Title: ZapQR Login Author: dasecure Published: 25 آگوست 2026 Last modified: 31 آگوست 2026 --- جستجوی افزونه‌ها ![](https://ps.w.org/zapqr-login/assets/banner-772x250.png?rev=3674421) ![](https://ps.w.org/zapqr-login/assets/icon-256x256.png?rev=3674421) # ZapQR Login توسط [dasecure](https://profiles.wordpress.org/dasecure/) [دانلود](https://downloads.wordpress.org/plugin/zapqr-login.1.1.1.zip) * [جزئیات](https://fa.wordpress.org/plugins/zapqr-login/#description) * [نقد و بررسی‌ها](https://fa.wordpress.org/plugins/zapqr-login/#reviews) * [نصب](https://fa.wordpress.org/plugins/zapqr-login/#installation) * [توسعه](https://fa.wordpress.org/plugins/zapqr-login/#developers) [پشتیبانی](https://wordpress.org/support/plugin/zapqr-login/) ## توضیحات ZapQR Login gives your WordPress site passwordless sign-in, two ways: #### Sign in with ZapQR (SSO) — recommended A “Sign in with ZapQR” button on your login page. Visitors sign in with their ZapQR account — passkey-first (Face ID / Touch ID / security key), with an email link as fallback — via standards-based OpenID Connect single sign-on. One ZapQR account works across every site that offers it. * Passkey-first: phishing-resistant WebAuthn sign-in, no passwords anywhere * Standards-based: OAuth 2.0 authorization-code flow with PKCE; ID tokens verified in the plugin (RS256, JWKS) * Links existing WordPress users by their verified email — admins keep their role * New visitors are created with a low-privilege role you choose (Subscriber by default) * Single logout: logging out of WordPress also ends the ZapQR session * No external code: the whole flow is server-side redirects and server-to-server calls #### QR credential fill (classic) Users save their WordPress credentials in the ZapQR app; on the login page they scan a QR code and the login form fills and submits itself. Credentials travel phone browser over an encrypted WebSocket relay and are never stored on external servers. ### External services This plugin talks to the following services. No data is sent anywhere until a site administrator enables the relevant mode. **ZapQR identity provider** (SSO mode) — `auth.zapqr.ai` by default, or a self-hosted issuer the admin configures. When a visitor clicks “Sign in with ZapQR” their browser is redirected there to authenticate; your server then exchanges an authorization code (server-to-server) and receives the visitor’s email address and its verified status — nothing else. Provider: DaSecure ([zapqr.ai](https://zapqr.ai), terms and privacy linked there). **ZapQR relay** (QR mode) — `wss://relay.zapqr.ai`, a WebSocket relay that pairs the login page with the visitor’s phone using a random session identifier. Credentials pass through end-to-end encrypted and are not stored. Provider: DaSecure ([zapqr.ai](https://zapqr.ai)). **QR image service** (QR mode) — `api.qrserver.com` renders the QR image. It receives only the random session identifier and your site’s hostname — never credentials. Provider: [goqr.me](https://goqr.me/) ([privacy](https://www.qrserver.com/en/privacy/)). ## عکس‌های صفحه [⌊The WordPress login page: "Sign in with ZapQR" above the classic QR widget⌉⌊The WordPress login page: "Sign in with ZapQR" above the classic QR widget⌉[ The WordPress login page: “Sign in with ZapQR” above the classic QR widget [⌊Settings > ZapQR Login: SSO configuration, with the exact URIs to register⌉⌊Settings > ZapQR Login: SSO configuration, with the exact URIs to register⌉[ Settings > ZapQR Login: SSO configuration, with the exact URIs to register [⌊Signing in from a TV, kiosk or car - scan the code, approve on your phone⌉⌊Signing in from a TV, kiosk or car - scan the code, approve on your phone⌉[ Signing in from a TV, kiosk or car – scan the code, approve on your phone [⌊Single logout: signing out of WordPress ends the ZapQR session too⌉⌊Single logout: signing out of WordPress ends the ZapQR session too⌉[ Single logout: signing out of WordPress ends the ZapQR session too ## نصب 1. Install and activate the plugin. 