{"id":19198446,"url":"https://github.com/virgilsecurity/virgil-pure-wordpress","last_synced_at":"2025-05-09T01:15:12.116Z","repository":{"id":146283144,"uuid":"166052090","full_name":"VirgilSecurity/virgil-pure-wordpress","owner":"VirgilSecurity","description":"Free Wordpress Plugin  based on a powerful and revolutionary cryptographic technology that protects user passwords from data breaches and both online and offline attacks.","archived":false,"fork":false,"pushed_at":"2024-10-01T10:16:19.000Z","size":981,"stargazers_count":6,"open_issues_count":0,"forks_count":3,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-05-09T01:15:04.410Z","etag":null,"topics":["aead","cryptography","password-hardened-encryption","plugin","protect-database","pure-plugin","wordpress-plugin"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/VirgilSecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-01-16T14:17:38.000Z","updated_at":"2024-09-12T00:21:10.000Z","dependencies_parsed_at":"2024-08-15T15:25:34.225Z","dependency_job_id":"607466ce-4b66-4cc9-915a-56b1014c046f","html_url":"https://github.com/VirgilSecurity/virgil-pure-wordpress","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VirgilSecurity%2Fvirgil-pure-wordpress","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VirgilSecurity%2Fvirgil-pure-wordpress/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VirgilSecurity%2Fvirgil-pure-wordpress/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VirgilSecurity%2Fvirgil-pure-wordpress/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/VirgilSecurity","download_url":"https://codeload.github.com/VirgilSecurity/virgil-pure-wordpress/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253171272,"owners_count":21865297,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aead","cryptography","password-hardened-encryption","plugin","protect-database","pure-plugin","wordpress-plugin"],"created_at":"2024-11-09T12:22:03.787Z","updated_at":"2025-05-09T01:15:12.098Z","avatar_url":"https://github.com/VirgilSecurity.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Virgil Pure WordPress Plugin\n\n[Introduction](#introduction) | [Features](#features) | [Installation](#installation) | [How To Use Plugin](#how-to-use-plugin) | [F.A.Q](#faq) | [License](#license) | [Support](#support)\n\n## Introduction\n\u003cp\u003e\u003cimg src=\"https://cdn.virgilsecurity.com/assets/images/github/logos/pure_plugin.png\" align=\"left\" hspace=\"0\" vspace=\"0\"\u003e\u003c/p\u003e\n\n[Virgil Pure Wordpress Plugin](https://wordpress.org/plugins/virgil-pure) is a free tool that protects user passwords from data breaches and both online and \noffline attacks, and renders stolen passwords useless if the database is compromised. \n\nVirgil Pure is based on a powerful and revolutionary cryptographic technology that provides stronger and more advanced security than salting and hashing, and it can be used within any database or login system that uses a password, so it's accessible for businesses of any industry or size.\n\nLearn more about the Pure technology [here](https://virgilsecurity.com/announcing-purekit).\n\n## Features\n\n#### Available\n- Zero knowledge of users' passwords\n- Protects passwords from online and offline attacks\n- Instant invalidation of stolen database records\n- Plugin deactivation and restoration of the previous user authorization system\n\n#### Coming soon\n- User data encryption with a personal key\n\n## Installation\n\nCurrently the plugin is available only for **PHP7.2** and **PHP7.3**! \n\nTo install the Pure Plugin you need to go through the following steps:\n- add the crypto extensions into your server\n- install the Plugin from the [WordPress Plugin Directory](#from-the-wordpress-plugin-directory) or from [this repository](#from-this-repository)\n\n### Step #1. Add the crypto extensions into your server before using the Plugin\n\n- [Download](https://github.com/VirgilSecurity/virgil-pure-wordpress/releases) *virgil-test.zip*, unzip it and execute\n on your server [virgil-test.php](/_help/virgil-test.php) file.\n\n- [Download](https://github.com/VirgilSecurity/virgil-pure-wordpress/releases) and unzip *%YOUR_OS%_extensions.zip* \narchive according to your server operating system and PHP version.\n\n- Make sure you have access to edit the php.ini file (for example, use *root* for the Linux/Darwin or run *cmd* under \nadministrator for the Windows).\n- Copy extension files to the extensions directory.\n    - For Linux/Darwin:\n    ```\n     $ path=\"%PATH_TO_EXTENSIONS_DIR%\" \u0026\u0026 cp vsce_phe_php.so $path \u0026\u0026 cp virgil_crypto_php.so $path\n    ```\n    - For Windows:\n    ```\n     $ set path=%PATH_TO_EXTENSIONS_DIR% \u0026\u0026 copy vsce_phe_php.dll %path% \u0026\u0026 copy virgil_crypto_php.dll %path%\n    ```\n- Add the extensions into the php.ini file \n    ```\n    $ echo -e \"extension=vsce_phe_php\\nextension=virgil_crypto_php” \u003e\u003e %PATH_TO_PHP.INI%\n    ```\n    \n- Restart your server or php-fpm service\n\n#### Extension installation example\n\nOur web stack is: *Linux, nginx, php7.2-fpm*\n\n- Execute the [virgil-test.php](/_help/virgil-test.php) to find your path to the extensions directory and path to \nthe php.ini file:\n    \u003cp\u003e\u003cimg src=\"https://raw.githubusercontent.com/VirgilSecurity/virgil-pure-wordpress/master/_help/s-1.png\" \n    width=\"60%\"\u003e\u003c/p\u003e \n\n- Then, go to the command line interface (CLI) to specify the paths you identified in the previous step:\n    \u003cp\u003e\u003cimg src=\"https://raw.githubusercontent.com/VirgilSecurity/virgil-pure-wordpress/master/_help/s-2.png\" \n    width=\"60%\"\u003e\u003c/p\u003e\n\n- Reload the page in your browser to see that the extension is loaded (`IS_VSCE_PHE_PHP_EXTENSION_LOADED =\u003e true` and \n`IS_VIRGIL_CRYPTO_PHP_EXTENSION_LOADED =\u003e true`):\n    \u003cp\u003e\u003cimg src=\"https://raw.githubusercontent.com/VirgilSecurity/virgil-pure-wordpress/master/_help/s-3.png\" \n    width=\"60%\"\u003e\u003c/p\u003e\n    \nNow it's time to add the Virgil Pure Plugin to your WordPress project.