Guide · 5 min read

Passwords are a pain: forgotten, reused, phished. A one-time code texted to the user’s phone is simple and familiar. With SwarmSMS Pro, those codes go out through your own phone — no per-code fees.

What you get

• Passwordless login: enter a mobile number, receive a code, you’re in.
• SMS two-factor: after the password step, chosen roles must enter a texted code.
• Developer API: wpsg_otp_send() and wpsg_otp_verify() for your own flows.

Set up SMS login

1. Open SwarmSMS → OTP & Login and tick Enable.
2. Add the shortcode to your login or My Account page. A “Log in with an SMS code” link also appears on wp-login.php.
3. Make sure users have a Mobile number on their profile (or a WooCommerce billing phone). Users are matched by that number.
4. Optionally allow new visitors to register with just a phone number (never as an administrator).

Set up two-factor

Tick SMS two-factor and choose the roles (administrators by default). After a correct password, the user is sent a code and must enter it before they’re logged in. Users without a number aren’t challenged — the OTP screen warns you which admins have no mobile number saved.

Safe by design

• Codes are random, stored only as a hash, expire (default 5 minutes) and allow five attempts
• Rate-limited per number, per IP and site-wide
• Login never reveals whether a number has an account
• OTP texts jump the queue so they arrive fast
• If no phone is online, two-factor falls back to password-only so you can’t lock yourself out; and a WPSG_DISABLE_2FA constant is the emergency off switch

Tips

Pair at least two phones so a code can always be sent, and enable Firebase push so codes arrive within a second or two. Test with your own account before enforcing 2FA for everyone.