Digitaldive

WP OAuth2 adds “Login with WordPress.com” (OAuth2) to your WordPress login screen and a connect/disconnect widget on user profile pages. It’s designed for agencies and teams managing multiple sites who want a consistent WordPress.com login without installing Jetpack.
External Service: WordPress.com OAuth2 API 
– Service purpose: Authenticate users with their WordPress.com accounts. 
– Data sent: Client ID, redirect URI, OAuth authorization code, and standard HTTP request metadata during the OAuth flow. 
– Data received: WordPress.com user ID, email, and display name to link or create WordPress users. 
– Service terms: https://wordpress.com/tos/ 
– Privacy policy: https://automattic.com/privacy/
Features:
<ul>
<li>WordPress.com login (OAuth2 “auth” scope).</li>
<li>Link or unlink WordPress users to WordPress.com accounts.</li>
<li>Auto-create users when no matching email exists (optional).</li>
<li>Allowlist by email domain or WordPress.com user ID (optional).</li>
<li>Audit log of the last 20 OAuth attempts (optional).</li>
<li>Stores only WordPress.com user ID in user meta (no access tokens stored).</li>
<li>Short-lived OAuth state with HttpOnly cookie + transient for CSRF protection.</li>
</ul>
Setup requires creating a WordPress.com application and adding the redirect URI shown in the plugin settings. Feature toggles let you enable or disable the login button, profile widget, auto-create users, admin notices, allowlists, and the audit log.
<h3>Privacy</h3>
This plugin connects to WordPress.com to authenticate users. It stores the WordPress.com user ID in WordPress user meta to link accounts. OAuth access tokens are used during the login flow and are not stored. A short-lived HttpOnly cookie and transient are used for OAuth state validation and expire automatically. If the audit log is enabled, the last 20 OAuth attempts are stored (time, status, IP address, and basic details) in a non-autoloaded option. WordPress.com service terms: https://wordpress.com/tos/ and privacy policy: https://automattic.com/privacy/.

OAuth2 Account Login

Add WordPress.com OAuth2 login to WordPress. Let teams sign in with WordPress.com, link accounts, and avoid Jetpack. Not affiliated with Automattic.

