Add ProductLift SSO to WordPress

The easiest way to connect ProductLift to a WordPress site is the free official ProductLift WordPress plugin. It handles signed SSO for your logged-in WordPress users, provides shortcodes for every widget type, and requires no code in your theme.

If you cannot install plugins on your site (managed WordPress, restricted hosting, etc.) there is a manual JavaScript fallback further down.

Option 1: WordPress plugin (recommended)

How to get there: Go to Settings in the sidebar of your ProductLift portal → Security & Privacy tab (under Users & Access) → scroll to the Single Sign-On (SSO) section, and copy your SSO Secret.

  1. In your WordPress admin, go to Plugins > Add New, search for "ProductLift", click Install Now, then Activate.
  2. Open ProductLift in your WordPress admin sidebar.
  3. Enter your Portal URL (for example https://feedback.yourdomain.com or https://app.productlift.dev/t/your-slug).
  4. Paste your SSO Secret from step 1.
  5. Save.

That's it. Every logged-in WordPress user is now automatically signed into your ProductLift portal via a short-lived signed JWT (HS256). No user data is stored on your WordPress server, and no third-party cookies are required.

Shortcodes provided by the plugin

The plugin exposes four shortcodes you can drop into any page, post, or block:

  • [productlift_link text="Give Feedback"]: auto-login link to your portal
  • [productlift_widget text="Suggest a feature"]: popup widget trigger
  • [productlift_sidebar text="Open Widget"]: sidebar widget trigger
  • [productlift_embed height="700" tab="feedback" align="wide"]: embed a feedback, roadmap, changelog, or knowledge base board inline. Use tab="roadmap", tab="changelog", or tab="kb" to switch boards. Use align="full" for edge-to-edge, align="none" for the theme's default content width.

The [productlift_embed] iframe auto-resizes to fit its content, so height is only the initial (minimum) height reserved before the board finishes loading.

What data the plugin sends

For logged-in WordPress users with SSO enabled, the plugin transmits:

  • User email address
  • User display name
  • WordPress user ID
  • User avatar URL

This is the same identify payload used by the JavaScript SDK, described in the main SSO guide. Nothing else is sent, and nothing is transmitted for logged-out visitors.

Option 2: Manual JavaScript identify (no plugin)

Use this if you cannot install the plugin (managed WordPress, restricted hosting) or if you want the identify payload to include custom fields (MRR, LTV, segments) that the plugin does not expose.

Add this to your theme's functions.php or use any "insert code in footer" plugin:

add_action('wp_footer', function () {
    if (!is_user_logged_in()) {
        return;
    }
    $user = wp_get_current_user();
    ?>
    <script>
        window.PQ = window.PQ || [];
        window.ProductLiftIdentify = window.ProductLiftIdentify || function (u) { PQ.push(u); };
        ProductLiftIdentify({
            email: <?php echo json_encode($user->user_email); ?>,
            uid: <?php echo json_encode((string) $user->ID); ?>,
            name: <?php echo json_encode($user->display_name); ?>,
            avatar_url: <?php echo json_encode(get_avatar_url($user->ID)); ?>
        });
    </script>
    <script defer src="https://app.productlift.dev/widgets_sdk"></script>
    <?php
});

This is the unsigned identify flow: it relies on the caller (your WordPress site) to send correct user data. Anyone with access to your site source can inspect and modify the payload before it is sent. For a signed (JWT) flow that cannot be tampered with client-side, use Option 1 (plugin) or the server-side SSO flow.

When to use which

Scenario Use
Standard WordPress site, you control the plugins Option 1 (plugin)
You need custom identify fields (MRR, LTV, segments, groups) Option 2 (manual JS) or server-side SSO
Managed WordPress / cannot install plugins Option 2 (manual JS)
Non-WordPress site (React, Vue, static, other CMS) See the main SSO guide

Troubleshooting

  • "SDK reachable" check fails in the plugin settings. Your firewall or caching layer is blocking app.productlift.dev. Allowlist that host.
  • Logged-in users still see the portal's login screen. Confirm your Portal URL in the plugin settings matches the domain you are embedding, and that the SSO Secret matches the one shown under Settings > Security & Privacy > SSO in your portal.
  • You want to disable SSO temporarily. Toggle SSO off in the plugin settings. Widgets and embeds continue to work; users will just need to sign in separately to submit or vote.
Made with ProductLift