Someone leaves. A contractor’s engagement ends, an editor moves on, an agency hands a site back to its client. The account gets closed in the identity provider, and everyone assumes that is the end of it.
On most WordPress sites, it is only the start. WordPress sessions are cookies with their own lifetime: two days by default, two weeks with Remember Me. Closing an account upstream does nothing to a cookie that already exists. The person who left can keep publishing until it expires, unless someone remembers to visit every site and end the session by hand.
With Authfu, the session ends when the access does. Here is the sequence.
1. Access is revoked in Authfu
An administrator removes the person from the app, suspends them, or takes them out of the organization. Any of those counts.
2. Authfu sends a logout token
Authfu posts a signed OpenID Connect back-channel logout token to the site. The plugin verifies the signature against Authfu’s published keys, checks the issuer and audience, confirms the token is fresh and has never been seen before, and only then acts.
3. WordPress destroys every session for that person
Every browser, every device, every Remember Me. The next request from any of them lands on the login page.
That is the fast path, and it takes about as long as a web request. There is a second path as well. Every few minutes, the plugin confirms with Authfu that a signed-in person still has access. If the answer is no, the session ends. If Authfu is unreachable, the check is skipped, so an outage upstream never locks a site’s own team out. The push handles the moment; the pull covers anything the push missed.
Thirty sites, one action
This is the feature agencies ask about first, and for good reason. An agency managing thirty client sites has thirty login pages and thirty places a former teammate’s session could linger. With Authfu in front of all of them, offboarding is one action. Remove the person once, and every site they touched closes the door behind them.
The same mechanism makes the good days smoother, too. Roles are applied at each sign-in, so a promotion in Authfu is a promotion on every site. Adding someone to a new client’s app puts the tile on their launcher and the role on the site in the same moment.
Identity should be decided in one place and enforced everywhere. For a WordPress session, everywhere now includes the cookie.