⚠ DISCLAIMER
A WordPress plugin that connects a WP site to a XenForo forum without installing anything on the XF side —
everything runs from WordPress using XF's standard REST API and webhooks.
What it does
- Bi-directional user sync — register on WordPress, the matching XenForo account is auto-created; register on
XF, the WordPress account is auto-created via webhook. Existing users auto-link by email or username on first login.
- Single sign-on — log into WordPress (password OR passkey) and you land logged into the forum at the same
time, via XF's login-token API.
- WebAuthn / Passkey login — passwordless authentication with device biometrics, PIN, or security keys.
Includes a token-redirect mechanism that works reliably behind aggressive cache layers (Cloudflare, LiteSpeed) that
strip Set-Cookie from REST responses.
- Latest threads widget — Elementor widget, sidebar widget, Gutenberg block, and
[xf_latest_threads]shortcode. Four modes: latest created, latest active (bumped by replies), latest
replies, latest activity (mixed feed of new threads + replies). Auto-refreshes every 30 seconds via AJAX — new posts
and deletions surface within seconds without page reload.
- Per-user XenForo Profile section on the WP user-edit screen — live XF username, email, group memberships,
sync timestamps. Manual "Link by XF user ID" input as fallback.
- Users list integration — sortable, filterable "XenForo" column on the WP Users list so admins can see sync
status at a glance.
- Webhook signature verification — handles both XF 2.2 HMAC signatures and XF 2.3 plaintext-secret
authentication transparently.
- Smart fallback chain — widget never goes empty on low-activity forums; broadens its query progressively
until something shows.
- Auto-post on WP publish — optionally create a XenForo thread when you publish a WordPress post, with a
configurable BBCode template ({post_url},{post_title},{post_excerpt}
placeholders).
XenForo-side requirements
- A XenForo API key. Super-user type recommended for full functionality. User-type keys work for read-only
widget features but block user creation, find-email lookups, and SSO bounces.
- Optional but recommended: two webhooks (one for
/sync-user, one for
/sync-content) subscribed to user_* and post_*/thread_* events. Enables real-time updates instead of
cron-driven polling.
Who it's for
If you run a WordPress site alongside a XenForo community and you're tired of users having two separate accounts, two
separate logins, and zero sync between them — this stitches the two sides together. Comments under a blog post can
become replies on a linked XF thread. Users register once, end up on both. Latest forum activity surfaces directly on
your WP frontend.
Built with
Designed and developed with Claude (Anthropic's AI agent), including the
architectural decisions, the WebAuthn integration, the token-based auth-cookie delivery that survives cache layers
stripping Set-Cookie from REST responses, and the multi-version-tolerant webhook signature verification.
Uses the lbuchs/WebAuthn PHP library for FIDO2 / WebAuthn operations.
Status
Current version: 1.7.11 — running in production on my own private site. Open code,
GPL-2.0+, fork freely. Use at your own risk and test on staging before deploying to a live site.
Feedback, bug reports, and feature requests welcome in this thread.
Attachments
Last edited:
Probably most of developers will be hate me then 
