manifest / security / recognition

Recognition

Privacy-first face recognition login for WordPress. No third-party APIs. No biometric data ever leaves your server. All recognition happens locally in the user's browser using TensorFlow.js and `face-api.js`

by JSS Web Solutions · github.com/jsswebsolutions/recognition · website

★ 1stars

0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/jsswebsolutions/recognition/archive/refs/heads/main.zip

Readme

🛡️ Recognition — Face Recognition Login for WordPress

Privacy-first, offline face recognition login. No third-party APIs. Your face never leaves your server.

Live Demo & Buy Now · GitHub Repo · License Activation · Report a Bug

📑 Table of Contents

Overview
Badges
Key Features
How It Works
Screenshots
Premium Add-ons
- WooCommerce Add-on
- QR Login Add-on
Installation
Requirements
Privacy & Security
GDPR Compliance
Frequently Asked Questions
Developer Documentation
Changelog
Roadmap
Support
Contributing
License
Links

🧠 Overview

Recognition is a privacy-first WordPress plugin that lets your users log in with their face — no passwords, no third-party APIs, no cloud services. All biometric processing happens locally on your server using TensorFlow.js and face-api.js.

Instead of storing a photo, the plugin extracts a 128-number mathematical descriptor from the user's face and stores it encrypted at rest. On login, the plugin generates a new descriptor and compares it locally — if it matches, the user is signed in.

🔐 Your face never leaves your server. Period.

Recognition ships with a powerful license manager that gates premium add-ons (WooCommerce, QR Login, and future extensions) through our licensing portal at license.jsswebsolutions.com.

🏷️ Badges

Badge	Purpose
	Current stable release
	Minimum WordPress version
	Minimum PHP version
	License type
	Local-only processing
	No external API calls
	CI status
	WordPress Coding Standards
	GitHub downloads
	GitHub stars
	GitHub forks
	Open issues
	Repo activity
	Made with love

💡 Generate more custom badges at shields.io/badges.

✨ Key Features

Feature	Description
🔒 Privacy-First	Biometric data is never sent to any third party. All processing is local.
🌐 Offline Operation	No external APIs, no cloud dependencies, no monthly fees.
👤 Easy Enrollment	Users enroll their face from their profile in seconds.
📱 Multi-Device	Enroll from webcam, phone camera, or any `getUserMedia`-capable device.
👁️ Liveness Detection	Eye-aspect-ratio (EAR) algorithm prevents photo and replay attacks.
🛡️ AES-256 Encryption	Descriptors are encrypted at rest with `AES-256-CBC`.
🚦 Rate Limiting	Per-IP and per-user rate limits protect against brute force attacks.
🧰 Brute Force Protection	Automatic lockouts and audit logging for failed attempts.
🇪🇺 GDPR Tools	Built-in Export and Erase tools for biometric data.
♿ Accessible	Full keyboard navigation and screen-reader support.
🎛️ Configurable Threshold	Tune the matching threshold (0.30–0.70) per site.
📊 Admin Dashboard	Stats, logs, users, and settings in one place.
🪪 License Manager	Server-side license validation for premium add-ons.
🧩 Premium Gates	Server-enforced sanitisation of premium-only settings.
🧪 WPCS Compliant	Follows the WordPress Coding Standards.
🌎 Translation Ready	`.pot` file shipped in `/languages`.

⚙️ How It Works

   ┌─────────────────┐                  ┌─────────────────┐
   │  User enrolls   │                  │  User logs in   │
   │  (signup page)  │                  │  (login page)   │
   └────────┬────────┘                  └────────┬────────┘
            │                                    │
            ▼                                    ▼
   ┌─────────────────┐                  ┌─────────────────┐
   │  Webcam capture │                  │  Webcam capture │
   │  (5–10 frames)  │                  │  (1 frame)      │
   └────────┬────────┘                  └────────┬────────┘
            │                                    │
            ▼                                    ▼
   ┌─────────────────┐                  ┌─────────────────┐
   │  face-api.js    │                  │  face-api.js    │
   │  → descriptor   │                  │  → descriptor   │
   │  (128 numbers)  │                  │  (128 numbers)  │
   └────────┬────────┘                  └────────┬────────┘
            │                                    │
            ▼                                    ▼
   ┌─────────────────┐                  ┌─────────────────┐
   │  AES-256-CBC    │                  │  Compare with   │
   │  encrypt + save │                  │  enrolled desc. │
   │  in WP DB       │                  │  (Euclidean)    │
   └─────────────────┘                  └────────┬────────┘
                                                 │
                                          ┌──────┴──────┐
                                          ▼             ▼
                                  ┌──────────┐   ┌──────────┐
                                  │  Match!  │   │ No match │
                                  │ Log user │   │ Fallback │
                                  │   in     │   │ to pwd?  │
                                  └──────────┘   └──────────┘

