{"id":15046666,"url":"https://github.com/auth0/wordpress","last_synced_at":"2025-04-12T18:42:17.986Z","repository":{"id":14186890,"uuid":"16893279","full_name":"auth0/wordpress","owner":"auth0","description":"WordPress Plugin for Auth0 Authentication","archived":false,"fork":false,"pushed_at":"2024-09-03T17:05:45.000Z","size":10816,"stargazers_count":159,"open_issues_count":11,"forks_count":97,"subscribers_count":67,"default_branch":"5.x","last_synced_at":"2025-04-03T20:12:11.173Z","etag":null,"topics":["dx-sdk","enterprise","passwordless","sso","wordpress","wordpress-plugin"],"latest_commit_sha":null,"homepage":"https://auth0.com/docs/cms/wordpress","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/auth0.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-02-16T20:20:08.000Z","updated_at":"2025-03-27T13:23:06.000Z","dependencies_parsed_at":"2024-01-11T05:14:22.934Z","dependency_job_id":"14c4facc-187e-49b9-b1cb-3868f807e7fe","html_url":"https://github.com/auth0/wordpress","commit_stats":{"total_commits":1674,"total_committers":50,"mean_commits":33.48,"dds":0.5651135005973715,"last_synced_commit":"7ee3ea94000be27e50c5dfc6fabd59449410a0e1"},"previous_names":[],"tags_count":74,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fwordpress","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fwordpress/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fwordpress/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fwordpress/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/auth0","download_url":"https://codeload.github.com/auth0/wordpress/tar.gz/refs/heads/5.x","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248617100,"owners_count":21134189,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dx-sdk","enterprise","passwordless","sso","wordpress","wordpress-plugin"],"created_at":"2024-09-24T20:53:21.622Z","updated_at":"2025-04-12T18:42:17.941Z","avatar_url":"https://github.com/auth0.png","language":"PHP","funding_links":[],"categories":["Developer Ecosystem"],"sub_categories":[],"readme":"![WordPress by Auth0](https://cdn.auth0.com/website/sdks/banners/wp-auth0-banner.png)\n\nWordPress Plugin for [Auth0](https://auth0.com) Authentication\n\n[![License](https://img.shields.io/packagist/l/auth0/auth0-php)](https://doge.mit-license.org/)\n\n:rocket: [Getting Started](#getting-started) - :computer: [SDK Usage](#sdk-usage) - 📆 [Support Policy](#support-policy) - :speech_balloon: [Feedback](#feedback)\n\n## Overview\n\nThe Auth0 WordPress plugin replaces the standard WordPress login flow with a new authentication process using Auth0's Universal Login experience. This enables you to secure your WordPress site with Auth0's advanced features, such as MFA, SSO, Passwordless, PassKey, and so on.\n\n\u003e [!IMPORTANT]  \n\u003e This plugin is **NOT** a SDK (Software Development Kit.) It's APIs are internal and not intended for developers to extend directly. We do not support altering the plugin's behavior or integrating it in any way beyond what is outlined in this README. If you're looking to build a more extensive integration, please create a solution using the [Auth0-PHP SDK](https://github.com/auth0/auth0-php) instead.\n\n\u003e [!WARNING]  \n\u003e v4 of the plugin is no longer supported as of June 2023. We are no longer providing new features or bugfixes for that release. Please upgrade to v5 as soon as possible.\n\n## Getting Started\n\n### Requirements\n\n- PHP 8.1+\n- [Most recent version of WordPress](https://wordpress.org/news/category/releases/)\n- Database credentials with table creation permissions\n\n\u003e Please review our [support policy](#support-policy) on specific PHP and WordPress versions and when they may exit support in the future.\n\n### Installation\n\n\u003c!-- // Disabled while we complete this distribution configuration\n#### Release Package\nReleases are available from the GitHub repository [github.com/auth0/wordpress/releases](https://github.com/auth0/wordpress/releases), packaged as ZIP archives. Every release has an accompanying signature file for verification if desired.\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eVerify a release signature with OpenSSL (recommended)\u003c/b\u003e\u003c/summary\u003e\n\n1. Download the public signing key from this repository\n2. Put the repository's public signing key, the release's ZIP archive, and the release's signature file (ending in `.sign`) in the same directory.