Skip to main content

Security Plugin Compatibility

OneTap Login is designed to work alongside WordPress security plugins. This guide covers compatibility, configuration, and troubleshooting for popular security solutions.

Overview​

Common Security Features​

Security plugins may affect OneTap Login through:

  • Firewall rules - Blocking Google API requests
  • Login protection - Rate limiting, CAPTCHAs
  • Two-factor authentication - Additional verification
  • Brute force protection - IP blocking
  • File integrity - Monitoring plugin files

General Compatibility​

OneTap Login is compatible with most security plugins when properly configured.

Wordfence Security​

Status: ✅ Compatible​

Configuration​

Firewall Settings​

Ensure these are not blocking Google:

  1. Go to Wordfence > Firewall
  2. Check "Allowed IPs" if using strict mode
  3. Whitelist Google OAuth endpoints (usually automatic)

Login Security​

For Wordfence Login Security:

  • 2FA integration supported (see 2FA Plugins)
  • reCAPTCHA may conflict - see below

reCAPTCHA Conflict​

If Wordfence reCAPTCHA is enabled:

  • Google button still works
  • But may show CAPTCHA after Google auth
  • Consider disabling reCAPTCHA for logged-in users

Recommendation: Disable reCAPTCHA for Google sign-in flow:

add_filter('wordfence_ls_require_captcha', function($require, $action) {
    // Skip CAPTCHA for Google OAuth callback
    if (isset($_GET['code']) && isset($_GET['state'])) {
        return false;
    }
    return $require;
}, 10, 2);

Troubleshooting​

Issue: "Access Denied" during Google callback

Solution:

  1. Temporarily disable Wordfence firewall
  2. Test Google sign-in
  3. If works, add callback URL to whitelist
  4. Re-enable firewall

Solid Security (iThemes Security)​

Status: ✅ Compatible​

Configuration​

File Change Detection​

OneTap Login files may trigger alerts:

  1. Go to Security > Settings > File Change Detection
  2. Add to exclusion list: 
    wp-content/plugins/onetap-login-for-woocommerce/

Login Lockout​

Solid Security's lockout features work alongside:

  • IP lockout still functions
  • Google sign-in bypasses password attempts
  • Failed Google auth doesn't count against lockout

2FA Integration​

Solid Security 2FA supported - see 2FA Plugins.

Troubleshooting​

Issue: Locked out after Google sign-in attempts

Solution: Check if IP was blocked for other reasons; Google sign-in shouldn't trigger lockout.

Sucuri Security​

Status: ✅ Compatible​

Configuration​

Firewall (Sucuri WAF)​

If using Sucuri's cloud WAF:

  1. Login to Sucuri dashboard
  2. Go to Firewall > Settings
  3. Ensure Google's OAuth endpoints aren't blocked

Hardening​

Most hardening options compatible:

  • Disable file editing: Compatible
  • Block PHP in uploads: Compatible
  • Security keys: Compatible

Troubleshooting​

Issue: 403 Forbidden on OAuth callback

Solution: Add callback URL to Sucuri WAF whitelist.

All In One WP Security​

Status: ✅ Compatible​

Configuration​

Login Lockdown​

Settings to check:

  1. Go to WP Security > User Login
  2. Google sign-in works alongside lockdown
  3. Failed Google attempts don't count

Firewall​

Basic firewall compatible:

  • 6G/7G rules work
  • Custom rules may need adjustment

Brute Force​

Compatible - Google auth bypasses brute force protection since it doesn't use passwords.

Shield Security​

Status: ✅ Compatible​

Configuration​

Bot Protection​

May need adjustment:

  1. Go to Shield > Bot Detection
  2. If Google sign-in blocked as bot
  3. Add exception for OAuth callback

Login Guard​

Works alongside Shield's login protection.

Defender Pro (WPMU DEV)​

Status: ✅ Compatible (with configuration)​

Important Configuration​

Defender Pro's firewall may block the Google OAuth callback. Here's how to fix:

Allowlist REST API​

  1. Go to Defender > Firewall > IP Lockout
  2. Click Allowlist
  3. Add your site's callback URL pattern: 
    /wp-json/onetap/v1/callback

Configure User Agent​

If blocking by user agent:

  1. Go to Defender > Firewall > User Agent Banning
  2. Ensure "Googlebot" is not blocked (shouldn't be by default)
  3. Check custom rules don't block Google

2FA Compatibility​

Defender 2FA is supported - see 2FA Plugins.