Enrollment — The user grants camera access and the plugin captures 5–10 frames.
Descriptor extraction — face-api.js converts each frame into a 128-number vector.
Encryption & storage — The descriptor is encrypted with AES-256-CBC and stored in the local WordPress database. No image is ever stored.
Login — On subsequent logins, the user clicks "Login with Face" and a single descriptor is generated.
Matching — The new descriptor is compared to the enrolled descriptors using Euclidean distance.
Decision — If the distance is below the configured threshold, the user is signed in. Liveness detection prevents photo attacks.

📸 Screenshots

Live previews coming soon on the landing page.

Login page with the new "Login with Face" button.
Face enrollment screen with a live webcam preview.
Admin dashboard with stats, recent activity, and license status.
Settings page with the matching-threshold slider.
User profile face-management section.
Audit log of authentication events.

🧩 Premium Add-ons

The Recognition plugin is free and open-source under GPLv2+. Premium functionality is delivered through licensed add-ons that hook into the core.

🛒 WooCommerce Add-on

Extend Recognition with full WooCommerce integration for passwordless customer login, checkout verification, and high-value order protection.

Highlights

🪪 Passwordless WooCommerce login — customers sign in with their face instead of a password.
🛒 Checkout face verification — verify the buyer's identity at checkout.
💰 High-value order protection — auto-require verification for orders above a configurable threshold.
📱 Trusted devices — skip verification on devices the customer has trusted.
📜 Order verification logs — every verification attempt is logged.
👤 My Account dashboard — customers manage trusted devices & history.
📊 Admin reports — comprehensive analytics for store admins.
🔌 REST API — full REST endpoints for third-party integrations.
🧱 Scalable architecture — built with hooks & filters for easy extension.

Source folder: frl-woocommerce-addon/ Requires: WordPress 6.0+, PHP 8.0+, WooCommerce 7.0+, Recognition core.

See add-on folder →

📱 QR Login Add-on

Highlights

🔐 256-bit cryptographic tokens (random_bytes() with wp_generate_password() fallback).
🧠 State machine lifecycle (pending → scanned → authenticating → authenticated → completed) prevents race conditions & replay attacks.
📡 Server-Sent Events for instant desktop notification, with AJAX polling fallback.
🎨 Branded modal with site logo, custom accent colour, and an animated success state.
⏱️ Countdown timer with automatic QR rotation on expiry.
🚦 Per-IP rate limiting using WordPress transients.
🔁 One-shot replay protection for both desktop and mobile tokens.
📚 Full audit log in a dedicated database table.
🛠️ Admin screens for Settings, Logs, Sessions, and Statistics.
👤 Customer self-service in WordPress profile and (optionally) WooCommerce My Account.
🧪 ~20 actions and filters for developers.
🌎 Translation-ready with a .pot file under languages/.

Source folder: frl-qr-login-addon/ Requires: WordPress 5.8+, PHP 7.4+ (PHP 8.1+ recommended), Recognition core.

See add-on folder →

📥 Installation

From the website (recommended)

Purchase a license at jsswebsolutions.com/recognition.
Download the plugin zip from your customer dashboard.
In WordPress admin, go to Plugins → Add New → Upload Plugin.
Upload the zip, click Install Now, then Activate.
Visit Recognition in the admin menu to configure settings.
Activate your license at license.jsswebsolutions.com and enter the key in Recognition → License.

From GitHub (development)

cd wp-content/plugins/
git clone https://github.com/JssWebSolutions/recognition.git

Then activate Recognition in the Plugins screen.

Manual

Download the latest release from the GitHub Releases page.
Unzip into wp-content/plugins/recognition/.
Activate via the Plugins screen.

🧪 Requirements

Requirement	Minimum
WordPress	6.0
PHP	8.0
MySQL / MariaDB	5.7 / 10.3
Browser	Chrome 90+, Firefox 88+, Safari 14+, Edge 90+
HTTPS	Required for camera access (except `localhost`)
Memory limit	256 MB recommended
Max execution time	60 s recommended

Read the full README on GitHub →