Victor Flores

Wapu Auth is a free Google Social Login plugin for WordPress and WooCommerce. Let your visitors register and sign in using their Google account — no passwords, no forms, no friction.
Whether you run a WooCommerce store, a membership site, or any WordPress site, Wapu Auth makes authentication instant, secure, and completely free — including WooCommerce integration.
<blockquote>
Wapu Auth Pro is coming soon with additional social login providers, advanced analytics exports, and priority support.
</blockquote>
<h4>Free WooCommerce Social Login — No Pro Upgrade Required</h4>
Most social login plugins lock WooCommerce compatibility behind a paid plan. Wapu Auth includes free WooCommerce social login out of the box. The Google login button is automatically placed on your WooCommerce login page, registration page, and checkout form — zero configuration needed.
Store owners: let customers register and sign in at checkout with their Google account. Fewer abandoned carts. More completed purchases.
<h4>Features</h4>
Google Login — One Click 
Let visitors register and sign in with their Google account instantly. No passwords, no forms, no friction. Fast and invisible.
Google One Tap 
Show a non-intrusive sign-in prompt that authenticates users with a single click, without leaving the current page.
Magic Link — Passwordless Login 
Let customers sign in with a secure one-click link sent to their email. No password required. Links expire automatically for security.
Two-Factor Authentication (Email OTP) 
Add email verification codes to the sign-in flow. Enable globally for all users, require it for administrators only, or let customers opt in from their account page.
Active Sessions & Trusted Devices 
Customers can see every device signed in to their account and revoke sessions remotely. Trusted devices skip 2FA automatically for smoother return visits.
Unified Security Tab (WooCommerce My Account) 
Customers manage two-factor authentication, active sessions, trusted devices, and their Google connection from a single “Security” page in My Account.
Built-in SMTP Mailer 
Send magic links and OTP codes reliably using a custom SMTP server configured directly in the plugin settings — no third-party plugin required.
Free WooCommerce Login Integration 
Google login button automatically appears on all WooCommerce forms: login, register, and checkout. Free. No Pro plan required.
Smart Redirect Post-Login 
After signing in on the cart or checkout page, customers return to that page — not to My Account.
Analytics Dashboard 
Track every Google login attempt, new registration, and user activity from your WordPress admin panel.
Domain Restrictions 
Whitelist or blacklist email domains for your Google social login. Only @yourcompany.com users can sign in? Done.
Sandbox Mode 
Test the complete Google OAuth login flow with specific test emails before going live. No risk to production data.
Customizable Google Login Button 
Match the login button to your brand. Adjust colors, text, size, and style with a live visual editor — no CSS required.
Popup Mode 
Display the Google login prompt in a popup window for a seamless, redirect-free experience.
Activity Log 
Full log of every login attempt: status, email, timestamp, and optional GeoIP location data.
Shortcode Support 
Place the Google login button anywhere on your site: 
 [wapu_auth_button] — Google login button 
 [wapu_auth_login_form] — Full custom login form with Google login 
 [wapu_auth_register_form] — Full custom registration form with Google login
Custom Login & Registration Form Templates 
Replace the default WordPress login and register pages with three built-in templates: Classic, Modern, and Compact. All include the Google login button.
Setup Wizard 
Step-by-step guided setup walks you through creating Google OAuth credentials and configuring the plugin in under 5 minutes.
Full Internationalization 
Fully translated into English and Spanish. Ready for community translation via translate.wordpress.org.
<h4>Who Uses Wapu Auth?</h4>
WooCommerce store owners looking to reduce cart abandonment by adding Google login to the checkout page — free, without a Pro plan.
Membership site owners who want fast, trusted social login and registration using Google accounts.
WordPress developers and agencies who need a clean, standards-compliant Google OAuth plugin for client sites.
Users switching from Nextend Social Login who need free WooCommerce social login integration without paying for a Pro addon.
<h4>How Google Social Login Works</h4>
<ol>
<li>Visitor clicks the Google login button on your site</li>
<li>Google authenticates the user via secure OAuth 2.0</li>
<li>Wapu Auth creates or matches their WordPress account by email</li>
<li>User is logged in — done. The whole process takes under 3 seconds.</li>
</ol>
Existing users who already have a WordPress account with the same Google email address are automatically matched and logged in — no duplicate accounts, no confusion.
<h4>Privacy & Compliance</h4>
Wapu Auth connects to Google’s OAuth API only when a user actively clicks the Google login button. GeoIP enrichment and Google Analytics integration are optional and disabled by default. Site owners are responsible for appropriate consent mechanisms for their jurisdiction (GDPR, CCPA, etc.).
<h4>Requirements</h4>
<ul>
<li>WordPress 6.0 or higher</li>
<li>PHP 8.0 or higher</li>
