Let users sign in with a short one-time code sent to their email instead of entering a password.
Email OTP (one-time password) lets a user enter their email address, receive a short numeric code, and complete authentication by entering that code.
Core Email OTP is included in VentraConnect Free. VentraConnect Pro extends Email OTP into supported WooCommerce, membership, LMS, community, comments, and custom inline-form experiences.
This guide covers:
- How to enable Email OTP
- Code length, expiry, resend throttling, and max attempts
- Login Only vs Login & Register
- The master account-creation control
- Redirect behaviour
- Email sender, subject, template, and placeholders
- Preview and end-to-end testing
- Where Email OTP can appear
Before You Enable Email OTP
Before rolling Email OTP out to users, make sure your WordPress site can send email reliably.
- VentraConnect Free is installed and active
- Outgoing WordPress email works reliably
- You have at least one login surface where Email OTP will be available
- VentraConnect Pro is active if you use WooCommerce, membership, LMS, community, comments, or other Pro placements
Fix email delivery first. If normal WordPress emails such as password resets are not arriving reliably, configure SMTP or a transactional email provider before depending on OTP for login.
Enable Email OTP
In the WordPress admin:
- Go to VentraConnect → Login Methods.
- Select OTP (Email).
- Turn the Active toggle On.
- Configure the security, account-creation, redirect, and email settings you want to use.
- Click Save Changes.
In VentraConnect Free, Email OTP is available on supported core WordPress authentication surfaces. VentraConnect Pro adds supported WooCommerce, membership, LMS, community, comments, and inline-form placements.
Configure Code Length, Expiry & Attempt Limits
Good starting point: 6 digits, 10-minute expiry, 60-second resend throttle, and 5 maximum attempts.
When a new OTP is issued, use the most recently requested code. Older active codes should no longer be treated as the current code for that request flow.
Choose Login and Account-Creation Behaviour
Email OTP has its own registration mode, but the method-level setting sits underneath VentraConnect's master account-creation control.
The master setting always wins. Login & Register does not override a master restriction that blocks new accounts from default login forms.
For supported WooCommerce, membership, and LMS flows, Guardrails can keep login forms existing-user-only while directing new visitors through the proper registration, checkout, membership, or enrollment path.
Set the Redirect After OTP Login
Email OTP can follow your normal VentraConnect redirect behaviour or use an OTP-specific redirect override.
- Return to previous page
- Send to the homepage
- Send to an account or dashboard page where supported
- Send to a custom URL
If you do not configure an OTP-specific override, VentraConnect follows the applicable global or integration-aware redirect behaviour.
Customize the OTP Email
Your login code for {site_name}
Body:
Hi,
Here is your one-time login code for {site_name}:
{otp_code}
This code expires in {expires_in} minutes. If you did not request this code, you can ignore this email.
Thanks,
{site_name}
VentraConnect Pro adds additional branding controls for supported passwordless emails, including logo, accent styling, and footer branding.
Preview & Test Email OTP
Recommended test:
- Use the OTP preview/test tools
- Send a test email to an address you control
- Confirm the sender, subject, body, and placeholders render correctly
- Open the real login form while logged out
- Request a code for an existing user
- Enter the correct code and confirm login succeeds
- Confirm the post-login redirect is correct
- Try the same code again and confirm it is not accepted
- Request a new code and use the newest code for testing
- Test an expired code and incorrect-code attempts
- If registration is intentionally enabled, test separately with a completely new email address
If emails are slow or missing, fix delivery first. SMTP or transactional mail problems will directly affect the OTP login experience.
Where Email OTP Appears
Email OTP uses VentraConnect's placement system. The exact surfaces available depend on whether you are using Free or Pro.
If OTP is not showing where expected: confirm Email OTP is Active, confirm the relevant placement/integration is enabled, and clear page/cache layers if necessary.
Security Notes
- Use a reasonable code length and a limited expiry window
- Keep resend throttling enabled to reduce repeated requests
- Keep maximum attempts limited
- Use the newest OTP after requesting another code
- For high-value administrative accounts, keep stronger administrative authentication controls such as passwords and 2FA in place
