Clearer settings page with a step-by-step Sign in with QRAuth setup guide. No behaviour changes.<\/p>","0.1.24":"
Security hardening: vendored web component 0.4.2 (plain-text error messages, verifier kept out of URLs) and app credentials on the server-side verification call. Recommended for all sites.<\/p>","0.1.23":"
Confirmed compatible with WordPress 7.0. Documentation-only release \u2014 no source-code changes.<\/p>","0.1.22":"
Version bump only \u2014 no source-code changes vs 0.1.21. Re-submission for WordPress.org plugin directory review.<\/p>","0.1.21":"
Better compatibility with security plugins that move the login URL: the plugin now uses wp_login_url() instead of hardcoded \/wp-login.php references.<\/p>","0.1.20":"
WordPress.org plugin review compliance: unminified TypeScript source for the bundled web-components library is now vendored alongside the compiled bundle. No runtime behaviour change.<\/p>","0.1.19":"
Recommended. Removes the Recommended. The Mobile sign-in robustness: the "Continue with QRAuth" flow now reliably returns users to your site after approval, including on sites that send a strict Referrer-Policy header. No configuration change required.<\/p>","0.1.16":" WordPress.org review fixes. Vendored web component bumped to 0.4.1 (no more api.qrserver.com fetch). External services section added to readme. Auto-provision role UI is now Subscriber-only \u2014 sites that need Contributor\/Author must use the new Cosmetic readme fix \u2014 Security hardening \u2014 Tenant URL sanitiser now rejects plain-http localhost values unless CI \/ release-infrastructure bump only \u2014 runners now use Node.js 24. Zero runtime behaviour changes.<\/p>","0.1.11":" Plugin-check hygiene before WordPress.org submission: composer.json now shipped alongside vendor\/, discouraged Translation scaffolding only \u2014 no behaviour changes. New UI strings from 0.1.1 \u2192 0.1.9 are now picked up by the POT + el_GR.po so translators have a current baseline to work from.<\/p>","0.1.9":" Customers signing in through a WooCommerce form now land on My Account (or the checkout step they started on) instead of wp-admin. No configuration change required.<\/p>","0.1.8":" Mobile \/ multilingual fixes: a phone scanning a QR from another device no longer signs itself in; the redirect URL is language-neutral so WPML \/ Polylang \/ Weglot sites need only one allowlist entry.<\/p>","0.1.7":" Adds WooCommerce support \u2014 the widget can now appear on the My Account login\/register forms and on the checkout sign-in step. Opt in per-surface under Settings \u2192 QRAuth.<\/p>","0.1.6":" Adds a Adds mobile same-device sign-in. One-time setup: register your Required hotfix. 0.1.3 accepted QRAuth signatures but rejected every login with Required hotfix. 0.1.2 still failed to accept real QRAuth signatures because the envelope separator Recommended hotfix. Unblocks end-to-end QRAuth sign-in on sites running 0.1.1 \u2014 the Adds a same-origin REST proxy that eliminates browser CORS errors. Upgrading requires adding a Client Secret in Settings \u2192 QRAuth; the existing Client ID and the renamed Tenant URL (previously "Base URL") are migrated automatically.<\/p>","0.1.0":" Initial public release.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":2},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3559096,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3559096,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3559096,"resolution":false,"location":"assets","locale":false}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3559096,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3559096,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1.21","0.1.23","0.1.24","0.2.0","0.2.1","0.2.2","0.2.