

How it stays safe:

• The API key never leaves the server. The browser talks to admin-ajax.php only.
• Every AJAX call carries a nonce. Admin actions check manage_options.
• Send limits, enforced together with atomic counters: 5 codes per visitor, 10 per client IP, 3 per destination number, each per 10 minutes, plus a site-wide ceiling (default 100, setting and myotp_pv_site_hourly_cap filter). The site-wide count uses a fixed one-hour window that starts at the first send, so up to twice the ceiling can go out across a window boundary. It exists to bound what an attacker with many addresses and many numbers can make the site spend. A code that was not billed (provider answered 409 or a server error) is not counted against it.
• A visitor can only verify the code they requested: the challenge reference from the provider is stored with the pending record and sent back on every check. If the provider still has an active code that this visitor did not request, a fresh code is sent for this visitor instead (still within every send limit).
• 5 wrong codes put this visitor on a 15-minute cooldown for that number. Sending and checking are both refused for that visitor while it lasts; other visitors are not affected, and nothing is keyed on the phone number alone, so nobody can lock a number’s owner out. Only a provider answer of “wrong code” counts; an expired code, a network failure or a provider error never does.
• A verification is valid for 30 minutes and is claimed by exactly one checkout or one registration at validation time, then consumed when the order or account exists. If checkout fails after validation (a declined payment, for example) the visitor verifies again.
• Phone numbers are reduced to digits before they are sent. Leading zeros are kept.

Both the classic (shortcode) checkout and the block checkout are supported. On the block checkout the plugin adds its widget under the phone field with a small script (no block to add in the editor) and validates when the order is placed. The block checkout’s phone field must be shown: with the field hidden there is no number to verify and the order is refused.

Express wallet buttons (Apple Pay, Google Pay, Link, Amazon Pay) from WooPayments and WooCommerce Stripe Payment Gateway place the order without the checkout form, so the shopper never sees the code box. Settings > MyOTP has one setting for them, “Apple Pay / Google Pay and other express wallet orders”, with three choices:

• Allow without a code (the default, also after upgrading): the wallet has already confirmed the payer and the order is paid. The order is placed as usual, is not marked as verified, and gets an order note saying it was an express wallet payment placed without phone verification.
• Ask for the code after payment: the order is accepted, and once paid it goes on hold instead of processing, with an order note. The order confirmation page (and My account > View order for a logged-in customer) shows a code box for the billing phone on the order. When the shopper verifies that number, the order is marked as verified like any other and moves on to the status the payment gateway set (usually processing). Codes use the same send limits as checkout. Nothing runs on a timer: an order that is never verified stays on hold for you.
• Block: the order is refused unless the shopper verified the same number at checkout first, which is how 1.0.0 behaved.

Other gateways can be added with the myotp_pv_express_wallet_gateways filter (gateway id => list of request fields that mark a wallet order) and myotp_pv_express_wallet_types.

External service

This plugin sends the phone number a visitor enters to the MyOTP.App API at https://api.myotp.app to deliver a one-time code and to check the code the visitor types. No other data is sent. MyOTP.App privacy policy: https://myotp.app/privacy-policy/. Terms: https://myotp.app/term-condition/.

Data stored on your site

• A cookie myotp_pv_sid (random id, one day) so a guest’s verification can be tied to their browser.
• Rows in the options table (myotp_pv_kv_ prefix, not autoloaded): rate-limit counters (a row lives for one window after the last send it counted: 10 minutes, site-wide 1 hour), the pending number with its code reference and attempt count (kept for the configured code validity, at most 4 hours), a 15-minute per-visitor cooldown row after five wrong codes, and the verified number (30 minutes). Expired rows are removed on the next read of that row and by a daily WP-Cron sweep (myotp_pv_sweep). WP-Cron runs on page visits, so on a quiet site the sweep can run later than scheduled.
• Order meta _myotp_verified_phone on each verified WooCommerce order. With “Ask for the code after payment”, a held order also carries _myotp_pv_awaiting (the wallet type) and _myotp_pv_restore_status (the status to restore) until it is verified, and the store keeps that order’s pending code, attempt count and send counter for the code validity.
• User meta myotp_verified_phone on each account registered through the verified form.

Uninstalling removes the settings, the scheduled sweep, the counters, the pending records and the verified records. Order meta and user meta are part of your customer records and are kept. The plugin registers suggested text for your privacy policy under Settings > Privacy.