\n3. Run the following command, substituting `RELEASE` with the filename of the release you downloaded:\n\n```bash\nopenssl dgst -verify signing.key.pub -keyform PEM -sha256 -signature RELEASE.zip.sign -binary RELEASE.zip\n```\n\n'Verified OK' should be returned. If this is not the case, do not proceed with the installation.\n\u003c/details\u003e\n\n1. Open your WordPress Dashboard, then click 'Plugins', and then 'Add New'.\n2. Find the 'Upload Plugin' function at the top of the page, and use it to upload the release package you downloaded.\n\n\u003e **Note** Alternatively, you can extract the release package to your WordPress installation's `wp-content/plugins` directory.\n--\u003e\n\n#### Composer\n\nThe plugin supports installation through [Composer](https://getcomposer.org/), and is [WPackagist](https://wpackagist.org/) compatible. This approach is preferred when using [Bedrock](https://roots.io/bedrock/), but will work with virtually any WordPress installation.\n\nFor [Bedrock](https://roots.io/bedrock/) installations, you'll usually run this command from the root WordPress installation directory, but check the documentation the project's maintainers provide for the best guidance.\n\nFor standard WordPress installations, this command can be run from the `wp-content/plugins` sub-directory.\n\n```\ncomposer require symfony/http-client nyholm/psr7 auth0/wordpress:^5.0\n```\n\n\u003cp\u003e\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eNote on Composer Dependencies\u003c/b\u003e\u003c/summary\u003e\n\nWhen installed with Composer, the plugin depends on the presence of [PSR-18](https://packagist.org/providers/psr/http-client-implementation) and [PSR-17](https://packagist.org/providers/psr/http-factory-implementation) library implementations. The `require` command above includes two such libraries (`symfony/http-client` and `nyholm/psr7`) that satisfy these requirements, but you can use any other compatible libraries that you prefer. Visit Packagist for a list of [PSR-18](https://packagist.org/providers/psr/http-client-implementation) and [PSR-17](https://packagist.org/providers/psr/http-factory-implementation) providers.\n\nIf you are using Bedrock or another Composer-based configuration, you can try installing `auth0/wordpress` without any other dependencies, as the implementations may be satisfied by other already installed packages.\n\n\u003e **Note** PHP Standards Recommendations (PSRs) are standards for PHP libraries and applications that enable greater interoperability and choice. You can learn more about them and the PHP-FIG organization that maintains them [here](https://www.php-fig.org/).\n\n\u003c/details\u003e\u003c/p\u003e\n\n\u003c!-- // Disabled while we complete this distribution configuration\n#### WordPress Dashboard\n\n\u003e [!CAUTION]\n\u003e We recommend against using the WordPress Dashboard or Marketplace to install or update the plugin. Automattic does not implement reliable security measures to protect plugins from tampering, and this approach presents a supply chain risk. It is not recommended for production sites.\n\nInstallation from your WordPress dashboard is supported. This approach first installs a small setup script that will verify that your host environment is compatible. Afterward, the latest plugin release will be downloaded from the GitHub repository, have its file signature verified, and ultimately installed.\n\n- Open your WordPress Dashboard.\n- Click 'Plugins\", then 'Add New,' and search for 'Auth0'.\n- Choose 'Install Now' to install the plugin.\n--\u003e\n\n### Activation\n\nAfter installation, you must activate the plugin within your WordPress site:\n\n1. Open your WordPress Dashboard.\n2. Select 'Plugins' from the sidebar, and then 'Installed Plugins.'\n3. Choose 'Activate' underneath the plugin's name.\n\n### Configure Auth0\n\n1. Sign into Auth0. If you don't have an account, [it's free to create one](https://auth0.com/signup).\n2. [Open 'Applications' from your Auth0 Dashboard](https://manage.auth0.com/#/applications/create), and select 'Create Application.'\n3. Choose 'Regular Web Application' and then 'Create.'