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3766706,"resolution":"1","location":"assets","locale":"","width":1280,"height":800},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3766706,"resolution":"2","location":"assets","locale":"","width":1280,"height":920},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3766706,"resolution":"3","location":"assets","locale":"","width":780,"height":960},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3766706,"resolution":"4","location":"assets","locale":"","width":1280,"height":800},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3766706,"resolution":"5","location":"assets","locale":"","width":1280,"height":800}},"screenshots":{"1":"The WordPress login page with the \"Sign in with QRAuth\" button under the password form.","2":"QRAuth's sign-in page on a computer: visitors scan the code with their phone's camera.","3":"The same page on a phone: no code to scan, visitors confirm right there and come back signed in.","4":"Settings \u2192 QRAuth: a step-by-step setup guide with the return address ready to copy.","5":"Adding your website in the QRAuth dashboard to get the Client ID and Client Secret."}},"plugin_section":[],"plugin_tags":[710,602,9223,1373,2056],"plugin_category":[38],"plugin_contributors":[265379],"plugin_business_model":[],"class_list":["post-304732","plugin","type-plugin","status-publish","hentry","plugin_tags-authentication","plugin_tags-login","plugin_tags-passwordless","plugin_tags-qr-code","plugin_tags-social-login","plugin_category-authentication","plugin_contributors-aristech","plugin_committers-aristech"],"banners":{"banner":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/banner-772x250.png?rev=3559096","banner_2x":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/banner-1544x500.png?rev=3559096","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/icon.svg?rev=3559096","icon":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/icon.svg?rev=3559096","icon_2x":false,"generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/screenshot-1.png?rev=3766706","caption":"The WordPress login page with the \"Sign in with QRAuth\" button under the password form."},{"src":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/screenshot-2.png?rev=3766706","caption":"QRAuth's sign-in page on a computer: visitors scan the code with their phone's camera."},{"src":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/screenshot-3.png?rev=3766706","caption":"The same page on a phone: no code to scan, visitors confirm right there and come back signed in."},{"src":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/screenshot-4.png?rev=3766706","caption":"Settings \u2192 QRAuth: a step-by-step setup guide with the return address ready to copy."},{"src":"https:\/\/ps.w.org\/qrauth-passwordless-social-login\/assets\/screenshot-5.png?rev=3766706","caption":"Adding your website in the QRAuth dashboard to get the Client ID and Client Secret."}],"raw_content":"\n Adds a Sign in with QRAuth<\/strong> button to your WordPress login page. Visitors press it, confirm it is them on QRAuth, and come straight back signed in. On a computer they scan a code with their phone's camera. On a phone they confirm on the phone itself, with no code to scan. QRAuth handles Google, GitHub, Microsoft and Apple sign-in for you, so you never register an OAuth app with any of them.<\/p>\n\n Five-minute setup.<\/strong> Create a free QRAuth account, add your website in the QRAuth dashboard, and paste the Client ID and Client Secret into Settings \u2192 QRAuth. The settings page walks you through each step and shows the exact address to copy.<\/p>\n\n Built on OpenID Connect.<\/strong> Sign in with QRAuth uses the authorization code flow with PKCE, a one-time state bound to the visitor's browser, and a nonce. WordPress checks the ID token's signature against QRAuth's published keys before anyone is signed in. The QRAuth sign-in service is OpenID Certified.<\/p>\n\n Account safety is the default.<\/strong><\/p>\n\n Works where your users sign in:<\/strong> wp-login.php, the registration form, WooCommerce My Account and checkout, and any page via the Older sites: embedded widget.<\/strong> Sites set up before Sign in with QRAuth existed can keep using the embedded QR widget. It is used only while no Sign in with QRAuth client is configured, and switching over keeps every linked account.<\/p>\n\n Open source build.<\/strong> The compressed JavaScript at This plugin connects to QRAuth (https:\/\/qrauth.io) \u2014 the identity verification service that performs the actual passwordless \/ social sign-in. QRAuth is operated by ProgressNet, the publisher of this plugin. Without QRAuth there is no widget and no sign-in.