Phone Login for WooCommerce

A WordPress plugin that replaces WooCommerce email-based login/registration with a phone number based authentication flow.

Plugin Summary

Phone Login for WooCommerce enables customers to:

• Register with phone number + password
• Log in with phone number + password
• Use phone as primary account identifier in My Account
• Keep WordPress email requirement satisfied using auto-generated dummy email internally

It also includes:

• Rate limiting for failed login attempts
• Login attempt logging in custom DB table
• Password reset by phone (reset-link display flow)
• WooCommerce settings tab for plugin configuration
• User admin enhancements (phone column, phone search, CSV export)
• AJAX forms and REST API endpoints

Requirements

• WordPress 5.0+
• WooCommerce 5.0+
• PHP 7.4+

Installation

1. Copy plugin folder to:
   • /wp-content/plugins/phone-login-woocommerce
2. Go to:
   • WP Admin > Plugins
3. Activate:
   • Phone Login for WooCommerce
4. Configure settings:
   • WooCommerce > Settings > Phone Login

Recommended WooCommerce Settings

Go to WooCommerce > Settings > Accounts & Privacy:

• Enable: Allow customers to create an account on the "My account" page
• Disable: Automatically generate account password

This ensures users create their own password during phone registration.

How to Use (Step-by-Step)

1. Open My Account page (/my-account/)
2. Register using:
   • Country code
   • Phone number
   • Password
3. Logout
4. Login using:
   • Same phone number (supports +880..., 01..., or 1... for BD format variants)
   • Same password

Shortcodes

• [phone_login_form]
• [phone_register_form]
• [phone_reset_password]

Supported attributes:

• redirect_url=""
• show_remember_me="yes/no"
• button_text="Login"

Admin Features

• Settings tab: WooCommerce > Settings > Phone Login
• Users list phone column
• Search users by phone
• Bulk export selected users with phone numbers (CSV)

Security Features

• Phone sanitization and validation
• Failed login rate limiting
• Lockout after repeated failures
• Login attempt log table
• Nonce verification for AJAX handlers

Database Tables

Created on activation:

• {prefix}phone_login_attempts
• {prefix}phone_security_questions

Removed on uninstall.

REST API

Namespace: /wp-json/plwc/v1/

Endpoints:

• POST /login
• POST /register
• GET /check-phone/{number}

Authentication:

• X-WP-Nonce (REST nonce) or
• X-PLWC-API-Key

Troubleshooting

"Phone number not found" on login

• Ensure that exact account is registered.
• Try BD variants: +8801XXXXXXXXX, 01XXXXXXXXX, 1XXXXXXXXX.

"Incorrect password"

• Password mismatch.
• Reset from WordPress admin (Users > Edit User > Set New Password) and try again.

Registration asks for email / email errors

• Plugin auto-generates dummy email internally.
• If theme cache is stale, hard refresh browser (Cmd/Ctrl + Shift + R).

Testing Checklist

• Registration with phone + password
• Login with phone + password
• Duplicate phone registration blocked
• Rate limiting after multiple failed attempts
• Password reset flow works

File Highlights

• Main plugin: phone-login-woocommerce.php
• Core classes: includes/
• Admin classes/views: admin/
• Public classes/views: public/
• Assets: assets/css, assets/js
• Uninstall cleanup: uninstall.php

License

GPL v2 or later