WP-Safety

WP-OTP Security & Risk Analysis

wordpress.org/plugins/wp-otp

Make your WordPress login extra secure with One Time Passwords.

100 active installs v0.6.1 PHP 7.4+ WP 4.6+ Updated Feb 18, 2021
2faloginotptotptwo-factor
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Plugin page Download
Safety Verdict

Is WP-OTP Safe to Use in 2026?

Generally Safe

Score 85/100

WP-OTP has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 5yr ago
Risk Assessment

The "wp-otp" plugin version 0.6.1 exhibits a strong security posture based on the provided static analysis. There are no identified entry points like AJAX handlers, REST API routes, shortcodes, or cron events that are accessible without authentication. This significantly reduces the potential attack surface. Furthermore, the code demonstrates good practices with 100% of SQL queries using prepared statements and 97% of outputs being properly escaped. The presence of nonce and capability checks on all identified code paths further bolsters its security.

Vulnerabilities
None known

WP-OTP Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

WP-OTP Release Timeline

v0.6.1Current
v0.6.0
v0.5.1
v0.5.0
v0.4.1
v0.4.0
v0.3.0
v0.2.1
v0.2.0
v0.1.4
v0.1.3
v0.1.2
v0.1.1
Code Analysis
Analyzed Mar 16, 2026

WP-OTP Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
1
35 escaped
Nonce Checks
4
Capability Checks
4
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

97% escaped36 total outputs
Attack Surface

WP-OTP Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 9
actionadmin_enqueue_scriptsincludes\class-wp-otp.php:96
actionadmin_enqueue_scriptsincludes\class-wp-otp.php:97
actionadmin_initincludes\class-wp-otp.php:99
actionadmin_noticesincludes\class-wp-otp.php:100
actionprofile_personal_optionsincludes\class-wp-otp.php:102
actionpersonal_options_updateincludes\class-wp-otp.php:103
actionwp_authenticateincludes\class-wp-otp.php:116
actionlogin_formincludes\class-wp-otp.php:120
actionauthenticateincludes\class-wp-otp.php:121
Maintenance & Trust

WP-OTP Maintenance & Trust

Maintenance Signals

WordPress version tested5.6.17
Last updatedFeb 18, 2021
PHP min version7.4
Downloads11K

Community Trust

Rating80/100
Number of ratings9
Active installs100
Alternatives

WP-OTP Alternatives

Flavor 2FA

Flavor 2FA

flavor-2fa

A
100

Lightweight two-factor authentication that just works. Protect your WordPress site with authenticator apps or email codes in under 2 minutes.

0 No CVEs
SecureAuth Authenticator 2FA

SecureAuth Authenticator 2FA

secureauth-authenticator-2fa

A
100

Adds TOTP-based two-factor authentication (2FA) via SecureAuth Authenticator to your WordPress login page.

0 No CVEs
PassClip Auth for WordPress

PassClip Auth for WordPress

passclip-auth-for-wordpress

A
85

"PassClip Auth" provides strong and easy authentication. "PassClip Auth for WordPress" is the plugin to launch PassClip Auth to Wo …

10 No CVEs
4Login for Secure And Smart Access

4Login for Secure And Smart Access

4login-for-secure-and-smart-access

A
100

4Login will give you an easy and powerful authentication (connect to an external server for authentication).

0 No CVEs
Notakey Provider for Two-Factor

Notakey Provider for Two-Factor

notakey-two-factor-extension

A
100

Reduce friction and improve security of Two-Factor Authentication using push-based Notakey Authenticator mobile application.

0 No CVEs
Developer Profile

WP-OTP Developer Profile

noplanman

5 plugins · 140 total installs

84
trust score
Avg Security Score
85/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect WP-OTP

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/wp-otp/admin/css/wp-otp-admin.css/wp-content/plugins/wp-otp/admin/js/wp-otp-admin.js
Script Paths
/wp-content/plugins/wp-otp/admin/js/wp-otp-admin.js
Version Parameters
wp-otp/style.css?ver=wp-otp-admin.css?ver=wp-otp-admin.js?ver=

HTML / DOM Fingerprints

Data Attributes
data-wp-otp-codedata-wp-otp-recovery-codes
JS Globals
wp_otp
FAQ

Frequently Asked Questions about WP-OTP