<\/p>\n\n What the service is and what it is used for<\/strong><\/p>\n\n QRAuth verifies that the user who scanned the QR code (or completed a social-provider flow on the hosted approval page) is the same person who initiated the sign-in on your WordPress site, then returns a signed assertion that the plugin uses to set the WordPress auth cookie.<\/p>\n\n What data is sent and when<\/strong><\/p>\n\n Hosted approval page<\/strong> \u2014 when a visitor on a phone taps \"Continue with QRAuth\", the browser navigates to Sign in with QRAuth (OpenID Connect), when an OIDC client is configured<\/strong> \u2014 the visitor's browser is redirected to The vendored web component ( Service terms and policies<\/strong><\/p>\n\n The compiled bundle at The unminified TypeScript source files are also vendored alongside the compiled bundle inside this plugin ( The plugin's own source \u2014 PHP, the small browser adapter ( The PHP and The vendored file To regenerate the vendored bundle from the pinned npm release, clone the plugin source repository linked above and run from its root:<\/p>\n\n The build script Optional: under Who can sign in<\/strong>, turn on account creation for visitors who do not have an account yet. Under Where the button appears<\/strong>, choose the registration form, WooCommerce forms or the shortcode.<\/p>\n\n Multilingual sites (WPML, Polylang, Weglot) need only one return address: the plugin uses the language-neutral login URL.<\/p>\n\n\n No. On a computer they scan the code with their phone's camera. On a phone they press the button and confirm on the same phone. They confirm with Google, GitHub, Microsoft or Apple on QRAuth's page, so there is nothing to install and no new password.<\/p><\/dd>\n The visitor presses \"Sign in with QRAuth\", confirms on QRAuth in the same tab, and lands back on your site signed in. The phone is not asked to scan its own screen; the QR code is only offered for signing in from a second device.<\/p><\/dd>\n Use Sign in with QRAuth for every new site. The embedded widget is kept for sites that were set up with it. To switch, add your website under Website Sign-in in the QRAuth dashboard and paste the new Client ID and Client Secret into the Sign in with QRAuth section. Existing users keep their linked accounts. Administrators and Editors who used the widget link their account once from their profile.<\/p><\/dd>\n Settings \u2192 QRAuth has a \"Sign-in not working?\" list. The most common causes:<\/p>\n\n With They aren't. Auto-provisioned accounts get a 32-character random password that nobody (including you) holds or needs. WordPress users who already had a password keep it \u2014 QRAuth just becomes an additional sign-in method alongside the usual form.<\/p><\/dd>\n Yes. If a scanned account's email matches an existing WordPress user, they log into that account \u2014 no duplicate is created. The match is remembered via user meta, so subsequent sign-ins skip the email lookup.<\/p><\/dd>\n Subscriber, hardcoded. The settings UI only offers Subscriber, the sanitiser clamps any other value to Subscriber, and the provisioner ignores the stored option entirely and uses Subscriber unconditionally \u2014 this aligns with WordPress.org plugin directory guidelines for sign-in plugins that create users post-external-verification. There is no plugin-provided code path (filter, action, option, or constant) to elevate the auto-provisioning role. If a particular user needs a higher role, change it manually via Users \u2192 All Users after their first sign-in.<\/p><\/dd>\n Yes \u2014 from Users \u2192 Your Profile there's a QRAuth section with an \"Unlink QRAuth\" button. Admins can unlink other users from their profiles too. The WordPress account (role, posts, comments, history) is preserved; only the link metadata is removed.<\/p><\/dd>\n Yes. Deactivate and all your users stay. Uninstall removes the plugin's settings row and its rate-limit transients \u2014 it never deletes WordPress user accounts or their content. If you reinstall later, existing users re-link automatically on their next QRAuth sign-in.<\/p><\/dd>\n No. There's no telemetry, no analytics, no third-party scripts. The only outbound request is from your server to The REST verify route caps requests at 10 per 5 minutes per hashed IP. The hash uses Per-site activation works today. Network-activated multisite is tracked for a future release.