A secure, decentralized protocol for WordPress administrators to connect their sites and build a network of trust through cryptographic handshakes.

wilcosky

<p><strong>Peace Protocol</strong> enables WordPress site administrators to authenticate as their website and send cryptographically signed “peace” messages to other WordPress sites running the same protocol. This creates a decentralized network where admins can establish trust relationships, share peace, and enable cross-site interactions.</p>
<h3>🔒 **Security-First Design**</h3>
<h3><strong>Admin-Only Authentication</strong></h3>
<ul>
<li><strong>WordPress Administrators Only</strong>: This plugin is designed exclusively for WordPress site administrators</li>
<li><strong>Site-Level Authentication</strong>: Admins authenticate as their website, not as individual users</li>
<li><strong>No Public Registration</strong>: No public user registration system – only federated users created after secure handshakes</li>
<li><strong>Cryptographic Tokens</strong>: Each site uses cryptographically secure tokens for authentication</li>
</ul>
<h3><strong>Federated User System</strong></h3>
<ul>
<li><strong>Limited Permissions</strong>: Federated users can only comment on posts, no admin access</li>
<li><strong>Automatic Cleanup</strong>: Federated users are removed when the plugin is uninstalled</li>
<li><strong>Role-Based Security</strong>: Federated users have the <code>federated_peer</code> role with minimal capabilities</li>
<li><strong>No Dashboard Access</strong>: Federated users cannot access WordPress admin areas</li>
</ul>
<h3><strong>Token Security</strong></h3>
<ul>
<li><strong>Cryptographically Secure</strong>: Tokens are generated using WordPress’s secure password generator</li>
<li><strong>Token Rotation</strong>: Support for multiple tokens with automatic rotation</li>
<li><strong>Secure Storage</strong>: Tokens are stored securely in WordPress options</li>
<li><strong>Expiring Authorization Codes</strong>: Authorization codes expire after 5 minutes</li>
</ul>
<h3>🌟 **Key Features**</h3>
<h3><strong>Core Functionality</strong></h3>
<ul>
<li><strong>Send Peace</strong>: Send cryptographically signed peace messages to other WordPress sites</li>
<li><strong>Peace Log Wall</strong>: Display received peace messages using the <code>[peaceprotocol_log_wall]</code> shortcode</li>
<li><strong>Automatic Feed Subscription</strong>: Automatically subscribe to peace feeds from sites you connect with</li>
<li><strong>Token Management</strong>: Generate, rotate, and manage authentication tokens</li>
<li><strong>User Banning System</strong>: Ban problematic users with reason tracking</li>
<li><strong>IndieAuth Support</strong>: Alternative authentication using the IndieAuth standard with PKCE</li>
</ul>
<h3><strong>Federated Login System</strong></h3>
<ul>
<li><strong>Cross-Site Authentication</strong>: Users from remote sites can comment as their site identity</li>
<li><strong>Seamless Integration</strong>: Works with existing WordPress comment systems</li>
<li><strong>Secure Handshake</strong>: Only sites completing the cryptographic handshake can create federated logins</li>
<li><strong>Automatic User Creation</strong>: Creates federated users automatically after successful handshake</li>
<li><strong>Dual Authentication</strong>: Support for both Peace Protocol tokens and IndieAuth standard</li>
</ul>
<h3><strong>Admin Interface</strong></h3>
<ul>
<li><strong>Token Management</strong>: Generate, view, and delete authentication tokens</li>
<li><strong>Feed Management</strong>: View and manage subscribed peace feeds</li>
<li><strong>Peace Log</strong>: View all received peace messages in the admin area</li>
<li><strong>User Banning</strong>: Ban users with reason tracking and management</li>
<li><strong>Settings Configuration</strong>: Configure button position and auto-insertion</li>
</ul>
<h3><strong>Frontend Features</strong></h3>
<ul>
<li><strong>Peace Button</strong>: Floating peace hand button (✌️) that can be positioned anywhere</li>
<li><strong>Auto-Insertion</strong>: Automatically insert the peace button on your site</li>
<li><strong>Shortcode Support</strong>: Use <code>[peaceprotocol_hand_button]</code> to manually place the button</li>
<li><strong>Responsive Design</strong>: Works on all devices and screen sizes</li>
<li><strong>Dark Mode Support</strong>: Automatically adapts to user’s color scheme preference</li>
<li><strong>Choice Modal</strong>: User-friendly modal to choose between Peace Protocol and IndieAuth authentication</li>
</ul>
<h3><strong>Technical Features</strong></h3>
<ul>
<li><strong>REST API</strong>: Modern REST API endpoints for all functionality</li>
<li><strong>AJAX Fallback</strong>: AJAX endpoints for sites with REST API disabled</li>
