SMS verification codes for WordPress
Meser10 OTP sends a one-time code by SMS through your Meser10 account: verify the mobile number at sign-up and at WooCommerce checkout, and add a code step at login for the user roles you choose.
Read the setup guide (Hebrew)A cash-on-delivery order with a wrong phone number, an account opened by a bot, a leaked admin password. In all three cases one SMS code stops the problem: it proves the number is real and belongs to the person typing it. Meser10 OTP adds that code to WordPress in three places, and each one is switched on separately. Codes go out through the single SMS function of our API, with no campaign, no list and no scheduling.
Where the code is required
- ✓Sign-up: the WordPress registration form and the WooCommerce account form ask for a mobile number, and the account is created only after the code is entered
- ✓WooCommerce checkout: the customer verifies the billing mobile before the order, on every order or only on cash on delivery, where fake orders cost the most
- ✓Login: after the password, users in the roles you pick, for example administrators and editors, enter a code sent to the mobile in their profile
What else you get
- ✓A test send from the settings screen, and a log of recent sends with numbers partly masked
- ✓Your own message text, with an optional line that lets the phone fill in the code by itself
- ✓An interface in English and Hebrew, and reuse of the Meser10 Connect API key if it is already installed
- ✓Developer functions to add an SMS code to any other form on the site
How it protects your SMS balance and your site
- ✓An hourly limit per number, per IP address and for the whole site, plus a wait before a new code. Every code is a paid SMS, and the limits are what stands between a bot and your balance
- ✓A code works once, expires after 5 minutes by default, and is cancelled after a few wrong attempts. Login codes are always at least 6 digits
- ✓The code is stored on the site only as a keyed hash (HMAC), never as text
- ✓At login, the session is created only after the code is correct. A user who needs a login code and changes their own profile number verifies both the current number and the new one by code
Before you start
A Meser10 account with SMS credit, an API key and an approved sender. Each code sent is one SMS from the balance. By default the plugin accepts Israeli mobile numbers.
The plugin is in review in the official WordPress.org plugin directory. Want to start before it is listed? Contact us and we will send you the plugin file.
All our plugins are on the Meser10 WordPress plugins page. To send codes from any other system, see the OTP API page and the OTP libraries for Node.js, Python and PHP.
Ready to start?
Open a Meser10 account, get an API key and a sender, and connect the site.
Sign up freeContact usFrequently asked questions
How much does it cost?
The plugin is free. Each code sent is one SMS from the balance on your Meser10 account, at your SMS rate.
What stops bots from burning through my SMS balance?
Hourly limits per number, per IP address and for the whole site, and a wait before a new code can be requested. You set all the limits on the settings screen. Login codes are counted separately, so public forms cannot lock people out of signing in.
Does it work with the WooCommerce Checkout block?
The code step is shown on the classic checkout, with the [woocommerce_checkout] shortcode. On the Checkout block, an order that needs a code is refused, so the block cannot be used to get around verification, and the settings screen warns you about it.
What happens to an admin with no mobile number in the profile?
You choose: either they sign in with the password until a number is added, or their login is blocked until an administrator adds one. A user cannot switch the code off by deleting their own number.
Can I change the message text?
Yes. {code} is replaced with the code and {site} with the site name. If the text has no {code}, the code is added at the end. The default is: Your verification code for {site} is {code}
What do I need from Meser10?
An account with SMS credit, an API key and an approved sender. If Meser10 Connect is already installed on the site, the plugin uses the same key.