Find your store

Add-on

Email OTP Verification

Requires a one-time email code to confirm signups, optionally on every login, and protects a customer's change of account email behind their password and a code sent to the new address. Wrong codes lock the account's code requests for a while; the settings screen shows every code sent and lets an admin lift a lock.

  • Version 1.2.62

Add-on

Buy and install it from Add-ons in your admin panel.

Buy now · $7.00 Choose a platform

Changelog

  1. Version 1.2.62 8 Nov 2026

    - Visitor addresses in this add-on's limits and logs always come from the store's trusted-proxy setting (TRUSTED_PROXY_IPS): behind a listed proxy or CDN they are the visitor's own, never the proxy's; with none listed nothing changes.
    - Uses the store's shared rule for counting a visitor's address in its code limits. No change in behaviour.

  2. Version 1.2.61 4 Nov 2026

    - For developers: this plugin now tells the coming Clear test data tool what to do with each of its tables (empty it, keep it, or remove it only with customer accounts). Nothing changes for store owners yet.

  3. Version 1.2.60 1 Nov 2026

    - Admin: the customer link on the sign-in codes page now reads "View customer" instead of "Open customer", in every language.

  4. Version 1.2.59 29 Oct 2026

    - On a store running MySQL 8, signing out a customer who signed in with an email code no longer fails on an older database.
    - Its database tables name their text collation, so they come out the same on every server.
    - Amharic (አማርኛ) translation, machine-translated (review welcome).
    - Oromo (Afaan Oromoo) translation, machine-translated (review welcome).

  5. Version 1.2.58 26 Oct 2026

    - Adds Thai (ไทย). Machine-translated; review welcome.
    - Japanese translation.

  6. Version 1.2.57 25 Oct 2026

    - Adds Polish (pl) text. Machine-translated.

  7. Version 1.2.56 23 Oct 2026

    - Change-of-address codes count against one hourly cap per mailbox, so address+tag variants of one inbox share it.
    - Customers who ask for too many verification codes in an hour now see a clear message telling them how many minutes to wait, instead of a countdown of thousands of seconds.
    - Visitors on IPv4 behind a dual-stack server no longer share one sign-up limit and one wrong-code lock.
    - The "your account email was changed" warning to the old address can no longer be switched off.
    - Email-change codes to one address are capped at 5 an hour, however many accounts ask.
    - Sign-in codes are capped at 10 an hour per account.

  8. Version 1.2.55 22 Oct 2026

    - A store previewed in another language shows the sign-in code screens' own wording in that language, not the admin's own.