I rewrote FluentAuth & why you should use it

Nice, been looking for a good solution that has passkeys! Thanks.

Shahjahan Jewel Thank you for the plugin, it works!...just updated to the latest (3.0.1) and noticed this on the security panel - https://prnt.sc/9tzIfTGSdAtV

Wow, I honestly can’t believe how lucky we are! 😱

This is such an incredible update - and for a free plugin too!!

Thank you so much

Awesome! I use it on every site. With all of the various apps giving us different login solutions - Wordpress, FluentAuth, FluentCommunity, redirect to custom login page, etc. - it would be very helpful to have a brief guide letting us know best practices for how to configure all of them.

Passkey i really love it 😍

Passkeys you cant use for everyone if you are blocking access to /wp-admin/ Shahjahan Jewel make it work also on fluent community user profile on frontend. From profile everyone should be able to set up passkey and also authenticator app. For me it is now useless. And small cosmetic thing: new passkey login button has 3px border radius, give it 5px as other buttons on login form have. It looks wierd now.

Just wanted to say thank for this, been using FA for a few months and love it!

Great news! I moved all sites to FluentAuth several months ago from Kadence Security (Previously known as Solid Security and before that iThemes Security). I was a Liquidweb customer for ages (2001 - 2024), but I don't like what has happened to the company and how they are swallowing up premium plugins and raising prices (private equity behavior) without adding value. Thanks for this major update!

can't login anymore :)

✓ Your authenticator app is set up.

You will be asked for a code from it the next time you sign in.

and this comes everytime i want 2 access admin panel

I've used it for sometime now, and it's been of great use. However, I was having issues with bot users completing the registration form using @example.net(.org,.com) email addresses. Managed to stop that by adding the Simple Cloud flare Turnstile plugin, after the update, I've had to turn it off. It seems there's something going wrong when 2fa is switched on (for Admin, Shop Managers) and Turnstile is being used (all forms by default).

Has anyone else come across this issue? Any advice as to how I may fix this?

Smart - will check out the update 👍

Both FluentSMTP and Auth is part of my default stack. I install it on every site now. So, Thank you so much for these amazing plugins.

Shahjahan Jewel just tested and looks great, but appears to be some css/layout issues when used in FlunetHub.

I usually also set a number define rules in my wp-config for extra security, is there a way for FluentAuth to detect those?

e.g.
define( 'DISALLOW_APPLICATION_PASSWORDS', true );

YOU'RE THE BEST Shahjahan Jewel!

Thanks for the update... I can't wait to implement the new features

This makes my day in many ways. 😘

So awesome that you did this...thanks a lot :D

The bypassing of passwords in particular is a blessing. Thank you for this wonderful work. It seems to be an excellent product !

Awesome! Unfortunately, it doesn't work for me. I installed 3.0.1 on one site, went through the setup process, and registered a passkey in my user profile. It worked once but now I cannot log in anymore.

I tested regular Safari, Safari Private Browsing, Chrome, and even WordPress access through SiteGround. The passkey/Touch ID authentication fails and then repeatedly prompts me again, putting me into a loop.

I also tried logging in with email/password and using a recovery code. I tried two different recovery codes, but after entering either one, I was prompted for Touch ID/passkey again and ended up in the same loop. The email-code fallback wasn't offered either.

I've disabled the plugin through SiteGround for now so I can access the site again, but wanted to report this.

I also love the login email notifications, but it'll be great to be able to exclude the own IP from the notifications. I did get one for every login attempt - no matter if successful or not - saying I logged in via two_factor___passkey.

Already checked it out today. Loving the changes 🎉 Especially the new dashboard.

I am using fail2ban. Should I disable it or FluentAuth can work with it?

In combination with ASE pro and change the login URL it does not work to enable fingerprint login. It is not possible to get in de admin area...

Interesting statement... and i trust you in this. Just wondering if changing the login URL takes off a little but of pressure for bots that are trying to find the wp-admin / wp-login

So very grateful for all that you do and are, Shahjahan Jewel  I used it to sort some things out today and it was easy and easy to use. 🙂✨

That sounds great! Thanks Shahjahan Jewel for all your valuable contributions.

One question: I use WP Security Ninja (with Firewall) on all my sites. Does it make sense to still use FAuth? Could it create conflicts if I use both? Thanks

I've been using the free version of WordFence for years. I'm just curious, as WordFence is really good at its file scanner, I'm all for swapping out plugins as that's the biggest thing. Oh, and doing auto blocks. But again, I'd love to switch it out for a lighterweight plug-in if this does the file audit well. WordFence is the only other plugin that I've ever seen that really finds files that have been compromised. So I'm curious on that.

Love the new look and speed of the FluentAuth site! I can see you're using Astro for the frontend—just curious as a fellow dev, are you still using WordPress as a headless CMS for the backend, or was this a complete migration away from WP for the main site?

Try it.. break it as you say. Removed the login url so it is the normal wp-login / wp-admin. Then activated the plugin again hoping i could use the fingerprint, but i got totally locked in the screen. An authenticator app is not enabled for this account. Pressing continue does not work. I am locked out of the admin area. Have to remove the plugin to use my site again. Love the crm plugin and am a fan of the work of wpmanageNinja. Always in to change my current plugins for one of you...

I’d definitely pay for a pro if it included the ability to build the registration form properly and add your own consent boxes and stuff rather than needing to use FluentForms

hey Shahjahan Jewel, this is exactly what is missing and I was just discussing in another post on user onboarding. How does this integrate with FluentCart? Right now when signing up for a paid membership to FluentCommunity using FluentCart there is no way to set a username/password in the sales flow - you have to buy, then go to your profile, drill down and set a password manually, which is a really cumbersome onboarding flow. How does FluentAuth integrate with FluentCart to set up a user during the sales flow?

