JuanMa Garrido

<p>Unlike basic JWT plugins that use <strong>single long-lived tokens</strong>, JWT Auth Pro implements <strong>modern OAuth 2.0 security best practices</strong> with short-lived access tokens and secure refresh tokens.</p>
<h4>Why JWT Auth Pro?</h4>
<p><strong>The Problem with Basic JWT Plugins:</strong><br />
* Long-lived tokens (24h+) = Higher security risk<br />
* No refresh mechanism = Tokens live until expiry<br />
* XSS vulnerable = Tokens stored in localStorage<br />
* No revocation = Can’t invalidate compromised tokens</p>
<p><strong>JWT Auth Pro Solution:</strong><br />
* Short-lived access tokens (1h default) = Minimal attack window<br />
* Secure refresh tokens = HTTP-only cookies, XSS protected<br />
* Automatic token rotation = Fresh tokens on each refresh<br />
* Complete session control = Revoke any user session instantly</p>
<h4>Features</h4>
<ul>
<li><strong>Simple JWT Authentication</strong> – Clean, stateless token-based auth</li>
<li><strong>HTTPOnly Refresh Tokens</strong> – Secure refresh tokens in HTTP-only cookies</li>
<li><strong>Token Rotation</strong> – Automatic refresh token rotation for enhanced security</li>
<li><strong>CORS Support</strong> – Proper cross-origin request handling</li>
<li><strong>Clean Admin Interface</strong> – Simple configuration in WordPress admin</li>
<li><strong>Developer Friendly</strong> – Clear endpoints and documentation</li>
</ul>
<h4>Security Comparison</h4>
<p>  Feature<br />
  Basic JWT Plugins<br />
  JWT Auth Pro</p>
<p>  Token Lifetime<br />
  Long (hours/days)<br />
  Short (1 hour)</p>
<p>  Refresh Tokens<br />
  None<br />
  Secure HTTP-only</p>
<p>  XSS Protection<br />
  Limited<br />
  HTTP-only cookies</p>
<p>  Token Revocation<br />
  Manual only<br />
  Automatic rotation</p>
<p>  Session Management<br />
  None<br />
  Database tracking</p>
<p>  Security Metadata<br />
  None<br />
  IP + User Agent</p>
<h4>Perfect for:</h4>
<ul>
<li>Single Page Applications (React, Vue, Angular)</li>
<li>Mobile Applications (iOS, Android)</li>
<li>API Integrations (Third-party services)</li>
<li>Headless WordPress (Decoupled architecture)</li>
</ul>
<h4>API Endpoints</h4>
<ul>
<li><code>POST /wp-json/jwt/v1/token</code> – Login and get access token</li>
<li><code>POST /wp-json/jwt/v1/refresh</code> – Refresh access token</li>
<li><code>GET /wp-json/jwt/v1/verify</code> – Verify token and get user info</li>
<li><code>POST /wp-json/jwt/v1/logout</code> – Logout and revoke refresh token</li>
</ul>
<h3>Security</h3>
<ul>
<li><strong>Stateless Authentication</strong> – JWT tokens contain all necessary information</li>
<li><strong>HTTPOnly Cookies</strong> – Refresh tokens stored securely, inaccessible to JavaScript</li>
<li><strong>Token Rotation</strong> – Refresh tokens automatically rotate on use</li>
<li><strong>Configurable Expiration</strong> – Set custom expiration times</li>
<li><strong>IP & User Agent Tracking</strong> – Additional security metadata</li>
</ul>
<h3>Support</h3>
<p>For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api</p>
<h3>Privacy Policy</h3>
<p>This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.</p>


JuanMa JWT Auth Pro

Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.

Per Søderlind

<p>AI Valve gives site administrators visibility and control over how plugins use the built-in WordPress AI connector.</p>
<h4>Features</h4>
<ul>
<li><strong>Per-plugin access control</strong> — Allow or deny individual plugins from making AI requests.</li>
<li><strong>Token budgets</strong> — Set daily and monthly token limits per plugin and globally.</li>
<li><strong>Context restrictions</strong> — Control which execution contexts (admin, frontend, cron, REST, AJAX, CLI) may trigger AI calls.</li>
<li><strong>Usage dashboard</strong> — See token consumption at a glance with summary cards, progress bars, and per-plugin breakdowns.</li>
<li><strong>Request logging</strong> — Every AI request is logged with provider, model, capability, tokens, and caller attribution.</li>
<li><strong>Budget alerts</strong> — Admin notices and optional email when usage approaches or exceeds limits.</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>WordPress 7.0 or later</li>
<li>PHP 8.3 or later</li>
<li>A configured AI provider in Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Connectors</li>
</ul>


AI Valve

Control, meter, and permission-gate AI usage from plugins that connect through the WordPress 7 AI connector.

JuanMa JWT Auth Pro vs AI Valve