WordPress plugin

Blind-ID sign-in for WordPress: a real person behind every account, with no password, name or email for your site to store or lose. Connects to IRLProof.me with one button.

Download the plugin (version 0.5.2)

Requires WordPress 6.4 or later and PHP 8.0 or later.

Install

1. In your WordPress admin, open Plugins, then Add New Plugin, then Upload Plugin.
2. Choose the file you downloaded, press Install Now, then Activate.
3. Open Settings, then IRLProof.
4. Press Connect to IRLProof.me. Sign in to the developer console if asked, check the addresses shown, and press Connect WordPress. You come back to WordPress already connected: the site is registered, and its client secret and webhook secret are saved, without either passing through your browser.
5. Sign out and try the Sign in with IRLProof button on your login page.

Take it live

A new site is in testing and takes a limited number of people. When you're ready, verify your domain under Domains in the console, then press Take … live on the site's Settings tab.

What it does

• Sign-in and sign-out. A login button on the WordPress login screen, and a [irlproof_button] shortcode for anywhere else. Signing out of WordPress ends the IRLProof.me session too.
• Accounts. A WordPress user is created on first sign-in, with a readable username and the role you choose. The account is keyed on the person's identifier for your site.
• The data contract. If you ask people for something under "What you ask for" in the console, it arrives with the sign-in and is saved to the user. An email address you ask for becomes the user's email.
• Consent receipts. The signed receipt of what each person agreed to is stored against their user.
• Webhooks. When someone deletes their IRLProof.me account, their WordPress user can no longer be signed in to, and your content stays.
• Age verification. With the age verification add-on turned on for the site, tick Only let people in whose ID confirms they are 18 or over. Anyone whose ID doesn't confirm it, or whose age couldn't be checked, is refused, and each check's signed receipt is kept against the user.

Set it up by hand

If the site can't reach IRLProof.me from its server during setup, register it in the console yourself, using the redirect, sign-out and webhook addresses shown on the plugin's settings page, then paste the client ID, client secret and webhook secret into that page.

Testing

To try it against the sandbox, choose sandbox.irlproof.me next to the Connect button. The sandbox only accepts test IDs from Google Wallet's developer program.