EthPress – Web3 Login

Changelog

3.2.2

• The wallet login button, the profile fields it shows inline and the Terms checkbox now take their look from the page’s theme instead of being drawn like a WordPress admin control: on an ordinary page the button is drawn the way the theme draws its own buttons – its font, its colours, its border and radius – and the email, name and Terms controls next to it inherit the theme’s font and spacing. A theme that styles no buttons of its own gets a plain outlined button in the current text colour
• The plugin no longer injects a page-wide CSS reset into a page that shows the button: the page keeps its own body font, its own link underlines and its own element margins and spacing, instead of being flattened to the plugin’s Arial body and collapsed paragraph rhythm
• The new ethpress_button_surface filter lets a site say itself which surface the button is rendered on, so an integration the plugin does not know can name its own host instead of relying on the surface the plugin detected
• The WordPress login screen keeps its admin-style button, and the WooCommerce and Ultimate Member forms keep the look of the plugin whose form they stand in – only a page that has a theme of its own changes

3.2.1

• Fixed the wallet button inside an Ultimate Member form: it was drawn inside a second button – the field opened its um-field wrapper twice, so the button sat in a duplicate div – and it did not look like the form it stood in. It now carries Ultimate Member’s own secondary-button class, the one the form’s “Register” button is drawn with, and the button the plugin mounts inside it no longer paints a frame of its own, so the visitor sees one button that matches its neighbours in colour, size and hover
• Fixed the wallet button inside a WooCommerce form: it is drawn by the theme now, like the form’s own “Log In” and “Register” buttons, instead of the small grey admin-style button the plugin uses where the page has no styling of its own. The fix applies to the login, registration, checkout-registration and account-details screens alike

3.2.0

• Email and social login are back in the Professional edition: the plugin no longer hides the “Email” and “Continue with Google” rows there, so the wallet modal offers what the site’s Reown project enables. An embedded wallet signs with ERC-1271/ERC-6492, which the Professional edition verifies – that check asks the site’s JSON-RPC endpoint (ethpress_evm_rpc_url), so a contract-account login needs a reachable endpoint you trust. Ordinary wallets are not affected by that requirement. The Free edition keeps both rows hidden, because the ERC-1271/ERC-6492 verification is Professional and a row offered there could only end in a failed login; the plugin sets that itself and a Free site cannot turn the rows back on. On Professional an operator can still force them off with the hide_email_social inline key (see the extra readme)
• Linking a second wallet no longer renames the account: the user name stays the address of the first wallet the account was registered with. WordPress keeps the user name inside the authentication cookie, so renaming the account used to log out every other session of it (another browser, a phone); those sessions now keep working. The display name and the profile slug still follow the newest wallet
• Accounts that were renamed by linking a wallet in an earlier version keep their current user name – nothing depends on it, so no data is migrated
• Bitcoin wallets that sign in the BIP-322 full variant, or with a DER signature accompanied by their public key, now log in (PRO). Previously such a signature was rejected: the plugin understood only the 65-byte BIP-137 compact form and the BIP-322 simple form, so a Wallet Standard wallet ended in “Bad signature.” after the visitor had approved the prompt
• Smart account login (PRO): an account that is a contract – Safe, Argent, a wallet embedded by a provider – can now log in by answering ERC-1271, and an account that is not deployed yet by ERC-6492. The check asks the chain through a JSON-RPC endpoint, so that endpoint becomes the source of truth for it; point it at your own node with the ethpress_evm_rpc_url filter. The new ethpress_evm_chain_id, ethpress_rpc_timeout and ethpress_erc6492_validator filters are documented in the extra readme
• The Supported networks setting now offers VeChain (PRO). VeChain addresses are derived the same way Ethereum addresses are, so the existing EVM signature check verifies the login. Only wallets that sign an EIP-191 personal_sign message are covered – VeChain’s own Certificate signature is not supported yet