\n4. From the newly created application's page, select the Settings tab.\n\nPlease prepare the following information:\n\n- Note the **Domain**, **Client ID**, and **Client Secret**, available from the newly created Application's Settings page. You will need these to configure the plugin in the next step.\n- From your WordPress Dashboard's General Settings page, note your **WordPress Address** and **Site Address** URLs. We recommend you read our guidance on [common WordPress URL issues](#common-wordpress-url-issues).\n\nContinue configuring your Auth0 application from its Settings page:\n\n- **Allowed Callback URLs** should include the URL to your WordPress site's `wp-login.php`.\n  - In most (but not all) cases, this will be your WordPress Address with `/wp-login.php` appended.\n  - Please ensure your site is configured never to cache this URL, or you may see an \"invalid state\" error during login.\n- **Allowed Web Origins** should include both your WordPress Address and Site Address URLs.\n- **Allowed Logout URLs** should consist of your WordPress Address.\n\n\u003cp\u003e\u003cdetails id=\"common-wordpress-url-issues\"\u003e\n\u003csummary\u003e\u003cb\u003eCommon WordPress URL Issues\u003c/b\u003e\u003c/summary\u003e\n\n- These must be the URLs your visitors will use to access your WordPress site. If you are using a reverse proxy, you may need to manually configure your WordPress Address and Site Address URLs to match the URL you use to access your site.\n- Make sure these URLs match your site's configured protocol. When using a reverse proxy, you may need to update these to reflect serving over SSL/HTTPS.\n\u003c/details\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eTroubleshooting\u003c/b\u003e\u003c/summary\u003e\n\nIf you're encountering issues, start by checking that your Auth0 Application is setup like so:\n\n- **Application Type** must be set to **Regular Web Application**.\n- **Token Endpoint Authentication Method** must be set to **Post**.\n- **Allowed Origins (CORS)** should be blank.\n\nScroll down and expand the \"Advanced Settings\" panel, then:\n\n- Under **OAuth**:\n  - Ensure that **JsonWebToken Signature Algorithm** is set to **RS256**.\n  - Check that **OIDC Conformant** is enabled.\n- Under **Grant Types**:\n  - Ensure that **Implicit**, **Authorization Code**, and **Client Credentials** are enabled.\n  - You may also want to enable **Refresh Token**.\n\n\u003c/details\u003e\u003c/p\u003e\n\n### Configure the Plugin\n\nUpon activating the Auth0 plugin, you will find a new \"Auth0\" section in the sidebar of your WordPress Dashboard. This section enables you to configure the plugin in a variety of ways.\n\nFor the plugin to operate, at a minimum, you will need to configure the Domain, Client ID, and Client Secret fields. These are available from the Auth0 Application you created in the previous step. Once configured, select the \"Enable Authentication\" option to have the plugin begin handling authentication for you.\n\nWe recommend testing on a staging/development site using a separate Auth0 Application before putting the plugin live on your production site.\n\n### Configure WordPress\n\n#### Plugin Database Tables\n\nThe plugin uses dedicated database tables to guarantee high performance. When the plugin is activated, it will use the database credentials you have configured for WordPress to create these tables.\n\nPlease ensure your configured credentials have appropriate privileges to create new tables.\n\n#### Cron Configuration\n\nThe plugin uses WordPress' [background task manager](https://developer.wordpress.org/plugins/cron/) to perform important periodic tasks. Proper synchronization between WordPress and Auth0 relies on this.\n\nBy default, WordPress' task manager runs on every page load, which is inadvisable for production sites. For best performance and reliability, please ensure you have configured WordPress to use a [cron job](https://developer.wordpress.org/plugins/cron/hooking-wp-cron-into-the-system-task-scheduler/) to run these tasks periodically instead.\n\n## SDK Usage\n\nThe plugin is built on top of [Auth0-PHP](https://github.com/auth0/auth0-PHP) — Auth0's full-featured PHP SDK for Authentication and Management APIs.