WooCommerce Email Verification, Phone OTP & 2FA Plugin
Verify 2FA Email & Mobile OTP Pro
Reduce fake accounts. Verify real customers. Protect WooCommerce login and checkout.
Verify customer email addresses and mobile numbers with one-time passwords, enforce role-based two-factor authentication, and control who can register, log in or place an order.
Payment details required · Cancel before the trial ends to avoid a charge · Email OTP does not require Twilio.
Classic & Block Checkout
Guests & Registered Customers
Email, SMS & WhatsApp OTP
Role-based Login Protection
Verify 2FA Email & Mobile OTP Pro is a WooCommerce verification and login-security plugin. It can verify email addresses during registration, login, checkout and account changes; verify mobile numbers with SMS or WhatsApp through Twilio Verify; add email OTP as a second login factor for selected roles; and provide passwordless OTP login for eligible customer roles. It supports guest checkout, registered checkout, classic WooCommerce checkout and WooCommerce block checkout.
Verify customer details wherever trust matters
Instead of treating verification as a single signup feature, Verify 2FA protects the full customer journey: registration, login, checkout and later changes to account details.
1. REGISTRATION
Stop fake and disposable signups.
Require an email OTP before a new account is created, and remove registrations that remain unverified.
2. LOGIN
Add role-based email 2FA.
Require a one-time code for selected roles, or offer passwordless OTP login to eligible customer roles.
3. CHECKOUT
Verify guests and account holders.
Confirm email addresses and mobile numbers in both classic and block checkout.
4. MY ACCOUNT
Re-verify changed details.
Require verification when a customer changes an account email, billing email or billing phone number.
WooCommerce registration verification
How do I stop fake WooCommerce registrations?
Require new customers to prove that they control the email address used to register. Verify 2FA sends a one-time code before the account is created, helping reduce bot registrations, throwaway email addresses, typing errors and abandoned fake accounts.
- Email OTP during WooCommerce registration
- Starter list of disposable-email domains
- Global blocking by email address or domain
- Optional deletion of unverified registrations
- Verification logs for administrative review
For best results, still use you favorite captcha solution. This plugin compliments it.
What email verification proves
Email OTP confirms that the person completing the flow can receive a message at the submitted address. It does not prove a person’s legal identity or guarantee that an order is legitimate.
Why it matters: A verified inbox improves the chance that order messages, password resets and customer-service replies reach the intended recipient.
WooCommerce Login Security
Does Verify 2FA support role-based two-factor authentication?
Verify 2FA can add email OTP to supported WordPress and WooCommerce login flows for the roles you select.
This lets you apply stronger login protection where it is needed without forcing every role through the same experience.
🔐 Password plus OTP
After the normal password step, selected roles must enter a one-time code sent by email. Failed OTP verifications can be locked after repeated attempts.
⚡ Passwordless customer login
Selected non-administrative roles can log in using an email address or username and a one-time email code instead of a password.
🔗 One-click login OTP link
Optionally include a time-limited, single-use login link alongside the emailed code for a faster customer experience.
Important: Passwordless login is a convenience option for suitable customer roles. It is not stronger than password plus OTP and is blocked for Administrator and Shop Manager roles.
modern checkout support
Classic checkout and WooCommerce Blocks
The plugin supports guest and registered customer flows in classic shortcode checkout and WooCommerce block checkout through the Store API.
- Email-first verification when guest email and mobile OTP are both enabled
- Separate billing-email verification when it differs from the account login email
- Successful verification information displayed on admin orders
- International phone input with a country-code selector
WooCommerce checkout verification
Can WooCommerce verify email addresses and phone numbers at checkout?
Yes. Email verification can be set for registered users and/or guests independently from mobile number verification for registered users and/or guests. Mobile OTP codes are delivered via SMS by default unless WhatsApp has also been configured in Twilio.
Email OTP works without Twilio. Twilio Verify is required only for mobile OTP by SMS or WhatsApp. Twilio service and message charges are separate from the plugin license. How to get Twilio credentials
Control who can register, log in or buy
Use global rules for known risks and individual rules for exceptional customers. Choose the appropriate restriction instead of treating every account the same.
⛔Global blocklists
Block specific email addresses, email domains, phone numbers or phone countries. A starter disposable-email domain list is included.
👤Per-user decisions
Allow an account, block login, or permit login while preventing checkout. Email and mobile verification can also be allowed or blocked per user.
✅Trusted-user exceptions
Whitelist trusted users so they can use the configured password-login path without OTP where that exception is appropriate.
OTP abuse and cost controls
Protect your store and your Twilio budget
Repeated OTP requests can create unnecessary email traffic and mobile verification costs. Verify 2FA includes practical controls to slow repeated requests, cap mobile attempts and alert administrators to suspicious patterns.
- Email resend cooldowns and capped limits help prevent email blasts
- Staggered mobile OTP delays and configurable maximum attempts per day
- Guest email send streak tracking based on the email address and client IP
- Abuse notification emails for repeated email or mobile OTP patterns
- Cached Twilio balance displayed in plugin settings
⏱️Slow repeated sends
Progressive cooldowns make repeated, unverified requests less convenient without claiming to eliminate every form of automated abuse.
🔎Investigate activity
OTP and verification logs can include client IP information and configurable retention controls.
No anti-abuse control can eliminate every attack. Configure limits for your traffic, monitor logs and keep your Twilio account protections enabled.
WooCommerce stores that need more confidence in customer contact details
The plugin is particularly useful when accurate contact details, controlled account access or an additional checkout checkpoint matters to the business.
Digital products
Verify contact details before granting access to downloads, licence keys or other digital fulfilment.
Memberships
Reduce throwaway registrations and add an additional login step for selected member roles.
