rtCamp

Shalin Shah

Sagar Tamang

Nikhil Joshua

Chirag Mathur

Ultra minimal plugin to let your users login to WordPress applications using their Google accounts. No more remembering hefty passwords!
<h3>Initial Setup</h3>
<ol>
<li>
Create a project from <a href="https://console.developers.google.com/apis/dashboard" rel="nofollow ugc">Google Developers Console</a> if none exists.
</li>
<li>
Go to Credentials tab, then create credential for OAuth client.
<ul>
<li>Application type will be Web Application</li>
<li>Add <code>YOUR_DOMAIN/wp-login.php</code> in Authorized redirect URIs</li>
</ul>
</li>
<li>
This will give you Client ID and Secret key.
</li>
<li>
Input these values either in <code>WP Admin > Settings > WP Google Login</code>, or in <code>wp-config.php</code> using the following code snippet:
<code>define( 'WP_GOOGLE_LOGIN_CLIENT_ID', 'YOUR_GOOGLE_CLIENT_ID' ); 
define( 'WP_GOOGLE_LOGIN_SECRET', 'YOUR_SECRET_KEY' );</code>
</li>
</ol>
<h3>Browser support</h3>
<a href="https://developers.google.com/identity/gsi/web/guides/supported-browsers" rel="nofollow ugc">These browsers are supported</a>. Note, for example, that One Tap Login is not supported in Safari.
<h3>How to enable automatic user registration</h3>
You can enable user registration either by 
– Enabling Settings > WP Google Login > Enable Google Login Registration
OR
<ul>
<li>Adding 
<code>define( 'WP_GOOGLE_LOGIN_USER_REGISTRATION', 'true' );</code> 
in wp-config.php file.</li>
</ul>
Note: If the checkbox is ON then, it will register valid Google users even when WordPress default setting, under
Settings > General Settings > Membership > Anyone can register checkbox
is OFF.
<h3>Restrict user registration to one or more domain(s)</h3>
By default, when you enable user registration via constant <code>WP_GOOGLE_LOGIN_USER_REGISTRATION</code> or enable Settings > WP Google Login > Enable Google Login Registration, it will create a user for any Google login (including gmail.com users). If you are planning to use this plugin on a private, internal site, then you may like to restrict user registration to users under a single Google Suite organization. This configuration variable does that.
Add your domain name, without any schema prefix and <code>www,</code> as the value of <code>WP_GOOGLE_LOGIN_WHITELIST_DOMAINS</code> constant or in the settings <code>Settings > WP Google Login > Whitelisted Domains</code>. You can whitelist multiple domains. Please separate domains with commas. See the below example to know how to do it via constants: 
 <code>define( 'WP_GOOGLE_LOGIN_WHITELIST_DOMAINS', 'example.com,sample.com' );</code>
Note: If a user already exists, they will be allowed to login with Google regardless of whether their domain is whitelisted or not. Whitelisting will only prevent users from registering with email addresses from non-whitelisted domains.
<h3>Hooks</h3>
For a list of all hooks please refer to <a href="https://github.com/rtCamp/login-with-google#hooks" rel="nofollow ugc">this documentation</a>.
<h4>wp-config.php parameters list</h4>
<ul>
<li>
<code>WP_GOOGLE_LOGIN_CLIENT_ID</code> (string): Google client ID of your application.
</li>
<li>
<code>WP_GOOGLE_LOGIN_SECRET</code> (string): Secret key of your application
</li>
<li>
<code>WP_GOOGLE_LOGIN_USER_REGISTRATION</code> (boolean) (optional): Set <code>true</code> If you want to enable new user registration. By default, user registration defers to <code>Settings > General Settings > Membership</code> if constant is not set.
</li>
<li>
<code>WP_GOOGLE_LOGIN_WHITELIST_DOMAINS</code> (string) (optional): Domain names, if you want to restrict login with your custom domain. By default, it will allow all domains. You can whitelist multiple domains.
</li>
</ul>
<h3>BTW, We’re Hiring!</h3>
<a href="https://rtcamp.com/careers/" rel="nofollow ugc"></a>

Log in with Google

In terms of ready-to-go possibilities, this plugin is the best free plugin for both Logging in and Registering with Google.

It works great.

Great plugin


Works as advertised, SImple and easy to use.


Excellent plugin

Minimal plugin that allows WordPress users to log in using Google.

