Apocalypse Meow vs Login with Vipps and MobilePay

Apocalypse Meow’s main focus is addressing WordPress security issues related to user accounts and logins. This includes things like: Brute-force login-in protection; Customizable password strength requirements; XML-RPC access controls; Account access alerts; Searchable access logs (including failed login attempts and temporary bans); User enumeration prevention; Registration SPAM protection; Miscellaneous Core and template options to make targeted hacks more difficult; Anonymize/scrub leaky remote request headers; Security is an admittedly technical subject, but Apocalypse Meow strives to help educate “normal” users about the nature of common web attacks, mitigation techniques, etc. Every option contains detailed explanations and links to external resources with additional information. Knowledge is power! Requirements Due to the advanced nature of some of the plugin features, there are a few additional server requirements beyond what WordPress itself requires: WordPress 4.4+. PHP 7.4 or later. PHP extensions: (bcmath or gmp), date, filter, json, pcre. CREATE and DROP MySQL grants. Single-site Installs (i.e. Multi-Site is not supported). Please note: it is not safe to run WordPress atop a version of PHP that has reached its End of Life. Future releases of this plugin might, out of necessity, drop support for old, unmaintained versions of PHP. To ensure you continue to receive plugin updates, bug fixes, and new features, just make sure PHP is kept up-to-date. 🙂 Log Monitoring Some robots are so dumb they’ll continue trying to submit credentials even after the login form is replaced, wasting system resources and clogging up the log-in history table. One way to mitigate this is to use a server-side log-monitoring program like Fail2Ban or OSSEC to ban users via the firewall. Apocalypse Meow produces a 403 error when a banned user requests the login form. Your log-monitoring rule should therefore look for repeated 403 responses to wp-login.php. Additionally, some robots are unable to follow redirects; if your login form requires SSL, you should also ban repeated 301/302 responses to catch those fools. If you have enabled user enumeration protection with the die() option, requests for ?author=X will produce a 400 response code which can be similarly tracked. Privacy Policy When active, this plugin retains security logs of every sign-in attempt made to the CMS backend. This information — including the end user’s public IP address, username, and the status of his or her attempt — is used to help prevent unauthorized system access and maintain Quality of Service for all site visitors. This information resides fully on the hosting web site and is not shared with any third parties. Data retention is entirely up to the site operator, but by default old records are automatically removed after 90 days. Please note: Apocalypse Meow DOES NOT integrate with any WordPress GDPR “Personal Data” features. (Selective erasure of audit logs would undermine the security mechanisms provided by this plugin. Haha.)

Login with Vipps and MobilePay offers super-easy registration and login from the leading smart-payment app in Norway with more than 4.2 million users. MobilePay is used by more than 75 % of Denmark’s population (4.4 million users), and more than 36 % of Finland’s population (2.6 million users). There is no easier login. No more usernames or passwords. The users need only remember their phone number. They are also able to provide information that websites often require, like e-mail, phone numbers and addresses, from their Vipps MobilePay profile with no tedious data entry. The plugin is easy to modify for your own applications. This solution is great for all websites that wants to: Get more logged-in users All Vipps and MobilePay-users can create a profile on your website with just one click, and can be logged in directly on the next visit You can modify content, messaging and retrieve stored shopping carts for the user Your customers can see order histories and potentially register product returns More logged-in users gives you better overview and better conversion rates Get started If you are a user of Vipps and MobilePay for E-Commerce, you can add Login with Vipps and MobilePay to your account on https://portal.vippsmobilepay.com and find your API-keys there – see “Installation” for more details. If you do not have an account with Vipps Mobilepay, you can order this here: https://vippsmobilepay.com/no/priser/logg-inn . When the order has been processed, you will be notified and you will be able to retrieve the API-keys on https://portal.vippsmobilepay.com . Then see “Installation” for the next steps. Requirements WordPress version 4.9 or above PHP version 7.0 or above Your website must have an SSL certificate and be available through HTTPS OpenSSL must be configured for your PHP installation For WooCommerce, the version requirement is 3.3.4 or above The port 443 must be open for outward traffic on your servers firewall Feature Highlights Fully integrated with WooCommerce Allows login and registration on your account pages, cart, checkout and via shortcodes. Addresses automatically synchronized with Vipps MobilePay on