Title: Civipass Author: Perforks Published: November 6, 2026 Last modified: November 6, 2026 --- Search plugins ![](https://ps.w.org/civipass/assets/banner-772x250.png?rev=3788171) ![](https://ps.w.org/civipass/assets/icon.svg?rev=3787653) # Civipass By [Perforks](https://profiles.wordpress.org/jbosnakis/) [Download](https://downloads.wordpress.org/plugin/civipass.1.0.0.zip) * [Details](https://wordpress.org/plugins/civipass/#description) * [Reviews](https://wordpress.org/plugins/civipass/#reviews) * [Installation](https://wordpress.org/plugins/civipass/#installation) * [Development](https://wordpress.org/plugins/civipass/#developers) [Support](https://wordpress.org/support/plugin/civipass/) ## Description Civipass connects a WordPress site to the official user authentication service ( OAuth 2.0) of the Greek General Secretariat for Information Systems (GSIS). People sign in with their TaxisNet credentials on the GSIS pages — the site never sees them — and come back signed in to an account linked to their tax number. The GSIS offers this service to public sector bodies (ministries, municipalities, regions, universities, legal entities of public law, chambers and other bodies of the wider public sector). Each body applies through the Interoperability Centre’s request application (EDA) and receives its own credentials. Civipass shows the exact return address to declare in that request. **Features** * “Sign in with TaxisNet” button on the login screen, as a shortcode (`[civipass_login]`) and as a block. * Pilot (test.gsis.gr) and production (oauth2.gsis.gr) environments, each with its own credentials, and a button that checks them. * Accounts are recognised by tax number. New accounts can be created on first sign- in (off by default), always with a role that cannot manage the site. * People link their existing account from their profile. The tax number and names of a linked account are never edited by hand: they come from the GSIS at every sign-in, and the person can fetch them again with “Update details from TaxisNet” on their profile or with the `[civipass_refresh]` shortcode. Only staff who edit the account can unlink it. * The GSIS does not give an e-mail address: new people enter one and confirm it by e-mail before it is saved. * Signing out of the site also signs out of the GSIS, so a shared computer cannot reuse the session. * `[civipass_field name="fullname"]` shows the signed-in person their own details( afm_masked, firstname, lastname, fullname…). * Administrators see each linked account’s tax number in the users list and can find an account by typing the 9-digit number in the search box; everyone else sees it masked. * Bodies that the GSIS has granted the one-time-code variant of the service (oAuth2.0- OTP) enter its credentials and get a second button. * Personal data export and erasure, and suggested privacy policy text. **Security** Civipass creates and signs in accounts on behalf of an outside identity provider, so it is built to be strict by default: * Nothing reaches the GSIS until a person presses the button. The TaxisNet password is typed only on the GSIS pages; the site never sees or stores it. * Every sign-in carries a random, one-time `state` that is tied to the browser that started it (cookie) and expires after ten minutes, so a callback cannot be replayed, forged or forced on someone else. * The one-time code is exchanged for the person’s details server to server, with certificate checks on, no redirects, a short timeout and a size limit. The answer is read with external entities and network access turned off. * Accounts that can manage the site (administrators, editors and anyone with similar capabilities, also on multisite) cannot sign in with TaxisNet unless an administrator turns that on explicitly; they keep their password. New accounts never get such a role. * The tax number and the GSIS client secrets are stored encrypted (libsodium). The key can be moved to wp-config.php, so a copy of the database alone reveals nothing. A keyed hash is used to find an account by tax number. * User names are random, so the tax number never appears in author archives or other public addresses. Names that came from the GSIS cannot be changed by hand, through the profile screen, the REST API or `wp_update_user()`. * Sign-in attempts and callbacks are rate-limited per address (per /64 for IPv6). * Every form and action checks a nonce and the user’s capabilities, and every value is sanitised on input and escaped on output. * A test server can only be used on sites marked as local, development or staging(` WP_ENVIRONMENT_TYPE`), so a forgotten setting can never send a live site’s sign- ins elsewhere. **Civipass Pro**, sold separately, adds features that bodies need in production, such as sign-in for public administration employees and a sign-in log. ### External services This plugin connects to the user authentication service (OAuth 2.0) of the General Secretariat for Information Systems (GSIS) of the Ministry of Digital Governance, Greece. Nothing is sent before a person presses a “Sign in with TaxisNet” button or an administrator presses “Test the connection”. * When a person signs in, their browser is sent to `https://test.gsis.gr/oauth2server/`( pilot) or `https://oauth2.gsis.gr/oauth2server/` (production) with the site’s client ID and return address (the oAuth2.0-OTP service uses the same addresses with its own client ID). After they sign in and consent there, the site sends the GSIS the one-time code, its client ID and secret, and receives the person’s tax number, first name, last name, father’s name, mother’s name and year of birth. * When a person who signed in this way signs out, their browser is sent to the GSIS sign-out page of the same environment. * “Test the connection” sends the client ID and secret with a made-up code to the token address above. GSIS: https://www.gsis.gr/ — service description and terms: https://www.gsis.gr/ dimosia-dioikisi/ked/webservices/oauth20 ## Screenshots [⌊The login screen with the "Sign in with TaxisNet" button. The same button is available as a shortcode and as a block.