Secure OTP-Based Password Reset System for WordPress

A robust password reset solution implementing military-grade security practices through custom REST API endpoints and time-limited OTP verification.

Technical Overview

System Flow

sequenceDiagram
    participant User
    participant ClientApp
    participant WordPress
    User->>ClientApp: Initiate Password Reset
    ClientApp->>WordPress: POST /send-otp (email)
    WordPress-->>ClientApp: OTP Sent Confirmation
    ClientApp-->>User: Check Email for OTP
    User->>ClientApp: Submit OTP + New Password
    ClientApp->>WordPress: POST /verify-otp (email, otp)
    WordPress-->>ClientApp: OTP Verification Status
    ClientApp->>WordPress: POST /reset-password (email, pwd, confirm_pwd)
    WordPress-->>ClientApp: Password Reset Confirmation

Core Components

app-expert-password-reset/
├── app-expert-password-reset.php             # Main plugin file (entry point)
├── includes/                                 # Contains core functionality files
│   ├── class-reset-password-api.php          # Handles API endpoints (send OTP, verify OTP, reset password)
│   ├── indexr.php                            # Bootstrap or helper file (if needed)
│   └── general/                              # General utility functions
│       └── class-utility.php                 # Utility/helper functions for the plugin
└── config.php                                # Configuration file (e.g., constants, settings)                                

Technical Specifications

API Endpoint Matrix

Security Implementation

graph TD
    A[User Request] --> B{Input Sanitization}
    B --> C[Email Validation]
    C --> D[OTP Generation]
    D --> E[Secure Metadata Storage]
    E --> F[Time-Based Expiration]
    F --> G[Password Hashing]
    G --> H[Metadata Cleanup]

Installation & Configuration

Requirements

• WordPress ≥5.8 (REST API support)
• PHP ≥7.4
• SMTP server configured for email delivery

Installation

1. Download the plugin files.
2. Upload the plugin folder to the wp-content/plugins/ directory.
3. Activate the plugin through the Plugins menu in WordPress.

Configuration

1. Set environment variables in config.php:

   define('OTP_EXPIRATION', 600);  // 10 minutes in seconds
   define('OTP_LENGTH', 6);        // 6-digit code
   define('MAX_ATTEMPTS', 3);      // Maximum verification attempts

Database Schema

User Meta Structure

Meta Cleanup Process:

delete_user_meta($user_id, 'appExpert_otp');
delete_user_meta($user_id, 'appExpert_otp_expires');
delete_user_meta($user_id, 'appExpert_otp_verified');
delete_user_meta($user_id, 'appExpert_otp_attempts');
delete_user_meta($user_id, 'appExpert_otp_last_attempt');

Professional Email Template Design

Location: email-templates/password-reset-email.php

Template Includes:

• Mobile-responsive structure
• Branded header/footer sections
• Clear visual hierarchy for OTP display
• Dynamic variables for personalization:

  <?= htmlspecialchars($user_name) ?>
  <?= htmlspecialchars(APP_NAME) ?>
  <?= htmlspecialchars((OTP_EXPIRATION / 60)) ?>

Preview:

Error Handling Matrix