<\/p><\/dd>\n\n<\/dl>\n\n\nqrauth_psl_provisioning_role<\/code> filter \u2014 auto-provisioned users are now hardcoded to Subscriber with no code path to elevate. Operators needing a different role for a user must change it manually via Users \u2192 All Users after first sign-in. WordPress.org review fix.<\/p>","0.1.18":"\/verify<\/code> route now fires wp_login<\/code> on success and wp_login_failed<\/code> on signature mismatch so security plugins (Limit Login Attempts, Wordfence), audit logs, MFA gates, and last-login trackers see QRAuth sign-ins as if they came through wp-login.php. Also adds an == External resources ==<\/code> readme section, switches Plugin URI:<\/code> to the plugin's GitHub repo, and adds a top-level GPL-2.0 LICENSE file. No configuration changes required.<\/p>","0.1.17":"qrauth_psl_provisioning_role<\/code> filter.<\/p>","0.1.14":"Contributors:<\/code> now points at the actual wordpress.org profile. No runtime changes.<\/p>","0.1.13":"WP_DEBUG<\/code> is on or the qrauth_psl_allow_localhost_tenant_url<\/code> filter opts in. Blocks an admin-gated SSRF probe path. No action required for sites using https:\/\/<\/code> tenants.<\/p>","0.1.12":"load_plugin_textdomain()<\/code> call removed, 0.1.8 upgrade notice trimmed under the 300-char cap. No runtime behaviour changes.<\/p>","0.1.10":"[qrauth_login]<\/code> shortcode so the widget can live on any page, not just wp-login.php. Opt in from Settings \u2192 QRAuth. No existing configuration changes on upgrade.<\/p>","0.1.5":"\/wp-login.php<\/code> URL in your QRAuth app's redirect-URL allowlist (Settings \u2192 QRAuth shows the exact URL). Desktop sign-in is unaffected either way.<\/p>","0.1.4":"provision_disabled<\/code> because the widget was requesting only the identity<\/code> scope (the scope attribute name was wrong). Upgrade to restore end-to-end sign-in.<\/p>","0.1.3":":<\/code> wasn't in the allowed alphabet. Upgrade to restore end-to-end sign-in.<\/p>","0.1.2":"\/verify<\/code> route's input validators were too strict and rejected every real login. No configuration change required.<\/p>","0.1.1":"\n
[qrauth_login]<\/code> shortcode.<\/p>\n\nassets\/js\/qrauth-components.js<\/code> is built from publicly available TypeScript source at https:\/\/github.com\/qrauth-io\/qrauth\/tree\/main\/packages\/web-components. The unminified source files are also vendored alongside the minified bundle inside this plugin (assets\/js\/source\/<\/code>) for offline review. See the Source<\/strong> section below for build instructions.<\/p>\n\nExternal services<\/h3>\n\n
\n
https:\/\/qrauth.io\/api\/v1\/auth-sessions<\/code>. No visitor data is included in this request.<\/li>\nhttps:\/\/qrauth.io\/api\/v1\/auth-sessions\/verify-result<\/code>. The response carries the QRAuth user identifier and, when the email<\/code> scope is allowed in Settings \u2192 QRAuth, the user's email address. The plugin uses this only to locate or create the matching WordPress user; nothing beyond a hashed link reference is retained.<\/li>\nhttps:\/\/qrauth.io\/a\/<token><\/code> to complete the social-provider flow. This is a standard cross-domain navigation initiated by the visitor.<\/p><\/li>\nhttps:\/\/id.qrauth.io\/authorize<\/code> with your OIDC Client ID, the redirect URI, and one-time state, nonce and PKCE values; the visitor signs in on QRAuth's pages and is redirected back. Your server then calls https:\/\/id.qrauth.io<\/code>: the discovery document and signing keys (\/.well-known\/openid-configuration<\/code>, \/.well-known\/jwks.json<\/code>, nothing sent), the token endpoint (\/token<\/code>: your OIDC Client ID and Client Secret, the one-time authorization code and PKCE verifier), and the userinfo endpoint (\/userinfo<\/code>: the access token). The responses carry a site-specific QRAuth user identifier and, with the visitor's consent, their name and email address and whether QRAuth has verified it. The plugin uses these only to sign the visitor in to the matching WordPress account. The OIDC Client Secret is stored in your site's options table, like the widget's Client Secret, and is never sent to the browser.<\/p><\/li>\n<\/ul>\n\nassets\/js\/qrauth-components.js<\/code>) is served from your own WordPress site \u2014 there is no third-party JavaScript on wp-login.php, and the component does not contact qrauth.io directly from the browser; all server-to-server calls are proxied via your site's REST API.<\/p>\n\n\n