I'm currently using FluentAuth on all of my sites with FluentCommunity Pro, where I have "Members". I'm wondering if I can also use this on sites I build and maintain for others that don't have a "Community Membership" on them. They only have me and 1-3 more admins of the sites, so can I utilize FluentAuth to hide/bypass the default wp_login form to secure all logins for all admins?

Shahjahan Jewel I think there could be better integration with FluentCommunity too. I use the default FC login and a custom registration (FluentForms). Login looks great, as does registration as that's how I built the page. But with FA forms off, lost password is the horrible default WP one. If shortcode forms are turned on and Login page design off, it's right (blue button), but not as I expected - I didn't add any shortcodes but it has one appended to the community url! If I turn shortcodes off and Login page design on, FA overrides FC and the url changes to the wp-login default and I get the FA form (black button) and the Login/Register/Lost Password links are all then the FA forms and not the FC ones. Sound confusing? That's because it is. I'm sure you wouldn't want it to be. I understand things are happening in a relatively logical way. But perhaps there's a better way to make it clear if a user has both FC and FA installed, which would be the better path - Is FC installed? - use FC forms OR use FA forms, if not here's your form options. Finally, because I have FA's forms and shortcodes toggled off, and using FC's only, if a user enters wp-login.php (for whatever reason, it happens!), they get the default WordPress login, register and lost password pages/forms, which no one wants after we have spent time prettying up all our user forms etc. FA could do with an option to change or block this url.

Shahjahan Jewel, thanks for this great plugin. I started using it yesterday; everything works well, but I'm having trouble getting password reset emails to link to my custom reset page instead of the default wp-login.php?action=rp screen.

My Setup:

• Custom login page: mysite.com/login

• Custom register page: mysite.com/register

• Custom reset page: mysite.com/password-reset

• The reset page contains only the [fluent_auth_reset_password] shortcode, is published, and renders correctly when I visit it directly while logged out.

• Settings > Login & Signup Forms > "Shortcode forms" is turned ON.

  When I trigger a password reset (either via "Lost your password?" on the login form, or by sending a reset link from FluentAuth > Users), the email I receive still links to the default /wp-login.php?action=rp&key=...&login=... URL instead of my mysite.com/password-reset page.

Great update! Would you consider supporting email OTP login in the near future?

Love it!

Thank you so much for everything, Shahjahan Jewel! 🙌

Unfortunately, I'm unable to access my admin now. I'm trying to log in through the Magic Login button in xCloud, and I've tried multiple times, but I haven't received any email for a 2FA code or anything. Could you please guide me what must've went wrong? Or should I raise a support ticket? 🥺 TIA! 💚🙏

Hi

Thanks Jewel for the amazing work !

So we have a problem after we updated many sites to 3.0.0

the 2FA codes were being received correctly before, without FluentSMTP. The sites were simply using the standard WordPress email function on Hostinger Cloud hosting.

However, since version 3.0.1, 2FA codes are no longer being received on those sites.

This is an issue for us because we manage many client websites, and clients can no longer log in through the standard login form. At the moment, we have to access the hosting account and manually disable 2FA before they can log in again.

Since everything was working correctly before version 3.0.1, there seems to be a regression or an issue introduced in this version.

Shahjahan Jewel I like the idea of your FluentAuth. If it does not conflict with WordFence (free and premium) that would be great. Since some of FluentAuth features duplicate WordFence features, can you please provide some guidance for concurrent use setup? Thanks.

Hello Shahjahan Jewel,

Thanks for FluentAuth. We tested 3.0.2 on a staging copy of a WooCommerce site before adopting it. Good to see email_verified checked on Google and GitHub addresses resolved through /user/emails — that check is missing from a lot of social login code. Three things came up.

1. Inverted condition in the signup path. In AuthService, lines 54-58, the provider's username is adopted only when username_exists() returns true, and skipped when the name is free. registerNewUser() then rejects the duplicate, so signup fails with "Could not register you" exactly when the name collides — while an available username is never used and the login falls back to the email address. Reproduced both directions. In our sample, around 1% of Google local parts collided with an existing username, so it is not a rare path. Looks like a one-character fix.

2. Identity is keyed on email, not the provider's account ID. Matching on email is why existing users were picked up with no migration, which is a real strength. The edge cases are the cost: an account whose stored email is empty gets a brand new account instead of reconnecting, stranding its history, and the same happens to anyone who changes their Google address. Storing the provider's subject ID at first login and matching on that before falling back to email would close both, and would give stores a migration path from plugins that already keep such a mapping.

3. WooCommerce signups bypass wc_create_new_customer(). Accounts are created with wp_insert_user(), so woocommerce_created_customer never fires. The role still comes out right, so nothing looks wrong — but anything listening for that action is skipped. In our case an email verification plugin leaves the new customer unverified even though the provider had just proven the address. Firing the action, or routing through wc_create_new_customer() when WooCommerce is active, would fix it. Since you already track internally that the address was proven by the IdP, exposing that as a filter would let verification plugins skip their own round trip.

The 2FA and passkey side tested well and we are adopting it either way. Points 1 and 3 are what is holding back the social login move, and we are glad to re-test changes on staging.

Thanks again,

I know I told you previously, Shahjahan Jewel, but I have to say it again:

The more I install and configure FluentAuth, the more I love it. It’s the perfect security-hardening plugin I was missing! 

Hi Shahjahan Jewel ,

When enabling social login, is there a specific reason you chose to design FluentAuth to use the user’s email address as their username?

Using an email address as a username feels inappropriate, especially from a usability and privacy perspective. It would be more user‑friendly to allow individuals to choose their own username, or at least use their Google display name instead of their full email address.

Is there anything I might be overlooking that makes this approach difficult or not feasible to implement?

Thank you 😚