Category: Uncategorized

This site runs on WordPress, and every person who signs in to it does so through Authfu. There is a password form on the login page because WordPress ships one. The button above it is how we actually get in.

Why bother? Because WordPress runs about 40 percent of the web. It powers the marketing site for the ten-person agency, the newsroom with a hundred contributors, and the store that sells one product very well. Every one of those sites has a login page, and most of those login pages are guarded by a password that was chosen in a hurry. If Authfu is going to matter, it has to matter here first.

Living with it

So we use it ourselves, every day, on the site you are reading. That is the whole idea behind dogfooding: you learn what a product feels like by living with it, not by reading the spec. When the settings page was confusing, we were the ones confused. When role sync took a beat too long, we noticed. The blog is a small site, and small sites are exactly where the rough edges show.

What signing in looks like

You choose Continue with Authfu. Authfu asks for your email, or lets you use Google, Microsoft, GitHub, or a passkey. If you have two-factor authentication turned on, Authfu asks for your code before it sends anything. Only after a valid code does the sign-in link go out.

That order is deliberate. Nobody can fill your inbox by typing your address into a form, because the address alone earns nothing. Two-factor comes before email, every time.

Then a link arrives, you open it, and you are back on WordPress with a session and the right role. No password was typed, stored, or reset.

The part we like most

It is what happens later. Roles live in Authfu and are applied on every sign-in, so a promotion in one place is a promotion everywhere. And when someone’s access is revoked in Authfu, their WordPress session ends too, through OpenID Connect back-channel logout. The site you are reading behaves exactly like the sites we hope you will build with it.

Simple auth. No shortcuts. That line is easy to print on a page. Using it on our own front door is how we keep ourselves honest.

Five minutes is a promise, so here is the clock.

Minute one: install the plugin

Copy the Authfu plugin into wp-content/plugins/authfu and activate it. There are no dependencies to fetch. It speaks OpenID Connect with PKCE using the HTTP and cryptography tools WordPress already has, so activation is the whole install.

Minute two: create the app in Authfu

In the Authfu console, add a WordPress app and give it your site’s callback URL: https://your-site.example/wp-login.php?authfu=callback. Authfu produces a Setup Key, a single string that carries the issuer, client id, and client secret together.

Minute three: paste the key

In WordPress, open Settings → Authfu, paste the Setup Key, and save. WordPress unpacks it and stores the pieces; the secret is never rendered back into the page. Click Test connection and watch discovery succeed. That is the entire configuration.

Minute four: decide who gets what

Choose a default role for people who arrive without one, and decide whether the login page should send everyone straight to Authfu or keep the familiar form alongside the Authfu button.

Then look at roles. Authfu sends a roles claim with each sign-in, and the plugin maps administrator, editor, author, contributor, and subscriber one-to-one. Assign roles in Authfu, and they are applied the next time each person signs in. A role change in Authfu is a role change in WordPress, with no second admin screen to keep in step.

Minute five: sign in

Open wp-login.php, choose Continue with Authfu, and go. If your account has two-factor authentication, you will enter your code first, then receive the link. Open it and you are in, with the role Authfu assigned. Existing WordPress accounts link on first sign-in by email, and from then on they are matched by Authfu’s stable subject id, which is the safer key.

While the clock is still running

Copy the back-channel logout URL from the settings page into your Authfu app. That makes revocation immediate rather than eventual. And click Sync users now so the people already on your site show up in Authfu with the roles they hold today.

That is the walkthrough. Five minutes, one key, and a login page where the password field is optional.

Someone leaves. A contractor’s engagement ends, an editor moves on, an agency hands a site back to its client. The account gets closed in the identity provider, and everyone assumes that is the end of it.

On most WordPress sites, it is only the start. WordPress sessions are cookies with their own lifetime: two days by default, two weeks with Remember Me. Closing an account upstream does nothing to a cookie that already exists. The person who left can keep publishing until it expires, unless someone remembers to visit every site and end the session by hand.

With Authfu, the session ends when the access does. Here is the sequence.

1. Access is revoked in Authfu

An administrator removes the person from the app, suspends them, or takes them out of the organization. Any of those counts.

2. Authfu sends a logout token

Authfu posts a signed OpenID Connect back-channel logout token to the site. The plugin verifies the signature against Authfu’s published keys, checks the issuer and audience, confirms the token is fresh and has never been seen before, and only then acts.

3. WordPress destroys every session for that person

Every browser, every device, every Remember Me. The next request from any of them lands on the login page.

That is the fast path, and it takes about as long as a web request. There is a second path as well. Every few minutes, the plugin confirms with Authfu that a signed-in person still has access. If the answer is no, the session ends. If Authfu is unreachable, the check is skipped, so an outage upstream never locks a site’s own team out. The push handles the moment; the pull covers anything the push missed.

Thirty sites, one action

This is the feature agencies ask about first, and for good reason. An agency managing thirty client sites has thirty login pages and thirty places a former teammate’s session could linger. With Authfu in front of all of them, offboarding is one action. Remove the person once, and every site they touched closes the door behind them.

The same mechanism makes the good days smoother, too. Roles are applied at each sign-in, so a promotion in Authfu is a promotion on every site. Adding someone to a new client’s app puts the tile on their launcher and the role on the site in the same moment.

Identity should be decided in one place and enforced everywhere. For a WordPress session, everywhere now includes the cookie.