Description
BaseCloud Shield is a lightweight yet powerful security plugin that enforces Two-Factor Authentication (2FA) on your WordPress login page. Unlike other bloat-heavy plugins, BaseCloud Shield focuses on reliability and flexibility in OTP delivery.
Key Features:
- Plug & Play: Works immediately using standard WordPress email delivery.
- Multi-Recipient System: Send OTPs to the logging-in user, a manager email, or selected users.
- Multi-Channel Delivery: Choose multiple delivery methods simultaneously (Email, SendGrid, WhatsApp, SMS, Webhook).
- WhatsApp Integration: Send OTPs directly via WhatsApp using Twilio API.
- SMS Integration: Deliver OTPs via SMS using Twilio API.
- SendGrid API V3: Native integration for high-deliverability emails.
- Webhook Support: Connect to custom webhooks for advanced automation flows.
- Secure OTPs: 6-digit one-time passwords that expire automatically.
- Browser Trust: “Remember this device” functionality to reduce friction for authorized users.
External Services
This plugin may connect to external third-party services depending on your configuration. Below is a detailed explanation of what services are used, what data is sent, and when:
SendGrid Email API (Optional)
If you select “SendGrid API” as your delivery method in the plugin settings, this plugin will send data to SendGrid’s email service to deliver one-time password (OTP) codes.
- Service: SendGrid by Twilio
- What it’s used for: Sending two-factor authentication codes via email with improved deliverability
- When data is sent: Every time a user attempts to log in and 2FA is enabled
- Data sent:
- Recipient email address (user’s email or manager email if configured)
- Sender email address (configured in plugin settings)
- Site name
- Username attempting to log in
- 6-digit one-time password code
- Email subject and HTML body
- API Endpoint: https://api.sendgrid.com/v3/mail/send
- Terms of Service: https://www.twilio.com/legal/tos
- Privacy Policy: https://www.twilio.com/legal/privacy
Important: You must have a SendGrid account and API key to use this feature. You are responsible for complying with SendGrid’s terms of service and ensuring proper data handling practices.
Twilio API for WhatsApp & SMS (Optional)
If you select “WhatsApp” or “SMS” as delivery methods, the plugin will send data to Twilio’s API to deliver one-time password codes.
- Service: Twilio
- What it’s used for: Sending two-factor authentication codes via WhatsApp and/or SMS
- When data is sent: Every time a user attempts to log in and 2FA is enabled with WhatsApp/SMS selected
- Data sent:
- Recipient phone number (from user meta field ‘billing_phone’)
- Sender phone number (WhatsApp number or SMS number configured in settings)
- Site name
- Username attempting to log in
- 6-digit one-time password code
- Message body
- API Endpoint: https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json
- Terms of Service: https://www.twilio.com/legal/tos
- Privacy Policy: https://www.twilio.com/legal/privacy
Important: You must have a Twilio account with WhatsApp and/or SMS capabilities enabled. Phone numbers must be stored in user meta (field: ‘billing_phone’). You are responsible for complying with Twilio’s terms of service.
Custom Webhook (Optional)
If you select “Webhook” as a delivery method, the plugin will send login notification data to a webhook URL you configure.
- Service: Custom webhook endpoint (configured by you)
- What it’s used for: Sending login notifications to external systems for custom processing
- When data is sent: Every time a user attempts to log in and 2FA is enabled
- Data sent:
- Site name
- Username attempting to log in
- User email address
- 6-digit one-time password code
- Recipient information array
- Timestamp of login attempt
- Endpoint: User-configured webhook URL
Important: When using the webhook option, you are responsible for the security and privacy compliance of the endpoint you configure. Ensure your webhook endpoint uses HTTPS and follows proper data protection practices.
Standard WordPress Email (Default)
By default, this plugin uses WordPress’s built-in wp_mail() function, which does not involve any external services unless your WordPress installation is configured to use a third-party SMTP service.
Installation
- Upload the
basecloud-shieldfolder to the/wp-content/plugins/directory. - Activate the plugin through the ‘Plugins’ menu in WordPress.
- Go to the “BC Shield” menu item in your dashboard.
- Enable 2FA and choose your preferred Delivery Method.
- (Optional) Enter a “Manager Email” if you wish to centralize all login codes.
FAQ
-
Does this work with custom login pages?
-
Yes. BaseCloud Shield intercepts the authentication process at the core WordPress level, so it works with most standard login forms and custom themes.
-
What if I get locked out?
-
If you lose access to your email or the delivery method fails, you can disable the plugin by renaming the folder
basecloud-shieldtobasecloud-shield-disabledvia FTP/SFTP. -
Is this compatible with WooCommerce?
-
Yes, it protects the standard WordPress user authentication flow, which WooCommerce utilizes for customer logins.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“BaseCloud Shield” is open source software. The following people have contributed to this plugin.
Contributors
Translate “BaseCloud Shield” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.3.2
Branding Update
• Replaced Lottie animation with official BaseCloud SVG logo
• Removed Lottie player dependency for lighter plugin
• Cleaner, faster admin interface
1.3.1
UI/UX Polish
• Removed placeholder text from IP Whitelist and Blacklist fields
• Cleaner, empty textareas by default
• Current IP info box remains for reference
1.3.0
Release Update
• Bug fixes and improvements
• Updated version for deployment
1.3.0
Advanced IP Management & Security Controls
NEW FEATURES:
• IP Whitelist: Add trusted IPs that bypass lockout and rate limiting
– Support for exact IPs (169.0.79.28)
– Support for wildcards (192.168..)