<li><strong>CORS Support</strong>: Proper CORS headers for cross-site communication</li>
<li><strong>Translation Ready</strong>: Full internationalization support with multiple languages</li>
<li><strong>Custom Post Types</strong>: Uses custom post types for peace logs</li>
<li><strong>IndieAuth Endpoints</strong>: Full IndieAuth specification compliance with authorization and token endpoints</li>
<li><strong>PKCE Support</strong>: Proof Key for Code Exchange for enhanced security</li>
</ul>
<h3>🚀 **How It Works**</h3>
<h3><strong>For WordPress Administrators</strong></h3>
<ol>
<li><strong>Install & Activate</strong>: Install the plugin and activate it on your WordPress site</li>
<li><strong>Generate Tokens</strong>: Go to Settings > Peace Protocol and generate authentication tokens</li>
<li><strong>Send Peace</strong>: Use the peace button to send cryptographically signed peace to other sites</li>
<li><strong>Build Network</strong>: Connect with other WordPress sites and build a network of trust</li>
</ol>
<h3><strong>Federated Login Process</strong></h3>
<h4><strong>Peace Protocol Authentication</strong></h4>
<ol>
<li><strong>User from Site A</strong> visits Site B and wants to comment</li>
<li><strong>User clicks “Peace”</strong> button on Site B</li>
<li><strong>User chooses “Login with Peace Protocol”</strong> from the choice modal</li>
<li><strong>Site B redirects</strong> to Site A for authentication</li>
<li><strong>Site A validates</strong> the user and generates an authorization code</li>
<li><strong>User is redirected</strong> back to Site B with the authorization code</li>
<li><strong>Site B automatically</strong> logs in the user as a federated user from Site A</li>
<li><strong>User can comment</strong> on Site B as “siteacom”</li>
</ol>
<h4><strong>IndieAuth Authentication</strong></h4>
<ol>
<li><strong>User from Site A</strong> visits Site B and wants to comment</li>
<li><strong>User clicks “Peace”</strong> button on Site B</li>
<li><strong>User chooses “Login with IndieAuth”</strong> from the choice modal</li>
<li><strong>Site B discovers</strong> IndieAuth endpoints on Site A</li>
<li><strong>Site B redirects</strong> to Site A’s IndieAuth authorization endpoint</li>
<li><strong>Site A validates</strong> the user and generates an authorization code</li>
<li><strong>User is redirected</strong> back to Site B with the authorization code</li>
<li><strong>Site B exchanges</strong> the code for an access token using PKCE</li>
<li><strong>Site B automatically</strong> logs in the user as a federated user from Site A</li>
<li><strong>User can comment</strong> on Site B as “Logged in as siteacom”</li>
</ol>
<h3><strong>Security Flow</strong></h3>
<ol>
<li><strong>Cryptographic Handshake</strong>: Sites exchange cryptographically signed tokens</li>
<li><strong>Token Validation</strong>: Each peace message is validated using secure tokens</li>
<li><strong>Federated User Creation</strong>: Only after successful handshake are federated users created</li>
<li><strong>Limited Permissions</strong>: Federated users have minimal permissions and no admin access</li>
<li><strong>Automatic Cleanup</strong>: All federated data is removed on plugin uninstall</li>
</ol>
<h3>🛡️ **Security Considerations**</h3>
<h3><strong>What This Plugin Does NOT Do</strong></h3>
<ul>
<li>❌ <strong>No Public User Registration</strong>: Only WordPress administrators can use this plugin (federated users are created automatically after secure handshakes)</li>
<li>❌ <strong>No Admin Access for Federated Users</strong>: Federated users cannot access WordPress admin</li>
<li>❌ <strong>No Database Access</strong>: Federated users cannot access sensitive site data</li>
<li>❌ <strong>No File System Access</strong>: Federated users cannot upload or modify files</li>
<li>❌ <strong>No Plugin/Theme Management</strong>: Federated users cannot install or modify plugins/themes</li>
</ul>
<h3><strong>What This Plugin DOES Do</strong></h3>
<ul>
<li>✅ <strong>Site-to-Site Authentication</strong>: WordPress admins authenticate as their website</li>
<li>✅ <strong>Cryptographic Verification</strong>: All peace messages are cryptographically signed</li>
<li>✅ <strong>Limited Federated Access</strong>: Federated users can only comment on posts</li>
<li>✅ <strong>Automatic Cleanup</strong>: All federated data is removed on uninstall</li>
<li>✅ <strong>Secure Token Management</strong>: Tokens are cryptographically secure and can be rotated</li>
</ul>
<h3>🌍 **Internationalization**</h3>
<p>Peace Protocol is fully translation-ready and includes translations for:<br />
– English (default)<br />
– Spanish (es_ES)<br />
– French (fr_FR)<br />
– Japanese (ja)<br />
– Chinese Simplified (zh_CN)</p>


Alternatives to Peace Protocol

Top alternatives