JuanMa Garrido

Unlike basic JWT plugins that use single long-lived tokens, JWT Auth Pro implements modern OAuth 2.0 security best practices with short-lived access tokens and secure refresh tokens.
<h4>Why JWT Auth Pro?</h4>
The Problem with Basic JWT Plugins: 
* Long-lived tokens (24h+) = Higher security risk 
* No refresh mechanism = Tokens live until expiry 
* XSS vulnerable = Tokens stored in localStorage 
* No revocation = Can’t invalidate compromised tokens
JWT Auth Pro Solution: 
* Short-lived access tokens (1h default) = Minimal attack window 
* Secure refresh tokens = HTTP-only cookies, XSS protected 
* Automatic token rotation = Fresh tokens on each refresh 
* Complete session control = Revoke any user session instantly
<h4>Features</h4>
<ul>
<li>Simple JWT Authentication – Clean, stateless token-based auth</li>
<li>HTTPOnly Refresh Tokens – Secure refresh tokens in HTTP-only cookies</li>
<li>Token Rotation – Automatic refresh token rotation for enhanced security</li>
<li>CORS Support – Proper cross-origin request handling</li>
<li>Clean Admin Interface – Simple configuration in WordPress admin</li>
<li>Developer Friendly – Clear endpoints and documentation</li>
</ul>
<h4>Security Comparison</h4>
 Feature 
 Basic JWT Plugins 
 JWT Auth Pro
 Token Lifetime 
 Long (hours/days) 
 Short (1 hour)
 Refresh Tokens 
 None 
 Secure HTTP-only
 XSS Protection 
 Limited 
 HTTP-only cookies
 Token Revocation 
 Manual only 
 Automatic rotation
 Session Management 
 None 
 Database tracking
 Security Metadata 
 None 
 IP + User Agent
<h4>Perfect for:</h4>
<ul>
<li>Single Page Applications (React, Vue, Angular)</li>
<li>Mobile Applications (iOS, Android)</li>
<li>API Integrations (Third-party services)</li>
<li>Headless WordPress (Decoupled architecture)</li>
</ul>
<h4>API Endpoints</h4>
<ul>
<li><code>POST /wp-json/jwt/v1/token</code> – Login and get access token</li>
<li><code>POST /wp-json/jwt/v1/refresh</code> – Refresh access token</li>
<li><code>GET /wp-json/jwt/v1/verify</code> – Verify token and get user info</li>
<li><code>POST /wp-json/jwt/v1/logout</code> – Logout and revoke refresh token</li>
</ul>
<h3>Security</h3>
<ul>
<li>Stateless Authentication – JWT tokens contain all necessary information</li>
<li>HTTPOnly Cookies – Refresh tokens stored securely, inaccessible to JavaScript</li>
<li>Token Rotation – Refresh tokens automatically rotate on use</li>
<li>Configurable Expiration – Set custom expiration times</li>
<li>IP & User Agent Tracking – Additional security metadata</li>
</ul>
<h3>Support</h3>
For support and documentation, visit: https://github.com/juanma-wp/jwt-auth-pro-wp-rest-api
<h3>Privacy Policy</h3>
This plugin stores user session data including IP addresses and user agent strings for security purposes. This data is used solely for authentication and security monitoring.

JuanMa JWT Auth Pro

Modern JWT authentication with refresh tokens - built for SPAs and mobile apps with enterprise-grade security.

Nicu Micle

The Simple JWT Login MailPoet plugin is an add-on for the Simple-Jwt-Login plugin. 
It allows you to seamlessly log users into your WordPress site using a JWT generated from MailPoet newsletters.
Simple shortcode example:
<pre><code>[custom:simple-jwt-login]
</code></pre>
This shortcode will generate a link, with the text “Login”
Available shortcode parameters: 
– text : The text for the link 
– class: Class added for the link 
– style: Custom CSS added to the link 
– validity: The number of seconds a JWT is valid 
– authCode: Auth Code that is required by Autologin. You will find this in Simple-JWT-Login plugin -> Auth Codes 
– redirectUrl: This URL will overwrite the SimpleJWTLogin settings, and it will specify where users will be redirected after autologin. 
– isUrl: When this parameter is provided, the shortcode will return only the autologin URL
Full short code example:
<pre><code>[custom:simple-jwt-login text="Login" class="myClassName" style="color:red;" validity="604800" authCode="1"]
</code></pre>
This example will generate a red link, with the text “Login”.
You can also customize the shortcode to just return the URL.
<pre><code>[custom:simple-jwt-login text="Login" validity="604800" isUrl="on"]
</code></pre>

Simple JWT Login MailPoet – Login users from newsletter

The Simple JWT Login MailPoet plugin is an add-on for the Simple-Jwt-Login plugin.

JuanMa JWT Auth Pro vs Simple JWT Login MailPoet – Login users from newsletter