Source<\/h3>\n\n\n\n
assets\/js\/qrauth-components.js<\/code> carries the following banner header at the top of the file:<\/p>\n\n\/*!\n * @qrauth\/web-components v0.4.2\n * Vendored by qrauth-passwordless-social-login. Do not edit by hand.\n *\n * Source: https:\/\/github.com\/qrauth-io\/qrauth\/tree\/main\/packages\/web-components\n * License: MIT\n * npm: https:\/\/www.npmjs.com\/package\/@qrauth\/web-components\n * Build: `npm install && npm run build:assets` (see bin\/fetch-web-components.mjs)\n *\n * The unminified TypeScript source for this bundle is also vendored at\n * assets\/js\/source\/ \u2014 see assets\/js\/source\/README.md for provenance.\n *\/\n<\/code><\/pre>\n\nassets\/js\/source\/<\/code>) for offline review.<\/p>\n\nassets\/js\/qrauth-adapter.js<\/code>), build scripts, tests, and CI \u2014 is publicly maintained under GPL-2.0-or-later at:<\/p>\n\n\n
assets\/js\/qrauth-adapter.js<\/code> shipped in the plugin ZIP are non-minified \u2014 read them directly without checking out the repo.<\/p>\n\nassets\/js\/qrauth-components.js<\/code> is a pinned production build of the public @qrauth\/web-components<\/code> library. The non-compiled source for that library is openly available:<\/p>\n\n\n
package.json<\/code> under the qrauth.webComponentsIntegrity<\/code> key<\/li>\nnpm install\nnpm run build:assets\n<\/code><\/pre>\n\nbin\/fetch-web-components.mjs<\/code> (kept in the plugin source repository, not in the WordPress.org plugin ZIP) downloads the npm tarball, verifies its sha512 SRI hash against package.json#qrauth.webComponentsIntegrity<\/code>, extracts the IIFE build, and writes it to assets\/js\/qrauth-components.js<\/code>. CI runs the same script before the WordPress.org plugin-check job, so the bundle distributed on the directory always matches the published npm release. To rebuild from upstream source instead of the pinned tarball, follow BUILDING.md<\/code> in the upstream library repository above.<\/p>\n\n\n\n
\n
https:\/\/your-site.com\/wp-login.php?action=qrauth_psl_oidc<\/code> and must match exactly.<\/li>\n\n
Do my users need to install an app?<\/h3><\/dt>\n
How does sign-in work on a phone?<\/h3><\/dt>\n
Should I use Sign in with QRAuth or the embedded widget?<\/h3><\/dt>\n
Sign-in does not work. What should I check?<\/h3><\/dt>\n
\n
WP_DEBUG_LOG<\/code> on, each failed sign-in writes its exact reason to the debug log in a line starting with [qrauth-psl]<\/code>.<\/p><\/dd>\nWhere are passwords stored?<\/h3><\/dt>\n
Does it work with existing WordPress users?<\/h3><\/dt>\n
What role do new users get?<\/h3><\/dt>\n
Can I unlink a WordPress account from QRAuth?<\/h3><\/dt>\n
Can I remove the plugin later?<\/h3><\/dt>\n
Does the plugin phone home with analytics?<\/h3><\/dt>\n
https:\/\/qrauth.io\/api\/v1\/auth-sessions\/verify-result<\/code> during a login attempt, carrying only the session ID and the signature the user's phone produced.<\/p><\/dd>\nHow is rate limiting handled?<\/h3><\/dt>\n
wp_salt()<\/code>, so a database dump can't recover caller IPs. Each verify attempt costs one outbound call to QRAuth's servers, so tight limits protect both your site and ours.<\/p><\/dd>\nDoes it work on multisite?<\/h3><\/dt>\n
0.2.3<\/h4>\n\n
\n
0.2.2<\/h4>\n\n
\n
0.2.1<\/h4>\n\n
\n
wp_authenticate_user<\/code>); inactive accounts are still refused, and account-approval plugins can refuse a QRAuth sign-in through the new qrauth_psl_oidc_authenticate_user<\/code> filter.<\/li>\n<\/ul>\n\n0.2.0<\/h4>\n\n
\n
__Host-<\/code> prefix on https, and flow starts are rate limited per IP.<\/li>\nqrauth_psl_oidc_issuer<\/code> filter.<\/li>\n<\/ul>\n\n0.1.24<\/h4>\n\n
\n
0.1.23<\/h4>\n\n
\n
0.1.22<\/h4>\n\n
\n
wp_login_url()<\/code> migration, so this bump exists only to ensure the reviewer's tooling re-scans the post-fix tree.<\/li>\n<\/ul>\n\n0.1.21<\/h4>\n\n
\n
