Title: tlloancy Turn Relay Author: Thomas Lloancy Published: November 12, 2026 Last modified: November 13, 2026 --- Search plugins ![](https://ps.w.org/tlloancy-turn-relay/assets/banner-772x250.png?rev=3798744) ![](https://ps.w.org/tlloancy-turn-relay/assets/icon-256x256.png?rev=3798744) # tlloancy Turn Relay By [Thomas Lloancy](https://profiles.wordpress.org/tlloancy/) [Download](https://downloads.wordpress.org/plugin/tlloancy-turn-relay.1.1.0.zip) * [Details](https://wordpress.org/plugins/tlloancy-turn-relay/#description) * [Reviews](https://wordpress.org/plugins/tlloancy-turn-relay/#reviews) * [Installation](https://wordpress.org/plugins/tlloancy-turn-relay/#installation) * [Development](https://wordpress.org/plugins/tlloancy-turn-relay/#developers) [Support](https://wordpress.org/support/plugin/tlloancy-turn-relay/) ## Description WebRTC in the browser needs ICE servers. STUN discovers a public address. TURN relays the media when a direct path is impossible. coturn does that work. This plugin does not. **tlloancy Turn Relay** signs a username and a password that coturn accepts for a limited time (`use-auth-secret`). The shared secret stays on the server. Callers receive `iceServers` for `RTCPeerConnection` and leave `iceTransportPolicy` at ` all`. Other plugins, including a video plugin, call `tlloancy_turn_relay_get_ice_servers()` when a call starts. They do not collect a TURN host of their own. Publication is off until you turn it on. A published card is JSON. It never contains the shared secret. * **STUN only** — the card lists a `stun:` URL. * **Shared** — the card also lists the credential endpoint. Another site must present an invitation token. * **Private** — the card contains the class and nothing else. You can paste another site’s card URL. Private and loopback addresses are refused. The admin drawing measures latency in your browser with `RTCPeerConnection`. A figure advertised by the remote card is ignored. Step-by-step guides: `docs/USER-GUIDE.md` (English) and `docs/MODE-DEMPLOI.md` ( French). ### External services Nothing is contacted when you only issue credentials for your own coturn host. If an administrator pastes a card URL, the server fetches that HTTPS URL once. The request sends no secret and no visitor data. The response is limited to 8 KB and redirects are not followed. If an administrator then enables “During a call” on a shared node and stores that node’s invitation token, a call requests credentials from that node’s endpoint. The request sends the invitation token. It does not send your shared secret or the contents of the call. At most two nodes are asked. The diagnostics buttons resolve your own TURN host and open a TCP connection to its TLS port. They run only when an administrator clicks them. **Issue a test credential** also prints a QR code. The code opens a page on this site. That page runs the TURN test in the phone’s browser with a credential that expires in five minutes. The shared secret is not in the link. ## Installation 1. Upload the `tlloancy-turn-relay` folder to `/wp-content/plugins/`. 2. Activate **tlloancy Turn Relay**. 3. Open **Settings tlloancy Turn Relay**. 4. Enter the TURN host and a shared secret of at least 32 characters. The same secret is configured on coturn as `static-auth-secret`. 5. Leave publication off until you want another site to read a card. To keep the secret out of the database, define it in `wp-config.php`: ``` define( 'TLLOANCY_TURN_RELAY_SECRET', 'paste-a-long-random-secret' ); ``` ## FAQ ### Does this plugin relay audio or video? No. coturn relays the media. The plugin only signs credentials and, if you turn it on, publishes a card. ### Why do the credentials change? The password is visible in the browser. It expires. A fixed TURN user would keep working after someone copies it. An administrator sets the host and the secret once. Visitors never edit them. ### How does another plugin start a call? tlloancy_turn_relay_get_ice_servers() returns the list. In the browser, enqueue the helper and call `TlloancyTurnRelay.getIceServers()`. Guests are allowed by returning true from the `tlloancy_turn_relay_can_issue` filter. ### What is the invitation token? It is not the shared secret. A shared card tells another site where to ask for credentials. That request must include the token in the `X-Tlloancy-Turn-Relay-Token` header. The HMAC secret never leaves this server. ### How do I test the relay from another network? Open **Settings tlloancy Turn Relay**, click **Issue a test credential**, and scan the QR code with a phone on mobile data. The result `Relay` plus the public address means the phone reached coturn. ### Can I list every WordPress site that has the plugin? No. A site appears only after an administrator pastes its card URL, and only if that administrator has published the card. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “tlloancy Turn Relay” is open source software. The following people have contributed to this plugin. Contributors * [ Thomas Lloancy ](https://profiles.wordpress.org/tlloancy/) [Translate “tlloancy Turn Relay” into your language.](https://translate.wordpress.org/projects/wp-plugins/tlloancy-turn-relay) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/tlloancy-turn-relay/), check out the [SVN repository](https://plugins.svn.wordpress.org/tlloancy-turn-relay/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/tlloancy-turn-relay/) by [RSS](https://plugins.trac.wordpress.org/log/tlloancy-turn-relay/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * A five-minute phone test: the diagnostics screen prints a QR code that opens the TURN check with the test credential already loaded. #### 1.0 * Short-lived TURN credentials for a coturn server configured with `use-auth-secret`. * Optional public card, manual nodes, and an admin latency drawing. ## Meta * Version **1.1.0** * Last updated **22 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.4** * PHP version ** 8.1 or higher ** * Tags * [turn](https://wordpress.org/plugins/tags/turn/)[webrtc](https://wordpress.org/plugins/tags/webrtc/) * [Advanced View](https://wordpress.org/plugins/tlloancy-turn-relay/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/tlloancy-turn-relay/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/tlloancy-turn-relay/reviews/) ## Contributors * [ Thomas Lloancy ](https://profiles.wordpress.org/tlloancy/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/tlloancy-turn-relay/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://donorbox.org/wordpress-plugins)