YEGHRO

YEGHRO Nostr Login enables WordPress users to authenticate using their Nostr keys, providing a seamless bridge between the decentralized Nostr protocol and WordPress websites.
<h4>Key Features</h4>
Login 
* One-click login with Nostr browser extensions (NIP-07 compatible) 
* Automatic user registration for new Nostr users 
* Profile synchronization from Nostr metadata 
* Configurable Nostr relay settings
Import (1.8 and later) 
* Import posts from Nostr to WordPress as posts. 
* Optionally imports comments from Nostr to WordPress as comments. 
* Filter imports using tags and date range. 
* Import into specific categories. 
* Import as draft, publish or private. 
* Imports media from Nostr event and attaches to post.

YEGHRO Nostr Login

Enable secure WordPress authentication using Nostr keys - login with your Nostr identity.

Billy Wilcosky

Peace Protocol enables WordPress site administrators to authenticate as their website and send cryptographically signed “peace” messages to other WordPress sites running the same protocol. This creates a decentralized network where admins can establish trust relationships, share peace, and enable cross-site interactions.
<h3>🔒 **Security-First Design**</h3>
<h3>Admin-Only Authentication</h3>
<ul>
<li>WordPress Administrators Only: This plugin is designed exclusively for WordPress site administrators</li>
<li>Site-Level Authentication: Admins authenticate as their website, not as individual users</li>
<li>No Public Registration: No public user registration system – only federated users created after secure handshakes</li>
<li>Cryptographic Tokens: Each site uses cryptographically secure tokens for authentication</li>
</ul>
<h3>Federated User System</h3>
<ul>
<li>Limited Permissions: Federated users can only comment on posts, no admin access</li>
<li>Automatic Cleanup: Federated users are removed when the plugin is uninstalled</li>
<li>Role-Based Security: Federated users have the <code>federated_peer</code> role with minimal capabilities</li>
<li>No Dashboard Access: Federated users cannot access WordPress admin areas</li>
</ul>
<h3>Token Security</h3>
<ul>
<li>Cryptographically Secure: Tokens are generated using WordPress’s secure password generator</li>
<li>Token Rotation: Support for multiple tokens with automatic rotation</li>
<li>Secure Storage: Tokens are stored securely in WordPress options</li>
<li>Expiring Authorization Codes: Authorization codes expire after 5 minutes</li>
</ul>
<h3>🌟 **Key Features**</h3>
<h3>Core Functionality</h3>
<ul>
<li>Send Peace: Send cryptographically signed peace messages to other WordPress sites</li>
<li>Peace Log Wall: Display received peace messages using the <code>[peaceprotocol_log_wall]</code> shortcode</li>
<li>Automatic Feed Subscription: Automatically subscribe to peace feeds from sites you connect with</li>
<li>Token Management: Generate, rotate, and manage authentication tokens</li>
<li>User Banning System: Ban problematic users with reason tracking</li>
<li>IndieAuth Support: Alternative authentication using the IndieAuth standard with PKCE</li>
</ul>
<h3>Federated Login System</h3>
<ul>
<li>Cross-Site Authentication: Users from remote sites can comment as their site identity</li>
<li>Seamless Integration: Works with existing WordPress comment systems</li>
<li>Secure Handshake: Only sites completing the cryptographic handshake can create federated logins</li>
<li>Automatic User Creation: Creates federated users automatically after successful handshake</li>
<li>Dual Authentication: Support for both Peace Protocol tokens and IndieAuth standard</li>
</ul>
<h3>Admin Interface</h3>
<ul>
<li>Token Management: Generate, view, and delete authentication tokens</li>
<li>Feed Management: View and manage subscribed peace feeds</li>
<li>Peace Log: View all received peace messages in the admin area</li>
<li>User Banning: Ban users with reason tracking and management</li>
<li>Settings Configuration: Configure button position and auto-insertion</li>
</ul>
<h3>Frontend Features</h3>
<ul>
<li>Peace Button: Floating peace hand button (✌️) that can be positioned anywhere</li>
<li>Auto-Insertion: Automatically insert the peace button on your site</li>
<li>Shortcode Support: Use <code>[peaceprotocol_hand_button]</code> to manually place the button</li>
<li>Responsive Design: Works on all devices and screen sizes</li>