<li>SSL certificate (HTTPS) — required by Google OAuth</li>
<li>Free Google Cloud Console account — to generate OAuth credentials</li>
<li>WooCommerce 7.0 or higher (optional, for automatic WooCommerce social login integration)</li>
</ul>
<h3>Hooks & Filters</h3>
Wapu Auth exposes the following WordPress action and filter hooks so developers can extend the authentication flow without modifying plugin files.
<h4>Actions</h4>
<ul>
<li><code>wapu_auth_before_login</code> — Fires right before a user is authenticated by Wapu Auth.</li>
<li><code>wapu_auth_user_authenticated</code> — Fires after a WordPress user is logged in via Google. Passes <code>$user</code> (WP_User), <code>$google_user</code> (array), and <code>$is_new_user</code> (bool).</li>
<li><code>wapu_auth_user_created</code> — Fires after a new WordPress user is created from a Google account. Passes <code>$user_id</code>, <code>$email</code>, and <code>$google_id</code>.</li>
<li><code>wapu_auth_google_account_unlinked</code> — Fires when a user disconnects their Google account from My Account. Passes <code>$user_id</code>.</li>
<li><code>wapu_auth_analytics_event</code> — Fires when an analytics event is recorded. Passes <code>$event_type</code>, <code>$user_id</code>, and <code>$data</code>.</li>
<li><code>wapu_auth_log</code> — Fires on every plugin log entry. Passes <code>$message</code>, <code>$level</code>, and <code>$context</code>. Useful for routing logs to a custom handler.</li>
<li><code>wp_login</code> — The standard WordPress action fires on every successful Google login so security and 2FA plugins receive Google logins uniformly.</li>
</ul>
<h4>Filters</h4>
<ul>
<li><code>wapu_auth_auth_params</code> — Modify the query parameters sent to Google’s OAuth authorization endpoint (scope, prompt, hd, etc.).</li>
<li><code>wapu_auth_user_data</code> — Modify the user data array returned by Google before Wapu Auth creates or matches an account.</li>
<li><code>wapu_auth_redirect_url</code> — Override the URL users are redirected to after a successful login. Passes <code>$url</code>, <code>$user</code>, and <code>$is_new_user</code>.</li>
<li><code>wapu_auth_error_message</code> — Customize the error message shown to the user when authentication fails. Passes <code>$message</code> and <code>$code</code>.</li>
<li><code>wapu_auth_button_html</code> — Modify the rendered login button HTML. Passes <code>$html</code>, <code>$args</code>, and <code>$settings</code>.</li>
<li><code>wapu_auth_redirect_uri</code> — Override the OAuth callback redirect URI registered with Google. Passes the current URI string.</li>
<li><code>wapu_auth_geoip_enabled</code> — Enable or disable GeoIP lookup programmatically. Passes the current boolean value.</li>
</ul>
<h3>External Services</h3>
This plugin connects to the following external services only under clearly documented conditions.
<h4>1. Google OAuth 2.0 / OpenID Connect (required for Google social login)</h4>
Endpoints: 
* <code>https://accounts.google.com/o/oauth2/v2/auth</code> 
* <code>https://oauth2.googleapis.com/token</code> 
* <code>https://www.googleapis.com/oauth2/v2/userinfo</code> 
* <code>https://accounts.google.com/.well-known/openid-configuration</code> (admin diagnostics only)
Data sent: Client ID, redirect URI, OAuth scope, state token, and authorization code. An access token is sent to retrieve the user’s Google profile.
Data received: Google account ID, email address, display name, profile picture URL, email verification status, and locale.
When triggered: Only when a user actively clicks the Google login button, or when an admin runs connection diagnostics from the settings page.
Google’s policies: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a> | <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a>
<h4>2. GeoIP Providers (optional — disabled by default)</h4>
Services: <code>https://ipapi.co/</code> with <code>https://ipwho.is/</code> as fallback.
Data sent: Visitor IP address for location lookup.
When triggered: Only when GeoIP enrichment is enabled in the plugin’s security settings.
Note: Enable only with appropriate legal basis and user consent where required (e.g. GDPR).
Policies: <a href="https://ipapi.co/privacy/" rel="nofollow ugc">ipapi.co</a> | <a href="https://ipwhois.io/privacy-policy/" rel="nofollow ugc">ipwhois</a>
<h4>3. Google Analytics 4 Event Bridge (optional — disabled by default)</h4>
Service: Uses the site’s existing gtag / GA4 setup, if present.
Data sent: Social login event names and metadata only (login_start, success/error status).
When triggered: Only when a GA4 Measurement ID is configured and analytics is enabled in plugin settings.
Note: Site owners are responsible for obtaining required user consent before enabling this feature.
<h4>4. Google Fonts (optional frontend asset)</h4>
Services: <code>https://fonts.googleapis.com</code> | <code>https://fonts.gstatic.com</code>
Data sent: Standard browser request headers (IP, user-agent) to retrieve font CSS.
When triggered: When the social login button is rendered on the frontend.
Google’s policies: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>

Wapu Auth – Google Social Login for WordPress & WooCommerce

Google social login for WordPress & WooCommerce. One-click sign-in, passwordless magic links, email two-factor authentication, session management, …

OAuth2 Account Login vs Wapu Auth – Google Social Login for WordPress & WooCommerce