3.1.0

• Multichain login (PRO): besides the EVM chains, a visitor can log in with a Solana, TRON, Bitcoin or TON wallet. Each chain has its own signature verifier bundled with the plugin, so the checks run on your server and need no external service
• Bitcoin: P2PKH and P2WPKH are verified with BIP-137, taproot (bc1p…) addresses with BIP-322
• TON: the wallet signs a ton_proof (domain + timestamp + payload) instead of a text message. The payload is one-time, tied to the login message and expires in 5 minutes
• Every chain is now chosen in the wallet modal, so the login stays one button: TronLink and Leather are listed like any other wallet, and TON is a “TON” row that opens the wallet’s own connect window (a ton_proof can only be asked for while connecting). The separate Log in with TronLink / Log in with Leather / Log in with TON buttons and the Also show the per-chain buttons setting are removed
• A wallet on a phone logs in through the same modal: TRON gets a QR code the plugin draws itself (AppKit has no TRON WalletConnect option of its own), and Bitcoin uses AppKit’s
• The new Wallet list setting (Reown Settings, PRO) decides where the modal takes its list from. Reown catalogue (default, the only option in the free version) keeps the list up to date without a plugin release; This plugin only builds it from the wallets installed in the browser plus a built-in list of mobile wallets, sends no analytics, and – with Block AppKit's cloud on – returns a Content-Security-Policy: connect-src header that stops the page from reaching api.web3modal.org. WalletConnect (a phone wallet, QR code) works in both modes
• An account can carry several wallets (PRO): log in with any of them, and the new [ethpress_wallets] shortcode lists them. Unlinking removes only the wallet it was clicked for, with a confirmation. Attaching an address that belongs to another account is refused
• The Supported networks setting now offers the non-EVM chains as well (PRO): Solana, TRON, Bitcoin (mainnet, testnet, signet), TON (mainnet, testnet) and the test networks
• The ethpress_login_namespaces, ethpress_signature_verifiers, ethpress_address_types, ethpress_verify_signature, ethpress_networks, ethpress_ton_manifest_url, ethpress_ton_proof_domain, ethpress_ton_payload_lifetime and ethpress_remote_non_evm_verification filters are added for add-ons
• The Diagnostics section warns when the php-sodium extension is missing: ed25519 signatures (Solana and TON) are then checked by the bundled pure-PHP implementation, which works but is slower
• A wallet user’s address is printed in full everywhere the EVM address used to be (profile, [ethpress_account], [ethpress_wallets], address fields); only the generated user name is shortened
• The wallet modal no longer downloads a webfont from a third-party domain: it renders in the visitor’s system UI font, so a page with a login button makes no request to fonts.reown.com and preloads no font files
• The new Modal appearance setting (Reown Settings, PRO) can make the wallet modal follow your theme: its font, its accent colour and its corner radius. Only values that cannot break the layout are taken over – a light accent that would leave the button unreadable is ignored, and the radius is capped