\n\nFor custom WordPress development, please do not extend the plugin's classes themselves, as this is not supported. Nearly all of the plugin's APIs are considered `internal` and will change over time, most likely breaking any custom extension built upon them.\n\nInstead, please take advantage of the full PHP SDK that the plugin is built upon. You can use the plugin's `getSdk()` method to retrieve a configured instance of the SDK, ready for use. This method can be called from the plugin's global `wpAuth0()` helper, which returns the WordPress plugin itself.\n\n```php\n\u003c?php\n\n$plugin = wpAuth0(); // Returns an instanceof Auth0\\WordPress\\Plugin\n   $sdk = wpAuth0()-\u003egetSdk(); // Returns an instanceof Auth0\\SDK\\Auth0\n```\n\nPlease direct questions about developing with the Auth0-PHP SDK to the [Auth0 Community](https://community.auth0.com), and issues or feature requests to [it's respective repository](https://github.com/auth0/auth0-PHP). Documentations and examples on working with the Auth0-PHP SDKs are also available from [its repository](https://github.com/auth0/auth0-PHP).\n\n## Support Policy\n\n- Our PHP version support window mirrors the [PHP release support schedule](https://www.php.net/supported-versions.php). Our support for PHP versions ends when they stop receiving security fixes.\n- As Automattic's stated policy is \"security patches are backported when possible, but this is not guaranteed,\" we only support [the latest release](https://wordpress.org/news/category/releases/) marked as [\"actively supported\"](https://endoflife.date/wordpress) by Automattic.\n\n| Plugin Version | WordPress Version | PHP Version | Support Ends |\n| -------------- | ----------------- | ----------- | ------------ |\n| 5              | 6                 | 8.3         | Nov 2026     |\n|                |                   | 8.2         | Dec 2025     |\n|                |                   | 8.1         | Nov 2024     |\n\nComposer and WordPress do not offer upgrades to incompatible versions. Therefore, we regularly deprecate support within the plugin for PHP or WordPress versions that have reached end-of-life. These deprecations are not considered breaking changes and will not result in a major version bump.\n\nSites running unsupported versions of PHP or WordPress will continue to function but will not receive updates until their environment is upgraded. For your security, please ensure your PHP runtime and WordPress remain up to date.\n\n## Feedback\n\n### Contributing\n\nWe appreciate feedback and contribution to this repo! Before you get started, please see the following:\n\n- [Auth0's general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)\n- [Auth0's code of conduct guidelines](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)\n\n### Raise an issue\n\nTo provide feedback or report a bug, [please raise an issue on our issue tracker](https://github.com/auth0/wp-auth0/issues).\n\n### Vulnerability Reporting\n\nPlease do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/whitehat) details the procedure for disclosing security issues.\n\n---\n\n\u003cp align=\"center\"\u003e\n  \u003cpicture\u003e\n    \u003csource media=\"(prefers-color-scheme: light)\" srcset=\"https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png\" width=\"150\"\u003e\n    \u003csource media=\"(prefers-color-scheme: dark)\" srcset=\"https://cdn.auth0.com/website/sdks/logos/auth0_dark_mode.png\" width=\"150\"\u003e\n    \u003cimg alt=\"Auth0 Logo\" src=\"https://cdn.auth0.com/website/sdks/logos/auth0_light_mode.png\" width=\"150\"\u003e\n  \u003c/picture\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003eAuth0 is an easy-to-implement, adaptable authentication and authorization platform.\u003cbr /\u003e\nTo learn more checkout \u003ca href=\"https://auth0.com/why-auth0\"\u003eWhy Auth0?\u003c/a\u003e\u003c/p\u003e\n\n\u003cp align=\"center\"\u003eThis project is licensed under the MIT license. See the \u003ca href=\"./LICENSE\"\u003e LICENSE\u003c/a\u003e file for more info.\u003c/p\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fauth0%2Fwordpress","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fauth0%2Fwordpress","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fauth0%2Fwordpress/lists"}