Wholesale and B2B
Control which accounts may log in or place orders while preserving exceptions for trusted buyers.
High-value orders
Add email or mobile ownership checks at checkout as one layer in a wider fraud-management process.
Subscriptions
Improve the quality of customer contact records used for renewal, billing and account notifications.
Bookings and services
Reduce incorrect contact details that make confirmations and follow-up communication difficult.
Private stores
Combine role rules, per-user restrictions and verification requirements for controlled access.
International stores
Collect mobile numbers through an international phone interface with country-code selection.
How Verify 2FA compares with typical OTP plugins
Many OTP plugins focus on one form or one delivery method. Verify 2FA is designed to combine these and more around the wider WooCommerce customer journey.
| Capability | Verify 2FA Pro | Basic OTP plugin |
|---|---|---|
| Email OTP at Registration | Included | Common |
| Prevent account creation without OTP | Included | Varies |
| Per-user login & checkout restrictions | Included | Varies |
| Role-based email 2FA at login | Included | Varies |
| One-click login link | Included | Varies |
| Passwordless login | Included | Varies |
| Mobile Verification OTP by SMS or WhatsApp | Included via Twilio | Varies |
| Intelligent abuse controls, logging & reporting | Included | Varies |
| Account change verification | Included | Varies |
| Blacklist individual email & global domains | Included | Varies |
| Blacklist individual mobile number or by country | Included | Varies |
| Guest & Registered Customer Supported | Included | Varies |
| Classic & Block Checkout Support | Included | Varies |
See verification activity and control administrative access
Verification is easier to operate when administrators can review what happened and restrict sensitive plugin screens to the appropriate staff roles.
- OTP and verification logs with retention controls
- Client IP shown on log entries for abuse investigation
- Successful verification details on WooCommerce admin orders
- Role-based access to settings, logs and user or blocklist screens
- Customizable OTP wording and consent text where exposed in settings
- WooCommerce is required
- WordPress 6.9 or later
- PHP 7.4 or later
- Classic & Block checkout supported.
Third-party login forms that bypass WordPress login or WooCommerce My Account–style flows may not receive the plugin’s login 2FA protection.
Open a screenshot to inspect email settings, mobile settings, customer status, blocklists and checkout verification
Test the real verification flows on your own store
A seven-day trial lets you test registration, login, checkout and account-change verification with your own theme, extensions and email delivery.
Payment details are required. Cancel before the trial ends to avoid being charged.
Monthly
$2.99/month
Low-commitment monthly billing for one store.
Annual
$1.99/month
Save 33%. Billed annually.
Lifetime
$79.99/once
One payment for long-term use.
Payment details are required. Cancel before the trial ends to avoid being charged. Twilio usage charges are not included.
WooCommerce email verification and OTP questions
Does email verification require Twilio?
No. Email OTP uses the WordPress and WooCommerce email system. Twilio Verify is required only for mobile OTP delivered by SMS or WhatsApp.
Does the plugin support WooCommerce block checkout?
Yes. It supports classic shortcode checkout and WooCommerce block checkout through the Store API.
Can guest customers verify without creating an account?
Yes. Guest email verification and guest mobile verification can optionally be enabled at checkout for guests.
Can registered customers verify a mobile number at checkout?
Yes. Mobile verification is available for guest and registered checkout flows.
Can I require 2FA only for selected roles?
Yes. Email OTP login protection can be enabled by role, including any custom roles that have been created.
Can customers log in without a password?
Selected non-administrative roles can use passwordless email OTP login. Administrator and Shop Manager roles are excluded.
What happens when a customer changes an email address or phone number?
The plugin can require verification when the account email, billing email or billing phone number is new or changed.
Can disposable email domains be blocked?
Yes. You can block individual email addresses or domains, and the plugin includes a starter disposable-domain list.
Can individual users be blocked from checkout but still view their account?
Yes. A user can be allowed to log in and view account history while being prevented from placing another order.
Does WhatsApp verification work automatically?
WhatsApp OTP needs to be configured through Twilio and then enabled in the plugins settings.
How does the plugin help reduce OTP abuse and SMS pumping?
Email cooldown timers and attempt limits help prevent email abuse. Mobile number verification is only enabled after successful email verification and has its own progressive cooldown timers and capped attempts. The plugin offers blocking by country, and Twilio offers additional settings and options such as Fraud Guard to help prevent SMS pumping.
Can I limit how often customers request verification codes?
Yes, you can set email OTP attempt limits and for SMS/WhatsApp attempts, you can set cooldown timers and limits. You can also decide if registered customers need to verify every time, periodically (once a year for example) or never again. The plugin also attempts to not reverify guests unnecessarily.
Will returning guests have to verify on every order?
You may enable a cookie- or session-based returning-guest window of up to about 30 days. Whether the verification is skipped depends on the customer browser and session.
Does verification guarantee that an order is legitimate?
No. OTP confirms access to an inbox or phone number. It should be used as one layer in a wider fraud and account-security strategy.
What are the minimum requirements?
WooCommerce is required. The documented baseline is WordPress 6.9 or later and PHP 7.4 or later.
Will it protect every third-party login form?
Not necessarily. Login 2FA applies to supported wp-login and WooCommerce My Account-style flows. A third-party form that bypasses those flows may require separate compatibility work. This is exactly why we offer a full feature 7 day trial.
How does the seven-day trial work?
Payment details are required. You can test the plugin for seven days and cancel before the trial ends to avoid a charge. Read checkout terms shown by Freemius when ordering.
Replace uncertain contact details with verified customer checkpoints
Test email OTP, mobile verification, role-based login protection and access controls on your own WooCommerce configuration.