WP Single Sign On

Enterprise-grade SAML 2.0 Single Sign-On for WordPress. Pure PHP. No third-party libraries. No license servers. Priced for nonprofits, schools, and small teams.

WP Single Sign On (WP-SSO) brings secure Single Sign-On to WordPress the simple way: a from-scratch, pure PHP SAML 2.0 implementation with no external dependencies and nothing to phone home.

While It’s built for WordPress, WP-SSO speaks standard SAML 2.0, so it also connects to enterprise-grade secure access, made possible via the upcoming WP-SSO Pro product tier — designed to put that capability within reach of the nonprofits and small businesses that are priced out of it.

WPSSO Animated Logo

WP-SSO Free

Two products, one family. These free plugins are fully functional on their own — every feature below, no time limits, no locked core functions. This free tier: includes one IdP connection and one SP connection (SP). Both plugins can be installed together on the same site in dual roles (IdP + SP) without conflict. The free download is coming soon to WordPress.org. Download links will be available in a few weeks!

WP Single Sign On – IdP (Identity Provider): Turns your WordPress site into a SAML 2.0 Identity Provider. Your users log in once with their WordPress account and reach every connected site securely.

  • Pure PHP SAML 2.0 — no third-party libraries
  • Signed, encrypted assertions (RSA-SHA256, AES-256-GCM)
  • SP- and IdP-initiated SSO with single logout
  • Per-SP attribute mapping and role assignment
  • Signed one-click config push to SP sites
  • Endpoint rate limiting + replay prevention

WP Single Sign On – SP (Service Provider): Turns your WordPress site into a SAML 2.0 Service Provider. Users log in to WordPress through your trusted WP-SSO Identity Provider.

  • Pure PHP SAML 2.0 — no third-party libraries
  • Signed, encrypted authentication (RSA-SHA256, AES-256-GCM)
  • SP- and IdP-initiated SSO with single logout
  • Auto-provisioning with email match and role control
  • Signed config receive from a trusted IdP
  • Replay prevention

Both plugins can be installed together on the same site in dual roles (IdP + SP) without conflict.

GET THE IDP PLUGIN

Download

GET THE SP PLUGIN

Download

WP-SSO Pro — Coming soon

Pro unlocks multiple connections, third-party enterprise Identity Provider connections (Okta, Azure AD, Google Workspace, Keycloak, and other open-source providers), and managed support plans.

PLAN BENEFIT LEVELS

  • Basic
    $149 yearly
    • 16 support hours per year
    • Email support channel
    • 72-hour response window
    • Annual maintenance check
    • Zero setup sessions
    • Zero custom integrations
    Subscribe
  • Deluxe
    $249 yearly
    • 24 support hours per year
    • Email + chat support channels
    • 48-hour response window
    • Bi-annual maintenance check
    • 1 setup session per year
    • Zero custom integrations
    Subscribe
  • Premium
    $349 yearly
    • 36 support hours per year
    • Priority support channels (virtual meetings)
    • 24-hour response window
    • Quarterly maintenance check
    • 2 setup session per year
    • 1 custom integration per year
    Subscribe

Plan Service Requirement: Hours draw down across the year; unused hours do not roll over. Overage $75/hour. Need more mid-year? Prorate an upgrade or purchase additional hours.

PRODUCT FEATURES

Connections

  • Unlimited SP connections (IdP Pro) and Unlimited IdP connections with multi-IdP federation (SP Pro).
  • Third-party enterprise IdP federation — Okta, Microsoft Entra ID, Google Workspace, OneLogin, Auth0, Ping Identity, and any SAML 2.0 compliant IdP
  • Connection registries with card grids — live status badges, last-verified time, one-click Test Connection per connection

Ecosystem Monitoring

  • Connection health dashboard — real-time status, uptime history, last-check timestamps, failure alerts
  • Bird’s-eye ecosystem view — dashboard summary panels with connection counts, network groupings, and recent activity

Security

  • Signed AuthnRequests (AuthnRequestsSigned=true, SP Pro)
  • Signing algorithm selection — SHA-256, SHA-384, SHA-512
  • Configurable assertion encryption on/off toggle
  • Certificate strength options — RSA-2048, RSA-4096, ECDSA P-256
  • Persistent replay prevention — database-backed, survives session cleanup
  • Attribute-based access control on top of minimum-role checks
  • XXE hardening dashboard — parsing security status and blocked attempt display
  • Extended login-page customizer support beyond Branda

User Management

  • Advanced role mapping — multi-map, priority, fallback
  • Role mapping templates — Google Workspace, Microsoft 365, Salesforce
  • Just-in-time provisioning rules — conditional user creation, e.g. email-domain allowlists
  • Nested user-meta-attribute paths, role-based conditional attributes, reusable attribute templates
  • Custom attribute transformers — uppercase, lowercase, substring, regex replace, date format
  • Attribute value preview — see the exact SAML attributes a user would receive
  • NameID format selection — unspecified, email, persistent, transient
  • Global SLO configuration per SP with graceful fallback; IdP-initiated single logout across all connected sites
  • Stored attributes — search by value, bulk operations, export, attribute change history

Operations

  • Advanced audit log — search, filter, export (CSV/JSON), auto-purge
  • Email alerts on repeated SSO failures — configurable threshold and time window
  • SAML response inspector — raw request/response XML for recent transactions
  • Metadata tooling — downloadable XML, in-browser syntax-highlighted viewer, auto-push to registered SPs on certificate regeneration, SP auto-registration from a metadata URL
  • White labeling — client logo, colors, and styling on SSO pages; OTA/WP-SSO branding removed from client-facing interfaces

Integrations

  • WooCommerce — full billing-address pre-population (activates when WooCommerce is active)
  • Paid Memberships Pro — membership-level assignment from IdP attributes
  • LearnDash — group and course enrollment from IdP attributes

Hours draw down as you use them across the year; unused hours do not roll over. Need more mid-year? Prorate an upgrade or purchase additional hours at $75/hour.

Managed Support Services — continuous real-time support

High value, efficient, and affordable — Purchase or subscribe to secure a license on this page, then access support services via the OLC Support Desk delivered by Oracles of Truth Academy (OTA).

GET PRIORITY SUPPORT

Access Support

Start typing and press Enter to search