\n\n### Step #2. Install Virgil Pure WordPress Plugin\n\n- #### From the WordPress Plugin Directory\n\n    - Navigate to the WordPress Dashboard\n    - Open \"Plugins → Add New\" tab\n    - Find \"Virgil Pure\" in the WordPress Plugin Directory\n    - Install and activate the Plugin\n\n- #### From this repository\n\n    - [Download the virgil-pure.zip file](https://github.com/VirgilSecurity/virgil-pure-wordpress/releases)\n    - Navigate to the WordPress Dashboard\n    - Open \"Plugins → Add New\" tab\n    - Upload the virgil-pure.zip file\n    - Install and activate the Plugin\n    \nThe Pure Plugin should now be activated:\n\u003cp\u003e\u003cimg src=\"https://raw.githubusercontent.com/VirgilSecurity/virgil-pure-wordpress/master/_help/s-4.png\" width=\"70%\"\u003e\u003c/p\u003e\n\n## How To Use Plugin\n\n### Set up Credentials\nTo start working with the plugin, in the plugin tab on your WordPress dashboard, you'll need to input some credentials in the corresponding fields via the following steps:\n- create an account at [Virgil Dashboard](https://dashboard.virgilsecurity.com/)\n- create a Pure application\n- copy your Pure application's credentials from the config file or Virgil Security dashboard: `APP_TOKEN`, `APP_SECRET_KEY`, `SERVICE_PUBLIC_KEY`\n- paste them into the corresponding fields\n\n### Generate Recovery Keys\n\nYou’ll need to generate a recovery key so that the password hashes that are currently in your database can be \nrecovered if you ever need to deactivate the Pure plugin. Your recovery key will encrypt the original password hashes and \nwill store the encrypted values in a (wp_usermeta) table in your database. \n\nThe recovery key utilizes a public and private key pair. The public key will be stored in your database and the private key must be stored by you securely on another external device. Please read our FAQ section for best practices and more information. \n\n### Migration\n\nMigration is the process by which the plugin requests cryptographic data from the Virgil server to associate user \npasswords (user_pass) with cryptographic enrollments provided by the server. New enrollment records are then created and \nstored in your database (wp_usermeta) place of the of user passwords.\n\nOnce the Pure plugin is configured in your system, simply click the \"Start migration\" button to start the migration process.\n\n### Records Update (optional)\n\nThis function allows you to use a special `UPDATE_TOKEN` to update all of the enrollment records in your database. This action doesn't require changing user passwords or modifying the scheme of the existing table.\n\nNavigate to your Pure application panel at [Virgil Dashboard](https://dashboard.virgilsecurity.com/), press \"BEGIN \nROTATION PROCESS\", then “SHOW UPDATE TOKEN” button to get the `UPDATE_TOKEN`. Insert the `UPDATE_TOKEN` into the field at the Virgil Pure plugin tab.\n\nThis can be used when a database is known to be breached. For security reasons, we recommend proactively updating records every one week.\n\n### Recovery (optional)\n\nWhen you need to deactivate the Pure plugin, you can go through the Recovery process via the Wordpress dashboard and \nuse the recovery key to restore the original password hashes in place of the cryptographic values generated by the Pure plugin.\n\n## F.A.Q.\n\n#### - Do users have to change their passwords if the database has been compromised? \nIf a database has been stolen, users do not need to change their original passwords. However, you will need to rotate all user records in your database. This will use cryptography to disconnect the compromised Pure records from the original passwords, leaving any unauthorized party empty handed.\n\n#### - How does the Recovery Key work?\nRecovery Key is a key pair that allows you to recover the original user password hashes if you ever need to deactivate the Pure plugin. The Recovery Key encrypts the password hashes, and stores the encrypted values into the wp_usermeta table in your database.\n\nThe Recovery Key utilizes a public and private key pair. The public key is stored in the wp_option table and\nthe Private Key must be stored by you securely on an external device.\n\n#### - How much does it cost? \nPure is a FREE toolkit. All libraries are open source and can be found on GitHub, where they are available for free to any user.\n\n#### - What if an App Private Key gets lost?\nThere is no way to restore the `APP_SECRET_KEY`. The database records become inaccessible and therefore useless. So, it is highly recommended that you immediately create a backup of the key in a secure location to avoid losing it.\n\n## License\nSee [LICENSE](https://github.com/VirgilSecurity/virgil-pure-wordpress/tree/master/LICENSE) for details.\n\n## Support\nOur developer support team is here to help you. Find out more information on our [Help Center](https://help.virgilsecurity.com/).\n\nYou can find us on [Twitter](https://twitter.com/VirgilSecurity) or via email at support@VirgilSecurity.com.\n\nAlso, get extra help from our support team on [Slack](https://virgilsecurity.com/join-community).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvirgilsecurity%2Fvirgil-pure-wordpress","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvirgilsecurity%2Fvirgil-pure-wordpress","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvirgilsecurity%2Fvirgil-pure-wordpress/lists"}