Automattic

Manzoor Wani

Gergely J

Sign in with Telegram lets your visitors log in with their Telegram account — no extra password to remember, no new account to create. Unlike older Telegram-login plugins that rely on a script embedded from Telegram (which modern privacy-focused browsers often block), this plugin uses <a href="https://core.telegram.org/bots/telegram-login" rel="nofollow ugc">Telegram’s standard OpenID Connect login</a>: a secure redirect to Telegram and back. It works reliably in every browser, including ones with strict tracker blocking turned on.
<h4>Features</h4>
<ul>
<li>“Sign in with Telegram” button on the standard <code>wp-login.php</code> screen, as a <code>[telegram_signin_button]</code> shortcode anywhere on your site, or as a Block Editor block.</li>
<li>Account linking from the user profile screen — existing WordPress users can connect or disconnect their Telegram account.</li>
<li>Profile sync — display name and avatar from the user’s Telegram profile flow through to the WordPress profile automatically.</li>
<li>No automatic account merging — a Telegram identity can only attach to an existing WordPress user through an explicit click-to-link action from a logged-in session, so a stranger who happens to share an email address can never take over an account.</li>
<li>Secure by default — uses the same kind of modern, signed redirect flow that “Sign in with Google” and “Sign in with Apple” use. No shared bot-token secret on your server, no manual key rotation.</li>
<li>Settings page in wp-admin where you paste the bot’s Client ID + Client Secret, pick the default role for new users, and optionally collect the visitor’s verified phone number or request permission for your bot to message them directly.</li>
</ul>
<h4>How it compares to the legacy Login Widget</h4>
Telegram’s older Login Widget (used by most existing Telegram-login plugins on the directory) is not OAuth or OpenID Connect. It loads a JavaScript file from telegram.org that renders Telegram’s button on your page and then hands the auth result either to a JavaScript callback or to a server URL. Either mode still needs the embedded script to render the button in the first place. That setup is increasingly fragile:
<ul>
<li>Browsers with strict third-party-script blocking — Brave with default shields, Firefox Enhanced Tracking Protection on Strict, Safari Lockdown Mode, uBlock Origin filter lists — frequently block the embedded script outright, so the button never renders and visitors have no way to start the flow.</li>
<li>The widget’s authentication hash is an HMAC-SHA256 over your bot token, so anyone who wants to verify a login has to hold a copy of that secret. There’s no standard JWT / JWKS story to lean on.</li>
<li>Key rotation is manual — changing the HMAC key means rotating the bot token in BotFather and updating it on every server that verifies logins.</li>
</ul>
Sign in with Telegram uses Telegram’s newer OpenID Connect provider instead — a standard server-side redirect flow with a properly signed RS256 <code>id_token</code>. No third-party scripts on your pages, no shared bot-token secret with verifiers, automatic key rotation via JWKS. It behaves the same regardless of how privacy-locked-down the visitor’s browser is.
<h3>External services</h3>
This plugin connects to Telegram’s OpenID Connect provider at <code>oauth.telegram.org</code> so visitors can sign in with their Telegram account. No data is sent to Telegram unless a visitor actively starts a sign-in.
What is sent, and when:
<ul>
<li>Sign-in start. When a visitor clicks the “Sign in with Telegram” button, their browser is redirected to <code>oauth.telegram.org</code> with the bot’s Client ID, the requested scopes (always <code>openid</code> and <code>profile</code>; additionally <code>phone</code> and / or <code>telegram:bot_access</code> if you enabled those in Settings → Sign in with Telegram), a random <code>state</code>, a random <code>nonce</code>, and a PKCE <code>code_challenge</code> (SHA-256). The only user-specific traffic at this step is the browser redirect itself. If the discovery cache is cold (see below), building the redirect URL also triggers an anonymous server-side GET of the discovery document — no user data in that request.</li>
<li>Sign-in callback. After the visitor approves the sign-in on Telegram’s side, Telegram redirects them back to your site with an authorization <code>code</code>. The plugin then makes a single server-to-server POST to Telegram’s token endpoint, sending the Client ID + Client Secret (as HTTP Basic auth), the <code>code</code>, the matching PKCE <code>code_verifier</code>, and the redirect URI. Telegram responds with a signed <code>id_token</code> containing the visitor’s Telegram identifier, name, profile picture URL, and (if the <code>phone</code> scope was granted) phone number.</li>
<li>Discovery + JWKS lookup. The first sign-in after activation (and again after the local cache expires, 12 hours) triggers a one-off, anonymous GET to Telegram’s OpenID Connect discovery document and JSON Web Key Set (JWKS) at <code>oauth.telegram.org</code>. Both responses are cached in WordPress transients. If a later <code>id_token</code> references a signing key that isn’t in the cache (Telegram rotated keys), the JWKS is re-fetched once; a short cooldown prevents repeated refresh attempts. No user data is sent in any of these requests.</li>
</ul>
This service is provided by Telegram. Refer to Telegram’s <a href="https://telegram.org/tos" rel="nofollow ugc">Terms of Service</a> and <a href="https://telegram.org/privacy" rel="nofollow ugc">Privacy Policy</a> for details on how Telegram handles the sign-in.

Sign in with Telegram

Add Telegram login to your WordPress site. Visitors sign in with their existing Telegram account — no new password to remember.

Log in with Google vs Sign in with Telegram