Overview
Account Guard coordinates verification across native WordPress registration, WooCommerce, and administrator-created accounts. Administrators configure verification rules, email identity, role exemptions, and post-login destinations without editing PHP.
Architecture
Key features
- Configurable OTP length, expiration, attempts, resend cooldown, and hourly limits.
- Verification-before-password onboarding and login blocking.
- Dynamic role discovery, exemptions, and role-aware redirects.
- Verification status, resend, manual verification, diagnostics, and activity logs in WordPress administration.
- Mail-failure monitoring and scheduled cleanup of stale managed accounts.
Security decisions
Codes use a cryptographically secure generator and WordPress password hashing. Public verification URLs use a high-entropy per-account token in addition to nonces, preventing a predictable WordPress user ID from being sufficient to access verification or email-correction actions. Administrative mutations require capability checks and nonces.
Security contract
Known limitations
Mail deliverability remains dependent on the site's WordPress mail transport and sender-domain configuration. PHP lint and live WordPress integration testing require a WordPress/PHP test environment and are not represented as completed in this workspace.
What this project demonstrates
- Coordinating one security workflow across multiple WordPress account entry points.
- Hardening predictable public routes with token-bound verification.
- Designing configurable abuse controls and role-aware post-login behavior.
- Documenting validation limits instead of presenting unperformed testing as evidence.