Shibboleth

76 Quality Score

Active Installs

16/30

At roughly 3,000 active installs it is a niche plugin, but usage is steady within its institutional audience which is why the popularity subscore lands well above the raw install figure would suggest.

Update Freshness

25/25

Maintenance is perfect in the model: the plugin was last updated on 2026-06-22 and is explicitly tested against WordPress 7.0, which is a strong signal of active stewardship.

User Rating

13/15

Only 7 users have rated it, but the average is a high 86 out of 100, so the few administrators who have used it are clearly satisfied with the result.

Support Health

8/15

Support health is the weak link: 0 support threads have been opened on the WordPress.org forum, which gives no real signal that help is available there and suggests users rely on institutional IT rather than community support.

WP Compatibility

15/15

Compatibility is strong: minimum requirements are WordPress 4.3 and PHP 5.6, and it is tested up to WordPress 7.0, so it will run on effectively any maintained WordPress install.

Scores higher than 49% of indexed plugins

About

Allows WordPress to externalize user authentication and account creation to a Shibboleth Service Provider.

Active Installs 3k+

Rating ★★★★ 4.3/5

Last Updated 2026-06-22 11:40am GMT

Requires WordPress 4.3+

Tested Up To 7.0.4

Requires PHP 5.6+

Security History

2 known vulnerabilities, all patched

1 Critical 1 Medium

Most recent: June 24, 2026

View details ▸

What It Does

Shibboleth is a WordPress plugin that hands off user authentication to an external Shibboleth Service Provider, allowing logins via SAML/Shibboleth rather than the default WordPress login form. It is designed for institutions that already operate a Shibboleth identity provider and want WordPress to recognize those federated users.

Who It's For

This plugin is built for universities, research consortia, government agencies, healthcare networks, and large enterprises that already run a Shibboleth or SAML 2.0 identity provider and need WordPress to plug into a campus-wide or organizational single sign-on system. It suits IT teams that manage federated identity and want to avoid creating local WordPress accounts for thousands of users.

Who Should Skip It

If you do not already operate a Shibboleth Service Provider, or you simply need basic site protection, brute-force defence, or a customized login page, this plugin is the wrong tool and will not work without backend identity infrastructure in place.

The Bottom Line

Shibboleth earns a 75.97 overall score and is a focused, well-maintained bridge between WordPress and institutional Shibboleth identity providers, making it the right answer for SSO in higher education and enterprise settings. Its tiny install base and lack of forum activity mean you should not depend on community support: you will need in-house expertise or a paid maintainer. If you are not running a Shibboleth SP, look at the security-oriented alternatives above instead.

Related Plugins

WPS Hide Login 89/100

Pick WPS Hide Login if your goal is simply to move or obscure the wp-login URL for basic brute-force protection rather than integrate an enterprise identity provider.

Loginizer 89/100

Choose Loginizer if you want login rate limiting, IP blacklists, and password hardening rather than federated SSO.

Security Plugin, Firewall & Malware Scanner with Auto Removal 88/100

Opt for this security suite if you need a broad hardening and malware scanning toolkit and have no need for SAML-based authentication.

Security Optimizer – The All-In-One Protection Plugin 88/100

Pick SG Security when you want an all-in-one hardening plugin with login protection, firewall rules, and activity logging, not external SSO.

LoginPress 86/100

Choose LoginPress if your priority is redesigning and customizing the look of the default WordPress login screen.