login. User can register with one click Login with Vipps and MobilePay is the easiest way to create a new account. The user can easily share high-quality data from the user’s Vipps profile with the site owner. Available information includes name, email, address, phone number, and birth date. The identity of all Vipps users is verified using BankID, Norway’s leading electronic ID, so rest assured that these are real people with correct name and information. (Please note: Standard WordPress does not register information other than name and email, so apart from WooCommerce, you will need to write code to use this information for your particular application.) Link existing account Already registered users can link their current accounts when signing in with Vipps or from their account page. Users can choose to update their address information from Vipps MobilePay. Customizable for your application You can use the framework of this plugin to implement other solutions that require verified users, without actually requiring login. For example, you might create a system for having users sign their comments with Vipps MobilePay so as to avoid spam issues. Shortcodes [login-with-vipps application="wordpress"] – This will print out a Login with Vipps button that will log you into the given application, which by default can be either WordPress or WooCommerce. Uses this web component and supports the parameters: https://developer.vippsmobilepay.com/docs/knowledge-base/buttons/. [continue-with-vipps application="wordpress"] – This is the same, except for a different default text verb. Customizing the Plugin To use ‘Continue with Vipps/MobilePay’ in your application, there are two levels of customizations available, except for a mass of filters and hooks. Adding another ‘application’ to log into Logging into basic WordPress and into an application like WooCommerce is different in the details, especially with regards to * what page to redirect to (the profile page, or your account page, or maybe the checkout page), * handling of user data (for WooCommerce you want to update the users’ address) * and for error handling. For your own application, you may well have other actions you want done after new user registration, logins etc. We aim to provide support for as many applications as possible in time, but to create your own, these are the main steps: Define your application with a name. It should be a simple slug, like ‘wordpress’ or ‘woocommerce’ Create your login button, and make it call the supplied Javascript function “login_with_vipps” with your application name as argument. To customize, you can now modify several filters and hooks, the most important of which would be: ‘continue_with_vipps_error_your application_login_redirect’. This takes and returns an error-page redirect, the error string, and the login session data as an array. You can here return your own error page. ‘continue_with_vipps_before_your application_login_redirect’. This takes your logged-in user and a session (which can be called as an array) and is called right before the user is redirected. This would be a good place to add a filter to ‘login_redirect’ for instance. Filter ‘continue_with_vipps_your application_users_can_register’. Takes a truth value, an array of userinfo from Vipps MobilePay and a session, and should return true only if you allow the user to register Filter ‘continue_with_vipps_your application_create_userdata’. For newly registered users, takes an array to be passed to wp_update_user, an array of userinfo from Vipps MobilePay, and a session. You can here add your extra meta fields Filter ‘continue_with_vipps_your application_allow_login’. Takes a truth value, a user object, userinfo from Vipps MobilePay and a session, and returns true only if the user is allowed to log in Adding another ‘action’ apart from logging in You may want to do other things than logging in with the users’ confirmed Vipps MobilePay identity, and this plugin absolutely allows this. This might be submisssions of comments, reviews and so forth without requiring logins, or even just as a convenient way of letting users input their address. These are the main steps: Define your own action, like ‘submitaddress’. Create your button. The handler should call the static method ContinueWithVipps::getAuthRedirect($action) (you can also provide an array of sessiondata which will be available in your handlers, and restrict the scope of the data to retrieve from Vipps MobilePay. The return value is an URL to which you should redirect your user. Create your error handler. This should be hooked to ‘continue_with_vipps_error_your action‘. It will receive an error string, a description of the error, sometimes an error hint, and the contents of your session (which will no longer be active). You will need to redirect to your error page here, and show your user the error. The redirect is important, you should not output content in this action. Create your succes handler. This should be hooked to ‘continue_with_vipps_your action‘. It will receive an array of user information from Vipps MobilePay, and a live session. This handler too should end with a redirect to your success page. The rest is a simple matter of programming.