Digitaldive

<p>WP OAuth2 adds “Login with WordPress.com” (OAuth2) to your WordPress login screen and a connect/disconnect widget on user profile pages. It’s designed for agencies and teams managing multiple sites who want a consistent WordPress.com login without installing Jetpack.</p>
<p>External Service: WordPress.com OAuth2 API<br />
– Service purpose: Authenticate users with their WordPress.com accounts.<br />
– Data sent: Client ID, redirect URI, OAuth authorization code, and standard HTTP request metadata during the OAuth flow.<br />
– Data received: WordPress.com user ID, email, and display name to link or create WordPress users.<br />
– Service terms: https://wordpress.com/tos/<br />
– Privacy policy: https://automattic.com/privacy/</p>
<p>Features:</p>
<ul>
<li>WordPress.com login (OAuth2 “auth” scope).</li>
<li>Link or unlink WordPress users to WordPress.com accounts.</li>
<li>Auto-create users when no matching email exists (optional).</li>
<li>Allowlist by email domain or WordPress.com user ID (optional).</li>
<li>Audit log of the last 20 OAuth attempts (optional).</li>
<li>Stores only WordPress.com user ID in user meta (no access tokens stored).</li>
<li>Short-lived OAuth state with HttpOnly cookie + transient for CSRF protection.</li>
</ul>
<p>Setup requires creating a WordPress.com application and adding the redirect URI shown in the plugin settings. Feature toggles let you enable or disable the login button, profile widget, auto-create users, admin notices, allowlists, and the audit log.</p>
<h3>Privacy</h3>
<p>This plugin connects to WordPress.com to authenticate users. It stores the WordPress.com user ID in WordPress user meta to link accounts. OAuth access tokens are used during the login flow and are not stored. A short-lived HttpOnly cookie and transient are used for OAuth state validation and expire automatically. If the audit log is enabled, the last 20 OAuth attempts are stored (time, status, IP address, and basic details) in a non-autoloaded option. WordPress.com service terms: https://wordpress.com/tos/ and privacy policy: https://automattic.com/privacy/.</p>


OAuth2 Account Login

Add WordPress.com OAuth2 login to WordPress. Let teams sign in with WordPress.com, link accounts, and avoid Jetpack. Not affiliated with Automattic.

VinCSS FIDO2

<p>VinCSS FIDO2 Login helps you replace your passwords with devices like USB security key, fingerprint, Windows Hello, FaceID/TouchID….Plugin also support 2FA and OAuth2 Protocol.<br />
When you enable plugin on your site, you can log in without password or 2FA at the same time.</p>
<h4>Features</h4>
<ul>
<li><strong>FIDO2 Passwordless Authentication</strong></li>
<li><strong>Two-factor authentication</strong></li>
<li><strong>Enable OAuth2 authentication for your site</strong></li>
</ul>
<p>VinCSS FIDO2 Login is a plug-in for WordPress to enable FIDO2, OTP and OAuth2 on your site.</p>
<h4>FIDO2 Passwordless Authentication</h4>
<p>When you enable VinCSS FIDO2 Login on your site, you can log in with a simple action.<br />
 <strong>PHP extensions php-gmp, php-mbstring are required.</strong><br />
 <strong>FIDO2 Passwordless Authentication requires HTTPS connection or <code>localhost</code></strong></p>
<h4>Two-factor authentication</h4>
<p>This plugin can be configured for any TOTP-based authentication method like Google Authenticator, Microsoft Authenticator, etc.</p>
<h4>OAuth2</h4>
<p>VinCSS FIDO2 Login plugin allows login with your VinCSS FIDO2 Cloud or other custom OAuth2 providers.</p>


VinCSS FIDO2 Login

VinCSS FIDO2 Login transform applications to passwordless authentication, improve user experience and protect end users with highest security standard …

OAuth2 Account Login vs VinCSS FIDO2 Login