Add ProductLift SSO to WordPress

The easiest way to connect ProductLift to a WordPress site is the free official ProductLift WordPress plugin. It handles signed SSO for your logged-in WordPress users, provides shortcodes for every widget type, and requires no code in your theme.

If you cannot install plugins on your site (managed WordPress, restricted hosting, etc.) there is a manual JavaScript fallback further down.

Option 1: WordPress plugin (recommended)

How to get there: Go to Settings in the sidebar of your ProductLift portal → Authentication (under People & access) → scroll to the Single Sign-On (SSO) section, and copy your SSO Secret.

1. In your WordPress admin, go to Plugins > Add New, search for "ProductLift", click Install Now, then Activate.
2. Open ProductLift in your WordPress admin sidebar.
3. Enter your Portal URL (for example https://feedback.yourdomain.com or https://app.productlift.dev/t/your-slug).
4. Paste your SSO Secret from step 1.
5. Save.

That's it. Every logged-in WordPress user is now automatically signed into your ProductLift portal via a short-lived signed JWT (HS256). No user data is stored on your WordPress server, and no third-party cookies are required.

Shortcodes provided by the plugin

The plugin exposes four shortcodes you can drop into any page, post, or block:

• [productlift_link text="Give Feedback"]: auto-login link to your portal
• [productlift_widget text="Suggest a feature"]: popup widget trigger
• [productlift_sidebar text="Open Widget"]: sidebar widget trigger
• [productlift_embed height="700" tab="feedback" align="wide"]: embed a feedback, roadmap, changelog, or knowledge base board inline. Use tab="roadmap", tab="changelog", or tab="kb" to switch boards. Use align="full" for edge-to-edge, align="none" for the theme's default content width.

The [productlift_embed] iframe auto-resizes to fit its content, so height is only the initial (minimum) height reserved before the board finishes loading.

What data the plugin sends

For logged-in WordPress users with SSO enabled, the plugin transmits:

• User email address
• User display name
• WordPress user ID
• User avatar URL

This is the same identify payload used by the JavaScript SDK, described in the main SSO guide. Nothing else is sent, and nothing is transmitted for logged-out visitors.

Option 2: Manual JavaScript identify (no plugin)

Use this if you cannot install the plugin (managed WordPress, restricted hosting) or if you want the identify payload to include custom fields (MRR, LTV, segments) that the plugin does not expose.

Add this to your theme's functions.php or use any "insert code in footer" plugin:

add_action('wp_footer', function () {
    if (!is_user_logged_in()) {
        return;
    }
    $user = wp_get_current_user();
    ?>
    <script>
        window.PQ = window.PQ || [];
        window.ProductLiftIdentify = window.ProductLiftIdentify || function (u) { PQ.push(u); };
        ProductLiftIdentify({
            email: <?php echo json_encode($user->user_email); ?>,
            uid: <?php echo json_encode((string) $user->ID); ?>,
            name: <?php echo json_encode($user->display_name); ?>,
            avatar_url: <?php echo json_encode(get_avatar_url($user->ID)); ?>
        });
    </script>
    <script defer src="https://app.productlift.dev/widgets_sdk"></script>
    <?php
});

This is the unsigned identify flow: it relies on the caller (your WordPress site) to send correct user data. Anyone with access to your site source can inspect and modify the payload before it is sent. For a signed (JWT) flow that cannot be tampered with client-side, use Option 1 (plugin) or the server-side SSO flow.

When to use which

Troubleshooting

• "SDK reachable" check fails in the plugin settings. Your firewall or caching layer is blocking app.productlift.dev. Allowlist that host.
• Logged-in users still see the portal's login screen. Confirm your Portal URL in the plugin settings matches the domain you are embedding, and that the SSO Secret matches the one shown under Settings > Authentication > SSO in your portal.
• You want to disable SSO temporarily. Toggle SSO off in the plugin settings. Widgets and embeds continue to work; users will just need to sign in separately to submit or vote.

Forum names and avatars

SSO sets the name and avatar at account creation and preserves them on later sign-ins, including when linking to an existing account. Members can keep a private forum name without it being reset to their WordPress name. Custom integrations can send the optional boolean sync_profile: true to synchronize the name and supplied avatar on each sign-in. See the SSO profile guide.