Login by Auth0

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

8 searches this plugin appeared in over the last 90 days, 0 listed. 8 left out as unrelated or noise (years, numbers, stray words). 5 of its tags aren't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 30% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 14 months ago; the previous band took 17 months to cross, which places it about 50% of the way through.

1. ★★★★★ arbbi

   1.7y ago

   If you’re considering using the “Login by Auth0” plugin for WordPress authentication, DON’T. This plugin is an outdated, poorly maintained disaster that can break your site entirely. ❌ Fatal Errors & Crashes Installing and activating this plugin caused a fatal error on my WordPress site, making the entire login process unusable. It hasn’t been properly tested with the latest WordPress versions, and there’s no sign of maintenance or bug fixes. ❌ No Support, No Updates The plugin is practically abandoned – the last update was ages ago, and support requests are ignored or unanswered. If you run into issues, you’re on your own. For a security-focused plugin, this is completely unacceptable. ❌ Security Risks An authentication plugin that isn’t actively maintained is a massive security liability. If a vulnerability is found (which is likely, given the outdated codebase), you won’t get a fix anytime soon. ❌ Terrible User Experience Even if the plugin doesn’t crash your site (which it likely will), the configuration is a nightmare. The setup process is clunky, error-prone, and riddled with outdated documentation. Expect a frustrating experience from start to finish. 💀 Final Verdict: DO NOT USE. Auth0 is a great identity provider, but this WordPress plugin is a complete embarrassment. If you value site stability, security, and actual support, avoid this plugin at all costs. 🔹 Uninstall immediately.🔹 Look for a better alternative.🔹 Hope Auth0 either fixes or completely deprecates this mess. 🚨 DO NOT TRUST YOUR SITE’S LOGIN SECURITY TO THIS BROKEN PLUGIN. 🚨

   Read on wp.org ↗
2. ★★★★★ philbahz

   2.2y ago

   The title says it all. I spent the better part of 3 days trying to get this to work with no luck. I even paid for a plan to get support. They were little to no help. I use miniorange for my SSO needs. It works decently and has good support.

   Read on wp.org ↗
3. ★★★★★ Ivan Hryhorenko

   2.5y ago

   Unfortunately, plugin doesn’t work and abandoned. On official Github repository you can find this text: v4 of the plugin is no longer supported as of June 2023. We are no longer providing new features or bugfixes for that release. Please upgrade to v5 as soon as possible. OAuth0 Github But irony that v5 doesn’t work as well, so both versions of plugin are just a waste of time This topic was modified 2 years, 2 months ago by Ivan Hryhorenko.

   Read on wp.org ↗
4. ★★★★★ Donald Moore Jr.

   4.9y ago

   I have some questions about signing JWT’s, but other than that, the documentation is exhaustive, which is one of the reasons why I chose it. You can tell when a project is put together well.

   Read on wp.org ↗
5. ★★★★★ Menn

   5.5y ago

   I use multiple WordPress sites and other member platform. When I set every site login via Auth0, it creates seamless experience for users. I decide to user only Passwordless email. This will help people secure their accounts (because of no password to remember and no easy password remains.)

   Read on wp.org ↗
6. ★★★★★ svax

   5.7y ago

   Multiple users are not allowed to login getting the error : “This site requires a verified email”, even though this is not enabled in the settings. I’ve tried reporting this, getting absolutely zero response after 6 months…

   Read on wp.org ↗
7. ★★★★★ Ajay Ghaghretiya

   8.4y ago

   Does the latest version of plugin use the Lock 10 or Later version of the Lock API? Please do let me know your inputs about the same. Thanks

   Read on wp.org ↗
8. ★★★★★ earmbrust

   8.7y ago

   . This topic was modified 8 years, 4 months ago by earmbrust. This topic was modified 8 years, 4 months ago by earmbrust. This topic was modified 8 years, 4 months ago by earmbrust.

   Read on wp.org ↗

All 7 disclosed vulnerabilities are patched in the current version (4.6.2). Sites still on an older version should update.

1. Patched Medium · 6.1 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle ↗
   2024-07-09 CVE-2023-6813 Improper Neutralization of Input During Web Page Generation Affects <= 4.6.0 Patched in 4.6.1
2. Patched Medium · 4.3 Login by Auth0 <= 3.11.3 - Insecure Direct Object Reference ↗
   2020-04-01 CVE-2020-7948 Authorization Bypass Through User-Controlled Key Affects <= 3.11.3 Patched in 4.0.0
3. Patched Critical · 9.8 Login by Auth0 <= 3.11.3 - CSV Injection ↗
   2020-04-01 CVE-2020-7947 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 3.11.3 Patched in 4.0.0
4. Patched High · 7.2 Login by Auth0 <= 3.11.3 - Stored Cross-Site Scripting ↗
   2020-04-01 CVE-2020-6753 Improper Neutralization of Input During Web Page Generation Affects <= 3.11.3 Patched in 4.0.0
5. Patched High · 8.8 Login by Auth0 <= 3.11.3 - Cross-Site Request Forgery ↗
   2020-04-01 CVE-2020-5391 Cross-Site Request Forgery Affects <= 3.11.3 Patched in 4.0.0
6. Patched Medium · 5.5 Login by Auth0 Plugin <= 3.11.3 - Stored Cross-Site Scripting ↗
   2020-03-31 CVE-2020-5392 Improper Neutralization of Input During Web Page Generation Affects <= 3.11.3 Patched in 4.0.0
7. Patched Medium · 6.1 Login by Auth0 3.11.0 - 3.11.2 - Cross-Site Scripting ↗
   2020-01-31 CVE-2019-20173 Improper Neutralization of Input During Web Page Generation Affects 3.11.0 - 3.11.2 Patched in 3.11.3

Automated install-time checks, tested on PHP 8.1.12 · WP 6.5.5

Translated into 5 languages, 2 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-09-16 20K+ → 10K+ down after 495 days in tier
2. 2024-05-09 10K+ → 20K+ up after 7 days in tier
3. 2024-05-02 6K+ → 10K+ up after 50 days in tier
4. 2024-03-13 5K+ → 6K+ up after 619 days in tier
5. 2022-07-03 4K+ → 5K+ up after 32 days in tier
6. 2022-06-01 5K+ → 4K+ down after 8 days in tier
7. 2022-05-24 4K+ → 5K+ up after 348 days in tier
8. 2021-06-10 3K+ → 4K+ up after 321 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Login by Auth0 into a readme, a review or a deck. It updates itself.

Login by Auth0: 10K+ active installs, 3.1★ (18 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/auth0