wp_login_url()<\/code> instead of hardcoded site_url('\/wp-login.php')<\/code> for the two locations that reference the W login URL. This respects security plugins that move wp-login.php to a custom URL and is the recommended pattern per the WordPress developer handbook.<\/li>\n<\/ul>\n\n0.1.20<\/h4>\n\n
\n
@qrauth\/web-components<\/code> library at assets\/js\/source\/<\/code> alongside the minified bundle, so reviewers and integrators can read the unminified source without leaving the plugin. The readme's == Source ==<\/code> section (renamed from == External resources ==<\/code> for clarity) and the Description's \"Open source build\" paragraph also link to the canonical upstream repository and build instructions. WordPress.org plugin guideline 4 (human-readable code).<\/li>\n<\/ul>\n\n0.1.19<\/h4>\n\n
\n
qrauth_psl_provisioning_role<\/code> filter introduced in 0.1.16 has been removed. Auto-provisioned users are now hardcoded to the subscriber<\/code> role at every layer \u2014 settings UI, sanitiser, and runtime provisioner \u2014 with no programmatic path (filter, action, option, or constant) to elevate. Operators who need a different role for an individual user must update it manually via Users \u2192 All Users after first sign-in. Identified during WordPress.org plugin directory review (creating users post-external-verification must be capped at the lowest privilege role).<\/li>\n<\/ul>\n\n0.1.18<\/h4>\n\n
\n
\/verify<\/code> route now fires the canonical wp_login<\/code> action on every successful sign-in (mirroring what core's wp_signon()<\/code> does after wp_set_auth_cookie()<\/code>) and wp_login_failed<\/code> on signature_invalid<\/code> rejections. Security plugins (Limit Login Attempts Reloaded, Wordfence, Solid Security), audit-log plugins (WP Activity Log, Simple History), MFA gates, and \"last login\" \/ session-tracking plugins now see QRAuth sign-ins exactly as if the user had authenticated through wp-login.php<\/code>. Identified during WordPress.org plugin directory review \u2014 closes the \"creating your own login method can bypass security plugins\" concern raised in the review. No configuration changes required.<\/li>\n== External resources ==<\/code> section to the readme that publishes the plugin's own GitHub repository (https:\/\/github.com\/qrauth-io\/qrauth-passwordless-social-login, GPL-2.0-or-later) and points at the public source for the vendored @qrauth\/web-components<\/code> library (https:\/\/github.com\/qrauth-io\/qrauth\/tree\/main\/packages\/web-components, MIT) along with the npm release the bundle is pinned to and the npm run build:assets<\/code> step that reproduces it. The vendored file's banner now names its source repository, license, npm release, and build entry-point inline. The plugin header's Plugin URI:<\/code> now points at the GitHub repository instead of the QRAuth platform homepage, and a top-level LICENSE<\/code> file (GPL-2.0) has been added to the repository so forkers and reviewers see the licence at a glance. Addresses WordPress.org plugin directory feedback that compiled JS must link to a publicly maintained, human-readable source.<\/li>\n<\/ul>\n\n0.1.17<\/h4>\n\n
\n
Referrer-Policy<\/code> could end up landing the user on a \"you can close this page\" terminal state instead of returning them to wp-login.php. The \/a\/<token><\/code> proxy now forwards the query string verbatim, matching the existing behaviour documented for the \/api\/v1\/auth-sessions\/<id><\/code> proxy.<\/li>\n<\/ul>\n\n0.1.16<\/h4>\n\n
\n
== External services ==<\/code> section documenting every outbound call the plugin makes, with links to the QRAuth Terms, Privacy Policy, DPA, and Sub-processors list.<\/li>\nqrauth_psl_provisioning_role<\/code> filter, accessible only via code. Editor and Administrator remain hard-blocked at every layer, as before. Existing sites configured with Contributor or Author will fall back to Subscriber on the next save; until then their stored value is unchanged.<\/li>\n<\/ul>\n\n0.1.15<\/h4>\n\n
\n
0.1.14<\/h4>\n\n
\n
Contributors:<\/code> field set to aristech<\/code> \u2014 the verified wordpress.org account that owns the submission. The prior value (qrauth<\/code>) wasn't a registered wordpress.org profile and would have rendered as a broken contributor badge on the plugin directory page.<\/li>\n<\/ul>\n\n0.1.13<\/h4>\n\n
\n
http:\/\/localhost<\/code> and