⌉⌊The login screen with the "Sign in with TaxisNet" button. The same button is available as a shortcode and as a block.⌉[ The login screen with the “Sign in with TaxisNet” button. The same button is available as a shortcode and as a block. [⌊Settings → Civipass: the return address to declare in the EDA request, the pilot and production credentials, and "Test the connection".⌉⌊Settings → Civipass: the return address to declare in the EDA request, the pilot and production credentials, and "Test the connection".⌉[ Settings Civipass: the return address to declare in the EDA request, the pilot and production credentials, and “Test the connection”. [⌊The person's profile: the details that came from the GSIS, read-only, and "Update details from TaxisNet".⌉⌊The person's profile: the details that came from the GSIS, read-only, and "Update details from TaxisNet".⌉[ The person’s profile: the details that came from the GSIS, read-only, and “Update details from TaxisNet”. [⌊The users list: a TaxisNet column with the linked tax number (administrators only), and search by the 9-digit number.⌉⌊The users list: a TaxisNet column with the linked tax number (administrators only), and search by the 9-digit number.⌉[ The users list: a TaxisNet column with the linked tax number (administrators only), and search by the 9-digit number. ## Blocks This plugin provides 1 block. * Sign in with TaxisNet ## Installation 1. Install and activate the plugin. 2. Go to Settings Civipass and copy the return address. 3. Submit an OAuth2 Service request in the EDA (https://www.gsis.gr/dimosia-dioikisi/ ked/EDA) with that address for the pilot and for production. 4. When the request is approved, set a password for the pilot in the EDA and enter the EDA username and that password in Settings Civipass. Press “Test the connection”. 5. Test the sign-in on the pilot; after the GSIS starts production, enter the production credentials and switch the environment to Production. For stronger protection, copy the `CIVIPASS_KEY` line shown in Settings Civipass into wp-config.php. ## FAQ ### Can a private company use it? No. The GSIS gives this service only to bodies of the public and wider public sector. The plugin works only with credentials that the GSIS issued to your body. ### Does the site see the TaxisNet password? No. People type it only on the GSIS pages. ### Which details does the site receive? Tax number, first and last name, and for natural persons father’s name, mother’s name and year of birth. Civipass keeps the tax number (encrypted) and the first and last name; the rest only if you turn that on. ### Can someone take over an administrator account with TaxisNet? No. Accounts that can manage the site cannot sign in with TaxisNet unless an administrator turns that on, and a tax number can be linked to one account only. ### Does our body have to log the sign-ins? Yes. The ministerial decisions that grant the oAuth2.0 service (for example ΥΑ 36695/ 2026, Β΄ 6269, article 2) oblige every body to take and keep appropriate technical and organisational security measures, and as a minimum to record and monitor access and ensure traceability. They also allow the received details to be used only for the purpose stated in the decision. Civipass itself does not keep a log of sign-ins: the body has to cover this obligation another way, for example with an activity-log plugin or the server’s access logs. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Civipass” is open source software. The following people have contributed to this plugin. Contributors * [ Perforks ](https://profiles.wordpress.org/jbosnakis/) [Translate “Civipass” into your language.](https://translate.wordpress.org/projects/wp-plugins/civipass) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/civipass/), check out the [SVN repository](https://plugins.svn.wordpress.org/civipass/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/civipass/) by [RSS](https://plugins.trac.wordpress.org/log/civipass/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First version. ## Meta * Version **1.0.0** * Last updated **10 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [Greece](https://wordpress.org/plugins/tags/greece/)[gsis](https://wordpress.org/plugins/tags/gsis/) [login](https://wordpress.org/plugins/tags/login/)[oauth](https://wordpress.org/plugins/tags/oauth/) * [Advanced View](https://wordpress.org/plugins/civipass/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/civipass/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/civipass/reviews/) ## Contributors * [ Perforks ](https://profiles.wordpress.org/jbosnakis/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/civipass/)