– Support for CIDR notation (10.0.0.0/24)
– Current IP displayed for easy whitelisting
• IP Blacklist: Permanently block malicious IPs from accessing site
• Manual IP Unlock: Real-time lockout management
– View all currently locked IPs in admin panel
– See countdown timers for auto-unlock
– One-click manual unlock button
– Audit trail for all unlock actions
SECURITY IMPROVEMENTS:
• Whitelisted IPs bypass all lockout checks and rate limiting
• Blacklist check occurs before authentication processing
• Enhanced logging for whitelist/blacklist activities
• Secure AJAX endpoint for IP unlock with nonce verification
UI/UX ENHANCEMENTS:
• New “Security Controls” section in admin settings
• Real-time locked IP display with status indicators
• Color-coded security interface
• Improved admin panel organization
1.2.8
Critical Hotfix – Login Issue Resolved
CRITICAL FIX:
• Fixed “Suspicious session detected” blocking legitimate logins
• Session token now uses consistent secret (not time-based)
• Users can now successfully complete login with OTP
Improvements:
• Enhanced OTP lock mechanism to prevent duplicate generation
• Existing valid OTP reused if login attempted multiple times
• Better handling of page refreshes during OTP verification
• Reduced false positive security alerts
1.2.7
Critical Security & Bug Fix Release
CRITICAL FIX – Duplicate OTP Prevention:
• Fixed issue causing multiple duplicate OTP emails to be sent
• Implemented email deduplication across all delivery methods
• Added phone number deduplication for WhatsApp/SMS
• Enhanced recipient list processing to prevent duplicate entries
• Added 60-second OTP generation lock to prevent rapid duplicates
Enterprise-Grade Security Enhancements:
• Brute Force Protection: Maximum 5 OTP attempts before 15-minute IP lockout
• Rate Limiting: 3 OTP requests per 10-minute window per user/IP
• Cryptographically Secure OTP: Replaced rand() with random_bytes()
• Session Binding: IP address validation, User-Agent fingerprinting
• HMAC-SHA256 session tokens to prevent session fixation attacks
• CSRF Protection: WordPress nonce validation on all OTP submissions
• Enhanced Cookie Security: httponly and secure flags on all cookies
• Security Event Logging: Comprehensive audit trail (last 100 events)
• Real-Time Security Alerts: Email/webhook alerts for suspicious activity
• Timing Attack Protection: Constant-time comparisons using hash_equals()
Attack Prevention:
• OTP Interception Prevention (IP binding)
• Session Hijacking Detection (multi-factor validation)
• CSRF Attack Protection (nonce tokens)
• Replay Attack Prevention (one-time codes with metadata)
• Rate Limit Abuse Prevention (throttling)
• Brute Force Attack Blocking (auto-lockout)
Security Monitoring:
• 12 new security event types tracked and logged
• IP mismatch detection and alerting
• Session token mismatch detection
• Failed attempt tracking with remaining attempt counter
• Expired OTP usage attempt logging
• Invalid trust cookie detection
Technical Improvements:
• Enhanced IP detection (proxy, CloudFlare, load balancer support)
• OTP metadata tracking (IP, User-Agent, timestamp, attempts)
• Improved error messages with security context
• Pattern validation for numeric OTP input
• Better cookie management with expiration handling
1.2.6
Release Update
• Bug fixes and improvements
• Updated version for deployment
1.2.5
SendGrid From Email Enhancement
• Added dedicated “From Email Address” field for SendGrid configuration
• Allows customization of sender email specifically for SendGrid API
• Improved email deliverability and branding control for SendGrid users
• Defaults to site admin email if not configured
1.2.4
Lottie Logo Fix
• Fixed Lottie player script loading order to display logo properly
• Changed script loading from footer to header for immediate availability
• Resolved warning icon display issue on page load
1.2.3
Visual Enhancement
• Added animated BaseCloud logo (Lottie) to settings page header
• Logo animation loops continuously for enhanced brand presence
• Improved visual appeal and professional appearance
1.2.2
WordPress.org Compliance
• Fixed tag limit compliance (reduced to 5 tags as per WordPress.org requirements)
• Optimized tags for better plugin discoverability
1.2.1
UI/UX Improvements
• Enhanced select dropdown readability with bright green highlight for selected options
• Improved multi-select list with visible selection states
• Added hover effects and visual feedback for better user experience
• Enhanced checkbox styling with BaseCloud green accent colors
• Improved input field focus states with green border highlights
• Added text selection styling with brand colors
• Enhanced save button with glow effect and hover animation
• Better contrast and readability across all form elements
• More polished “BaseCloud” branded interface
1.2.0
Major Feature Release – Multi-Recipient & Multi-Channel Delivery
• Added Multi-Recipient System with 3 modes:
– Send to Logging-in User (default)
– Send to Manager Email (centralized notifications)
– Send to Selected Users (choose specific users from your site)
• Added Multi-Channel Delivery – select multiple delivery methods simultaneously
• Added WhatsApp integration via Twilio API
• Added SMS integration via Twilio API
• Enhanced UI with organized sections and dynamic form fields
• User selection interface with multi-select dropdown
• Auto-detection of all WordPress users on the site
• Smart routing system sends OTP to all selected recipients via all selected methods
• Phone number retrieval from user meta (billing_phone field)
• Improved settings panel layout with collapsible configuration sections
• Each delivery method now has dedicated configuration area
• Backward compatible with existing configurations
1.1.0
Internal Development Version
• Pre-release testing version
1.0.1
UI Improvements
• Updated labels and placeholders to be more generic for broader use
• Changed “BaseCloud CRM Webhook” to “Webhook” in delivery method options
• Removed BaseCloud-specific email placeholders for wider audience compatibility
• Updated version for deployment
1.0.0
- Initial Release.
- Added Central Manager Email routing.
- Added SendGrid API V3 integration.
- Added BaseCloud CRM Webhook integration.