3.0.0

• The login modal is rewritten on Reown AppKit (the successor of WalletConnect v2). The old web3modal based front end is removed
• The new Reown settings section is added: Reown Project ID, Theme mode and Supported networks
• Multichain support: the new Supported networks setting lets you choose which networks are offered to users – the EVM chains (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Fantom, Gnosis, zkSync, Linea, Scroll, Celo, Polygon zkEVM, Mantle, Blast, Cronos, Moonbeam) and testnets
• Multisite support: the plugin options are now stored network wide
• The [ethpress_unlink_button] shortcode is added to display the Unlink wallet button anywhere. Unlinking removes the wallet association and keeps the account: signing in again with the same wallet links it back to that account, and the wallet cannot be used to register a second one
• A confirmation message is shown to the user after the account is linked
• The Freemius SDK is updated and bundled via Composer
• olegabr/keccak is replaced with kornrunner/keccak
• Requires PHP 8.1
• The Disable standard redirect login setting is added. When enabled, a successful login no longer redirects to the WordPress dashboard or the Redirect URL, but returns the user to the page where the login started
• The noredirect and redirect_to attributes are added to the [ethpress_login_button] shortcode, so the redirect can be controlled per button
• The label attribute is added to the [ethpress_login_button], [ethpress_link_button] and [ethpress_unlink_button] shortcodes, so the button text can be changed per button (PRO)
• The Remember me login setting is added. Wallet users now stay logged in across browser restarts instead of having to connect their wallet on every visit. The Free version always keeps it enabled
• Wallet users are now registered with an email address, collected from the login form, the WooCommerce checkout, or a placeholder derived from the wallet address, so their profile is editable
• The Profile completion login setting is added. When enabled (PRO), new wallet users who registered without an email address are sent to their profile after the first login to add an email and a name. It also has an Inline form next to the login button mode, which collects the email and name before the account is created. The values are remembered for the current browser tab, so a reload does not lose them
• The Hide on the WordPress login page setting is added. When enabled, the wallet login and register buttons are not displayed on wp-login.php. Buttons added with the shortcodes or the widget are not affected
• The Custom CSS setting is added (PRO). It styles the login buttons and the wallet modal
• The Terms & Conditions text and Terms & Conditions URL login settings are added. They show a required “I agree to the Terms & Conditions” checkbox next to the wallet login button; the text links to the given URL when set. The login is blocked until the box is ticked, and the acceptance is checked on the server as well
• The Diagnostics section is added to the plugin settings. It answers the “why does nothing work here” questions without support: whether php-gmp/php-bcmath verify signatures on this server, whether a known message and signature really recover the expected address (checked with this server, or with the verification service when that is the path the logins take), which verification service is used instead, whether your own Reown Project ID is set, and whether new wallets can create an account
• A signature verification that is done by the verification service now fails cleanly when the service is unreachable, if your site blocks outbound requests, or when it answers with an HTML error page or a different JSON shape. Such answers used to raise PHP warnings inside the login request instead of a normal “failed to verify” error. The signature self-test in the Diagnostics section reports exactly that: it probes the service when the service is the path the logins take, and it waits at most 5 seconds
• The [ethpress_login_button] shortcode no longer prints nothing for a logged-in visitor. It prints a hint explaining that the button is hidden because the user is already logged in (notice="1" forces it for every visitor, notice="0" switches it off); site owners see the hint by default
• A wallet without an account is no longer answered with the bare “You have not registered on this site; we cannot log you in”. When the site does not accept registrations (the default), the message now says so, names the Anyone can register setting and tells the visitor to contact the site administrator – something they can forward as is. Both messages are filterable with ethpress_registration_closed_message and ethpress_unregistered_message
• Fixed wallet login on sites where another active plugin (for example BuddyPress) prints output, or renders a login form, while the login request is being processed. Such output used to be prepended to the AJAX response, which broke it with the Unexpected token < in JSON at position 0 error and left the user logged in on the server but not in the browser
• A malformed signature that cannot be recovered no longer returns an HTTP 500 error page. The failure is caught and reported as a regular JSON error response
• Fixed the renewed AJAX nonces that a successful login returns in its response. They were created for a session token that the browser did not have yet, so using them right after logging in failed with Bad nonce, please refresh. The renewed nonces are now valid on the session the login just created
• Wallet login with Bitcoin addresses (PRO). P2PKH (1…) and P2WPKH (bc1q…) are verified as BIP-137 signed messages; taproot (bc1p…) is verified as a BIP-322 simple signature, which is the scheme taproot wallets sign with, since BIP-137 is not defined for them
• Wallet login nonces are now one-time. The nonce is issued when the login message is requested and consumed when the signature is verified, so a signed message cannot be replayed. Its lifetime is configurable with the ethpress_nonce_lifetime filter (15 minutes by default) instead of the fixed five minutes, and it no longer depends on the session token, which fixes Bad nonce, please refresh on slow mobile wallet flows