FeatureSettingNotes
IP LockoutEnabledAdd callback to allowlist
404 DetectionEnabledWon't affect OAuth
User Agent BanningDefaultDon't block Google
GeolocationCarefulMay block Google servers

Troubleshooting​

Issue: 403/401 error on Google callback

Steps:

  1. Go to Defender > Firewall > Logs
  2. Search for your IP or "onetap"
  3. If blocked, add to allowlist
  4. Test again

Issue: Lockout after testing

Steps:

  1. Go to Defender > Firewall > IP Lockout
  2. Find your IP in blocked list
  3. Remove from blocklist
  4. Add to allowlist if needed

Cloudflare​

Status: ✅ Compatible (with configuration)​

While not a plugin, many sites use Cloudflare. Common issues and fixes:

WAF Rules​

If using Cloudflare WAF:

  1. Login to Cloudflare dashboard
  2. Go to Security > WAF
  3. Check for blocked requests from Google
  4. Create exception rule if needed

Challenge Pages​

Cloudflare challenges may interfere:

  1. Create Page Rule for callback URL
  2. Set Security Level to "Essentially Off" for: 
    yourdomain.com/wp-json/onetap/*

Bot Fight Mode​

May block legitimate Google auth:

  • Monitor for false positives
  • Create exception if needed

CSRF Token Issues​

Cloudflare can cause CSRF token mismatches:

  1. Go to Caching > Configuration
  2. Exclude from caching: 
    /wp-json/onetap/*
    /wp-admin/admin-ajax.php

See Cloudflare Troubleshooting for detailed guide.

NinjaFirewall​

Status: ⚠️ Compatible with configuration​

Configuration​

NinjaFirewall may block OAuth callbacks:

  1. Go to NinjaFirewall > Firewall Policies
  2. Check POST/GET restrictions
  3. Whitelist callback endpoint

Add to Whitelist​

// In NinjaFirewall rules
$nfw_rules['callback_whitelist'][] = '/wp-json/onetap/v1/callback';

BulletProof Security​

Status: ⚠️ Compatible with configuration​

Configuration​

May need .htaccess adjustments:

  1. Go to BPS > htaccess
  2. Ensure REST API not blocked
  3. Check custom rules

General Security Plugin Guidelines​

What Security Plugins Should NOT Block​

EndpointPurpose
/wp-json/onetap/v1/callbackOAuth callback
accounts.google.comGoogle authentication
oauth2.googleapis.comToken verification
www.googleapis.comAPI requests

Testing After Security Plugin Install​

  1. Install/configure security plugin
  2. Test Google sign-in on My Account
  3. Check for errors
  4. Review security plugin logs
  5. Adjust rules if blocked

Debug Mode​

Enable WordPress debug logging:

// wp-config.php
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);

Check /wp-content/debug.log for issues.

Rate Limiting​

OneTap's Built-in Rate Limiting​

OneTap Login has its own rate limiting:

  • 10 requests per 5 minutes per IP
  • Prevents abuse
  • Works alongside plugin rate limiting

Interaction with Security Plugins​

Most security plugins' rate limiting is compatible:

  • Password attempts: Not triggered by Google sign-in
  • Login attempts: May count OAuth callbacks
  • API requests: May need adjustment

IP Blocking Considerations​

Proxy/CDN Considerations​

If using:

  • Cloudflare
  • Sucuri WAF
  • Other CDN/proxy

Ensure security plugin gets real IP:

// Most plugins auto-detect, but verify:
// Real IP should show in security logs, not CDN IP

Google IP Ranges​

Don't block Google's IP ranges:

  • Google uses many IPs
  • Blocking can break OAuth
  • Let Google handle their security

CAPTCHA Conflicts​

Common Issue​

Security plugins adding CAPTCHA to login:

  • May show after Google auth
  • Unnecessary for OAuth users
  • Creates friction

Solutions​

  1. Disable CAPTCHA for OAuth flow
  2. Use plugin settings to exclude
  3. Custom code to bypass
// Example: Skip CAPTCHA for Google callbacks
add_filter('option_recaptcha_enabled', function($enabled) {
    if (isset($_GET['code']) && strpos($_SERVER['REQUEST_URI'], 'onetap') !== false) {
        return false;
    }
    return $enabled;
});

File Integrity Monitoring​

What to Expect​

Security plugins may flag:

  • OneTap Login plugin files (legitimate)
  • Cached Google scripts (legitimate)
  • Temporary files (legitimate)

Configuration​

Add to exclusion/whitelist:

wp-content/plugins/onetap-login-for-woocommerce/

Best Practices​

Do's​

  • Test Google sign-in after security plugin changes
  • Whitelist OAuth callback endpoints
  • Monitor security logs for false positives
  • Keep security plugins updated
  • Document custom rules

Don'ts​

  • Don't block Google IPs
  • Don't add aggressive rules without testing
  • Don't disable security features entirely
  • Don't ignore blocked request logs

Getting Help​

If security plugin blocks OneTap Login:

  1. Check logs: Security plugin logs show what's blocked
  2. Test without: Temporarily disable security plugin
  3. Contact support: Provide security plugin name and version
  4. Document: Note which rule caused the block

Next Steps​