Feature Request: Allow Email-only Login in FluentAuth
Hello!
I would like to suggest a feature request for FluentAuth: the option to allow login only with email, instead of allowing both username and email.
Why this would help:
- It reduces a large number of low quality login attempts that target common usernames such as admin, test, info, or the site owner's name
- It makes brute force and credential stuffing attacks slightly harder, because the attacker must know the exact email address
- It matches how many users already expect to log in today, especially on business and membership sites
- It gives site owners more control over the login surface without needing custom code or extra security plugins
Suggested implementation:
- Add a setting in FluentAuth to choose:
- Username or email
- Email only
- Username only
- Ideally this could apply both to the default WordPress login and FluentAuth custom login forms
This would be a small feature, but it could have a real security and UX benefit for many sites.
It's something typical from fail2ban plugins, but I think it will be a good addition to auth!
Thanks
cc: Shahjahan Jewel
And this would reduce one more field for possible users to start registering on the site.
arjun arjun exactly! :)
Any news on this ? Shahjahan Jewel
This post is feeling lonely
May be there are some members in this community who have already customized the plugin similar to your preference.
arjun arjun Thank you Arjun. I think I will reach Jewel directly. To my knowledge, this is somekind of side-project out from the official suite. So probably, if he has any kind of list of possible future features it could be there for the future.
For a security plugin, I am on the side of not touching it myself or having something this important delegated to an extension.
But, I will give it a try: thank you!
Any news on this feature? Shahjahan Jewel
I still think that not having an "Email only" option for logging opens the door to lots of failed attempts.
ASN and IP blocking is still not sufficient, sadly.