2. **For SSO:** go to Settings > ZapQR Login, copy the Redirect URI and Post-logout URI shown there, register your site at the ZapQR identity provider to get a Client ID and Secret, paste them in, tick Enable, save. 3. **For QR fill:** nothing to configure — the widget appears on wp-login.php. Customize theme and accent color in Settings > ZapQR Login. ## سوالات متداول ### What does the site receive about the visitor in SSO mode? Only a verified email address and a stable account identifier, delivered in a cryptographically signed token that the plugin verifies against the provider’s published keys. No passwords, no passkeys, no profile data. ### Can someone take over an existing account? No. Linking to an existing WordPress user happens only when the ZapQR identity provider asserts the email is verified; unverified emails are rejected outright. You can also disable linking entirely, and new users always get the low-privilege role you configure. ### Where do passkeys live? With the visitor and the ZapQR identity provider — never on your WordPress site. Your site only consumes the signed sign-in assertion. ### Does the QR credential mode still work? Yes, unchanged. It is a separate, coexisting mode: the ZapQR app stores per-site WordPress credentials locally on the phone (Face ID / Touch ID protected) and relays them to the browser at login. ### Does this work with multisite? Yes. ## نقد و بررسی‌ها نقد و بررسی‌ای برای این افزونه یافت نشد. ## توسعه دهندگان و همکاران “ZapQR Login” نرم افزار متن باز است. افراد زیر در این افزونه مشارکت کرده‌اند. مشارکت کنندگان * [ dasecure ](https://profiles.wordpress.org/dasecure/) [ترجمه “ZapQR Login” به زبان شما.](https://translate.wordpress.org/projects/wp-plugins/zapqr-login) ### علاقه‌ مند به توسعه هستید؟ [کد را مرور کنید](https://plugins.trac.wordpress.org/browser/zapqr-login/)، [مخزن SVN](https://plugins.svn.wordpress.org/zapqr-login/) را بررسی کنید، یا از طریق [RSS](https://plugins.trac.wordpress.org/log/zapqr-login/?limit=100&mode=stop_on_copy&format=rss) در [گزارش توسعه](https://plugins.trac.wordpress.org/log/zapqr-login/) مشترک شوید. ## گزارش تغییرات #### 1.1.1 * Fixed: the QR widget showed a stale, unscannable code after a login was delivered( e.g. after logging out and back in). It now refreshes its session automatically after every successful fill. * New: `window.ZapQR.refresh()` lets themes/plugins request a fresh QR programmatically. #### 1.1.0 * New: “Sign in with ZapQR” single sign-on (OpenID Connect, authorization-code + PKCE, RS256 ID-token verification via JWKS) * New: link existing users by verified email; configurable default role for new users; optional single logout through the identity provider * Changed: the QR widget script is now bundled with the plugin instead of loaded from zapqr.ai * Hardened: explicit sanitization on all settings #### 1.0.0 * Initial release: QR code credential fill on wp-login.php, theme and accent customization ## اطلاعات * نگارش **1.1.1** * آخرین به‌روزرسانی **3 هفته پیش** * نصب‌های فعال **کمتر از 10** * نگارش وردپرس ** 5.5 یا بالاتر ** * آزمایش‌شده تا **7.0.5** * نگارش PHP ** 7.4 یا بالاتر ** * زبان * [English (US)](https://wordpress.org/plugins/zapqr-login/) * برچسب * [authentication](https://fa.wordpress.org/plugins/tags/authentication/)[login](https://fa.wordpress.org/plugins/tags/login/) [passkey](https://fa.wordpress.org/plugins/tags/passkey/)[passwordless](https://fa.wordpress.org/plugins/tags/passwordless/) [sso](https://fa.wordpress.org/plugins/tags/sso/) * [نمایش پیشرفته](https://fa.wordpress.org/plugins/zapqr-login/advanced/) ## امتیازها هنوز هیچ نقدی ارسال نشده است. [بررسی شما](https://wordpress.org/support/plugin/zapqr-login/reviews/#new-post) [مشاهدهٔ همهٔ بررسی‌ها](https://wordpress.org/support/plugin/zapqr-login/reviews/) ## مشارکت کنندگان * [ dasecure ](https://profiles.wordpress.org/dasecure/) ## پشتیبانی چیزی برای گفتن دارید؟ نیاز به کمک دارید؟ [مشاهده انجمن پشتیبانی](https://wordpress.org/support/plugin/zapqr-login/) ## کمک مالی آیا تمایل دارید از پیشرفت این افزونه حمایت کنید؟ [ کمک مالی به این افزونه ](https://zapqr.ai)