Automattic

WordPress.org

Alex Kirk

Ashish Kumar (Ashfame)

Paulo Pinto

<p>With this plugin you can use your own WordPress install to authenticate with a webservice that provides <a href="https://openid.net/connect/" rel="nofollow ugc">OpenID Connect</a> to implement Single-Sign On (SSO) for your users.</p>
<p>The plugin is currently only configured using constants and hooks as follows:</p>
<h3>Define the RSA keys</h3>
<p>If you don’t have keys that you want to use yet, generate them using these commands:</p>
<pre><code>openssl genrsa -out oidc.key 4096
openssl rsa -in oidc.key -pubout -out public.key
</code></pre>
<p>And make them available to the plugin as follows (this needs to be added before WordPress loads):</p>
<pre><code>define( 'OIDC_PUBLIC_KEY', <<<OIDC_PUBLIC_KEY
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
OIDC_PUBLIC_KEY
);

define( 'OIDC_PRIVATE_KEY', <<<OIDC_PRIVATE_KEY
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
OIDC_PRIVATE_KEY
);
</code></pre>
<p>Alternatively, you can also put them outside the webroot and load them from the files like this:</p>
<pre><code>define( 'OIDC_PUBLIC_KEY', file_get_contents( '/web-inaccessible/oidc.key' ) );
define( 'OIDC_PRIVATE_KEY', file_get_contents( '/web-inaccessible/private.key' ) );
</code></pre>
<h3>Define the clients</h3>
<p>Define your clients by adding a filter to <code>oidc_registered_clients</code> in a separate plugin file or <code>functions.php</code> of your theme or in a MU-plugin like:</p>
<pre><code>add_filter( 'oidc_registered_clients', 'my_oidc_clients' );
function my_oidc_clients() {
    return array(
        'client_id_random_string' => array(
            'name' => 'The name of the Client',
            'secret' => 'a secret string',
            'redirect_uri' => 'https://example.com/redirect.uri',
            'grant_types' => array( 'authorization_code' ),
            'scope' => 'openid profile',
        ),
    );
}
</code></pre>
<h3>Exclude URL from caching</h3>
<ul>
<li><code>example.com/wp-json/openid-connect/userinfo</code>: We implement caching exclusion measures for this endpoint by setting <code>Cache-Control: 'no-cache'</code> headers and defining the <code>DONOTCACHEPAGE</code> constant. If you have a unique caching configuration, please ensure that you manually exclude this URL from caching.</li>
</ul>
<h3>Github Repo</h3>
<p>You can report any issues you encounter directly on <a href="https://github.com/Automattic/wp-openid-connect-server" rel="nofollow ugc">Github repo: Automattic/wp-openid-connect-server</a></p>


OpenID Connect Server

Use OpenID Connect to log in to other webservices using your own WordPress.

Trusted Accounts

<p><strong>Stop bots and scrapers without affecting real visitors.</strong></p>
<p>Atmosvere protects your WordPress pages in the background. Each request is checked (allow / challenge / block, typically under 50 ms) — we stop bots before they even reach your site, so you get effective bot, scraper & spam protection without CAPTCHAs. On the page, our SDK sends behaviour data for additional real-time security. Works for anonymous traffic and for logged-in users.</p>
<p><strong>Try the Admin Panel without installing:</strong> <a href="https://admin.atmosvere.eu/home?demo=true" rel="nofollow ugc">Admin Panel Demo</a></p>
<p><strong>Use the code EARLY-WORDPRESS-BIRD at checkout</strong> — Get <strong>3 months free</strong> on the Starter suite. Limited to the first 50 early birds. <a href="https://admin.atmosvere.eu/register" rel="nofollow ugc">Get started at Atmosvere <span aria-hidden="true" class="wp-exclude-emoji">→</span></a></p>
<h4>What Makes Atmosvere Special?</h4>
<ul>
<li><strong>Invisible to Real Users</strong> – Protection runs in the background; no annoying CAPTCHAs or steps for legitimate users</li>
<li><strong>Request + Behaviour</strong> – Request check before the page loads (under 50 ms); real-time behaviour data on the page</li>
<li><strong>Bot, Scraper & Spam Protection</strong> – Block or challenge bots, scrapers and abusive traffic before they reach your site</li>
<li><strong>Account Protection</strong> – Detect fake accounts and suspicious user behaviour to support safer communities and logins</li>
<li><strong>Marketing Protection</strong> – Reduce fake clicks, invalid leads and low-quality traffic so growth decisions are based on real users</li>
<li><strong>Admin Panel</strong> – Deep insights into bots and scrapers on your site; Advanced Crawler Management</li>
<li><strong>Works for Everyone</strong> – Guests and logged-in users; for communities, distinguish real vs. fake users</li>
<li><strong>Easy Integration</strong> – Works with any WordPress theme; simple setup with API keys</li>
</ul>
<h4>Product Coverage</h4>
<p>Atmosvere for WordPress supports use cases across all three Atmosvere product areas:</p>
<ul>
<li><strong>Bot Shield</strong> – Block bots, scrapers and automated abuse on pages and endpoints</li>
<li><strong>Account Shield</strong> – Strengthen user trust with fake-account detection and user risk signals</li>
<li><strong>Marketing Shield</strong> – Improve traffic quality by filtering suspicious clicks, visits and lead activity</li>
</ul>


Atmosvere (Formerly Trusted Accounts) for WordPress

Protect your pages from bots, scrapers and spam — fully in the background and invisible to visitors. We stop bad visitors before they reach your site.

OpenID Connect Server vs Atmosvere (Formerly Trusted Accounts) for WordPress