BePlus Login Sync helps trusted WordPress sites authenticate users between each other without Multisite and without sharing passwords. It is designed for agencies, site owners, and administrators who manage multiple independent WordPress installs and want a clear trust model for cross-site login. Th
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.2 and PHP 8.1.
SourceWordPress plugins · Nov 15, 2026
01 / Source details
Aboutthistool.
BePlus Login Sync helps trusted WordPress sites authenticate users between each other without Multisite and without sharing passwords.
It is designed for agencies, site owners, and administrators who manage multiple independent WordPress installs and want a clear trust model for cross-site login.
This plugin is a good fit when you want to:
let users sign in from one trusted WordPress site to another
keep each site independent instead of using Multisite
map provider roles to local roles explicitly
control which consumer sites are trusted
review redacted diagnostics when something fails
This plugin is not a good fit when you need:
password synchronization
raw capability mirroring
third-party app OAuth support
cloud-hosted identity brokering
WordPress Multisite as the main architecture
Key features in version 1.0.0:
provider and consumer mode, or both on the same site
provider discovery with metadata, public key, and JWKS endpoints
RS256 token issuance and offline signature validation
consumer connection discovery and trusted provider storage
explicit role mapping per trusted provider connection
profile synchronization for approved core identity fields only
provider-side Allowed Sites management with enable, disable, edit, delete, and icon support
admin toolbar launchers for enabled trusted provider connections
optional logout synchronization for SSO-created sessions
redacted diagnostics logging for connection, token, login, logout, and trust events
How it works:
01Configure one site as a provider.
02Configure another site as a consumer.
03Discover the provider from the consumer and save the trusted connection.
04Start SSO, validate the signed token, create or update the local user, and apply the mapped local role.
Security highlights:
no password synchronization
no shared-secret JWT signing
no raw capability synchronization
no automatic trust for arbitrary sites
private keys remain local to the provider
redirects are validated before cross-site navigation
diagnostics are redacted to avoid storing sensitive secrets
This release completes the initial production-readiness roadmap for BePlus Login Sync and is intended for staged rollout on trusted WordPress environments.
Troubleshooting
Provider discovery fails
Check that the provider site is reachable from the consumer, permalinks are enabled, and the provider discovery endpoints are available. Also confirm security plugins, page cache, or server rules are not blocking REST requests.
SSO returns an invalid state or token error
Start a fresh SSO flow from the consumer and retry. These errors usually indicate an expired login attempt, a tampered callback, or a mismatch between the trusted provider configuration and the signed response.
The provider blocks the login request
Review Allowed Sites on the provider and confirm the consumer site is trusted and enabled. If the consumer is new, a provider administrator may need to approve the first login flow.
Logout synchronization does not happen
Confirm logout synchronization is enabled, the session was created through Login Sync, and the provider connection has a valid trusted logout endpoint.
A role looks wrong after login
Review the consumer Role Mapping screen and test again. The plugin does not mirror provider capabilities automatically, so unmapped roles will follow the fallback behavior.
02 / Source details
Gettingstarted.
01Upload the plugin to /wp-content/plugins/ .
02Activate the plugin through the Plugins screen in WordPress.
03Open Login Sync in the WordPress admin menu and choose whether the site acts as a provider, a consumer, or both.
04On the provider site, review the provider overview screen and confirm discovery endpoints and keys are available.
05On the consumer site, open Connections , enter the provider URL, and save the discovered trusted provider.
06Open Role Mapping on the consumer and map provider roles to local WordPress roles explicitly.
07Open Allowed Sites on the provider to review, enable, or disable trusted consumer records.
08Use Start SSO from the saved connection or toolbar launcher to begin the browser login flow.
09Open Diagnostics to review redacted events and confirm expected login, trust, and logout behavior.
Minimum first-time setup:
10Enable provider mode on Site A.
11Enable consumer mode on Site B.
12Discover Site A from Site B in Connections .
13Save role mappings on Site B.
14Start SSO from Site B and confirm the provider trust approval, local user creation, and local role assignment.
03 / Source details
Frequently asked questions.
Does this sync passwords?
No. The plugin is designed for trusted SSO only and does not synchronize passwords.
What data is synchronized?
The plugin can synchronize approved identity fields such as username, email, display name, first name, and last name. Passwords and raw capabilities are never synchronized.
How do I connect a consumer site to a provider?
Open Connections on the consumer site, enter the provider site URL or direct metadata URL, run discovery, and save the validated provider connection locally.
How does the first provider approval work?
The first time an unknown consumer site requests SSO, a logged-in provider administrator must approve that flow. That initial approval creates the trusted consumer record so later logins can reuse it safely.
How are roles synchronized?
Roles are synchronized only through explicit mapping. Provider role claims are read from the signed token, but local roles change only when an administrator maps them or chooses a fallback role.
Why is my user not getting the expected role?
Check the Role Mapping screen on the consumer site. If a provider role is not mapped, the plugin will use the configured fallback behavior instead of mirroring the provider capabilities directly.
Where do I manage trusted consumer sites?
Use the Allowed Sites screen on the provider. There you can create, edit, enable, disable, delete, and label trusted consumer records, including optional media-library icons.
What does logout synchronization do now?
When enabled, logout can propagate from the consumer to the provider only for sessions that were established through Login Sync. It does not force logout for unrelated local WordPress sessions.
What does Diagnostics show?
Diagnostics records recent connection, token, login, logout, and trust-management events in redacted form without storing raw JWTs, secrets, or private keys.
Is the plugin production-ready today?
Version 1.0.0 completes the initial hardening roadmap with security review updates, packaging hardening, accessibility improvements, and runnable regression tests for core services. Production rollout should still follow your own staging and change-management process.
Does this work with WordPress Multisite?
This plugin is built for independent WordPress sites. It does not use Multisite as its core architecture.
What public endpoints exist now?
The provider currently publishes /metadata , /public-key , /jwks , /token , and /logout under the beplus-login-sync/v1 REST namespace when provider discovery is enabled.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
