DoLogin Security

🔐 TOTP and signing keys: encrypted when the server must recover them

TOTP seed or private key ➜ `authenticated encryption + site salt` ➜ `ciphertext in the database`

TOTP verification and digital signatures need the original secret at runtime, so these values cannot use a one-way hash. DoLogin encrypts them instead and rejects modified ciphertext. Existing TOTP seeds and Site Easy Login private keys are migrated automatically.

🏠 Site Easy Login: one signed message, one destination, one use

User + trusted public key + destination + issue time + random token ID ➜ `one Ed25519 signature`

The child site verifies the complete signed message with the public key already saved for that connection. Changing the user or destination breaks the signature, and an atomic consume step blocks replay.

📱 KeyLockr SSO: stable signing and encryption identity

Scan QR ➜ `approve on phone` ➜ `verify Safe + AppData binding` ➜ `WordPress login cookie`

• Fixed per-site signing and encryption keypairs let KeyLockr reuse the same backend-owned connection identity.
• Existing signing-only key storage is upgraded atomically with one persistent encryption keypair.
• The WordPress backend owns all private keys and KPS processing; the browser only opens the short-lived KeyLockr WebSocket and relays opaque signed, encrypted frames to the backend.
• Incoming frames are signed, encrypted, timestamp-checked, replay-checked, rate-limited, and accepted only in the expected protocol phase.
• Bind and Repair write the WordPress account hash to encrypted KeyLockr AppData, then read it back before completing.
• Login requires exactly one WordPress user with the matching Safe ID and binding hash.
• After a QR scan, the phone-unlock and approval prompt is highlighted in green so the next action is clear.

🚦 Force KeyLockr SSO that fails closed

Enable force mode after a verified admin binding ➜ `keep QR-only policy active` ➜ `never reopen older interactive login methods automatically`

DoLogin checks the current administrator binding before force mode can be enabled. After that policy is saved, a missing binding, changed App Tag, broken site identity, or unavailable KeyLockr service does not restore password, passwordless-link, connected-site, or password-reset login paths. The WordPress lost-password link and core password-reset screens are removed while force mode is active; unlinking and site-key reset are also blocked. Existing authenticated sessions can disable force mode from settings; if no session remains, rename the plugin folder through FTP or the hosting file manager before repairing the connection. WordPress Application Passwords remain available for API clients.

API

• Call the function $link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'your plugin name or tag' ) : ''; to generate one passwordless login link for the current user.
• Call the function $link = function_exists( 'dologin_gen_link' ) ? dologin_gen_link( 'note/tip for this generation', $user_id ) : ''; to generate a passwordless login link for the user which ID is $user_id .

The generated one-time used link will be expired after 7 days.

• Define const SILENCE_INSTALL to avoid redirecting to setting page after installtion.

KeyLockr SSO Recovery

Forced KeyLockr SSO blocks password, passwordless-link, and connected-site interactive logins. Existing authenticated cookies and WordPress Application Passwords remain available.

DoLogin never restores another interactive login method because KeyLockr is unavailable or the saved binding becomes invalid. Use an existing authenticated administrator session to disable force mode. If no such session remains, rename the plugin folder through FTP or the hosting file manager, then repair the connection before enabling force mode again.

CLI

• List all passwordless links: wp dologin list
• Generate a passwordless link for one username (for the login name root ): wp dologin gen root
• Delete a passwordless link w/ the ID in list (for the record w/ ID 5): wp dologin del 5

How GeoLocation works

When visitors hit the login page, this plugin will lookup the Geolocation info from API, compare the Geolocation setting (if has) with the whitelist/blacklist to decide if allow login attempts.

Privacy

The online IP lookup service is provided by https://www.doapi.us. The provider’s privacy policy is https://www.doapi.us/privacy.

Based on the original code from Limit Login Attemps plugin and Limit Login Attemps Reloaded plugin.