=== Message Verify ===
Contributors: messagecom
Tags: login, verification, security, email
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPL-2.0-or-later

Email verification after WordPress password sign-in using your Message Verify account.

== Installation ==
Upload the ZIP through Plugins > Add New > Upload Plugin and activate.
Open Settings > Message Verify. Connect a Verify-scoped API key and an email-enabled service ID from https://app.message.com/verify/.
Send yourself a test code and enter it to enable protection. HTTPS is required.
Keep an administrator session open while testing in a second browser.

== External service ==
This plugin calls https://app.message.com/api/v1/verify to send and check codes. It sends the account email, service ID and verification code to Message Verify. API keys stay on your server in a non-autoloaded WordPress option and are never rendered back into the settings form. Your Message Verify account, delivery configuration and balance are required. Standard Verify charges apply.
Service: https://message.com/
Privacy: https://message.com/privacy/
Terms: https://message.com/terms/

== Scope ==
Protects browser password sign-ins, including WooCommerce account sign-ins that use WordPress authentication. Does not verify checkout, public forms or SMS consent. XML-RPC password sign-ins are blocked while enabled. Existing sessions and WordPress Application Passwords are unaffected. Other authentication/SSO plugins require compatibility testing.

== Recovery ==
If delivery is unavailable, sign-in fails closed. Use an existing administrator session to disable verification, or run `wp plugin deactivate message-verify` through your hosting console. You can also rename the message-verify plugin folder using the hosting file manager. Uninstall removes settings and pending challenges. Deactivation preserves settings.

== Changelog ==
= 1.0.0 =
Separate Verify plugin with tested setup, browser-bound sign-in challenges, one-time consumption, expiry, local attempt limits, password-change invalidation, and server-side API credentials.