<li>Dark Mode Support: Automatically adapts to user’s color scheme preference</li>
<li>Choice Modal: User-friendly modal to choose between Peace Protocol and IndieAuth authentication</li>
</ul>
<h3>Technical Features</h3>
<ul>
<li>REST API: Modern REST API endpoints for all functionality</li>
<li>AJAX Fallback: AJAX endpoints for sites with REST API disabled</li>
<li>CORS Support: Proper CORS headers for cross-site communication</li>
<li>Translation Ready: Full internationalization support with multiple languages</li>
<li>Custom Post Types: Uses custom post types for peace logs</li>
<li>IndieAuth Endpoints: Full IndieAuth specification compliance with authorization and token endpoints</li>
<li>PKCE Support: Proof Key for Code Exchange for enhanced security</li>
</ul>
<h3>🚀 **How It Works**</h3>
<h3>For WordPress Administrators</h3>
<ol>
<li>Install & Activate: Install the plugin and activate it on your WordPress site</li>
<li>Generate Tokens: Go to Settings > Peace Protocol and generate authentication tokens</li>
<li>Send Peace: Use the peace button to send cryptographically signed peace to other sites</li>
<li>Build Network: Connect with other WordPress sites and build a network of trust</li>
</ol>
<h3>Federated Login Process</h3>
<h4>Peace Protocol Authentication</h4>
<ol>
<li>User from Site A visits Site B and wants to comment</li>
<li>User clicks “Peace” button on Site B</li>
<li>User chooses “Login with Peace Protocol” from the choice modal</li>
<li>Site B redirects to Site A for authentication</li>
<li>Site A validates the user and generates an authorization code</li>
<li>User is redirected back to Site B with the authorization code</li>
<li>Site B automatically logs in the user as a federated user from Site A</li>
<li>User can comment on Site B as “siteacom”</li>
</ol>
<h4>IndieAuth Authentication</h4>
<ol>
<li>User from Site A visits Site B and wants to comment</li>
<li>User clicks “Peace” button on Site B</li>
<li>User chooses “Login with IndieAuth” from the choice modal</li>
<li>Site B discovers IndieAuth endpoints on Site A</li>
<li>Site B redirects to Site A’s IndieAuth authorization endpoint</li>
<li>Site A validates the user and generates an authorization code</li>
<li>User is redirected back to Site B with the authorization code</li>
<li>Site B exchanges the code for an access token using PKCE</li>
<li>Site B automatically logs in the user as a federated user from Site A</li>
<li>User can comment on Site B as “Logged in as siteacom”</li>
</ol>
<h3>Security Flow</h3>
<ol>
<li>Cryptographic Handshake: Sites exchange cryptographically signed tokens</li>
<li>Token Validation: Each peace message is validated using secure tokens</li>
<li>Federated User Creation: Only after successful handshake are federated users created</li>
<li>Limited Permissions: Federated users have minimal permissions and no admin access</li>
<li>Automatic Cleanup: All federated data is removed on plugin uninstall</li>
</ol>
<h3>🛡️ **Security Considerations**</h3>
<h3>What This Plugin Does NOT Do</h3>
<ul>
<li>❌ No Public User Registration: Only WordPress administrators can use this plugin (federated users are created automatically after secure handshakes)</li>
<li>❌ No Admin Access for Federated Users: Federated users cannot access WordPress admin</li>
<li>❌ No Database Access: Federated users cannot access sensitive site data</li>
<li>❌ No File System Access: Federated users cannot upload or modify files</li>
<li>❌ No Plugin/Theme Management: Federated users cannot install or modify plugins/themes</li>
</ul>
<h3>What This Plugin DOES Do</h3>
<ul>
<li>✅ Site-to-Site Authentication: WordPress admins authenticate as their website</li>
<li>✅ Cryptographic Verification: All peace messages are cryptographically signed</li>
<li>✅ Limited Federated Access: Federated users can only comment on posts</li>
<li>✅ Automatic Cleanup: All federated data is removed on uninstall</li>
<li>✅ Secure Token Management: Tokens are cryptographically secure and can be rotated</li>
</ul>
<h3>🌍 **Internationalization**</h3>
Peace Protocol is fully translation-ready and includes translations for: 
– English (default) 
– Spanish (es_ES) 
– French (fr_FR) 
– Japanese (ja) 
– Chinese Simplified (zh_CN)

Peace Protocol

A secure, decentralized protocol for WordPress administrators to connect their sites and build a network of trust through cryptographic handshakes.

YEGHRO Nostr Login vs Peace Protocol