Security & Compliance

The Security & Compliance screen centralizes WPsigner’s signing gates and evidence settings. Use it to decide when signers must verify an email, complete KYC, enter an access code, and which cryptographic evidence is added to completed documents. A separate per-signer option can also require a matching WordPress login before the signing page opens.

Lite limits

Lite includes email OTP, access codes, audit trail, and local timestamps. KYC integrations, extra OTP channels, and external TSA are Pro. Lite vs Pro

Open WPsigner → More → Security & Compliance.

Caution

These controls strengthen authentication and evidence. They do not by themselves certify a signature as qualified, guarantee compliance, or replace legal advice for your jurisdiction and use case.

Signing gate policies

OTP, KYC, and access codes each support three policies:

Policy	Behavior
Always	Require the gate for every applicable signing request
Per document	Require it only when enabled in that document’s Review step
Off	Do not apply the gate

With Per document, review each document before sending and enable only the controls required for that transaction.

Email verification (OTP)

OTP verifies that the signer can receive a one-time code through a configured channel.

Method	Requirement
Email	Working WordPress email delivery
SMS	Configured Twilio integration
Both	Email delivery and Twilio

Test email and SMS delivery before requiring OTP in production. A failed delivery can prevent the signer from continuing.

WPsigner rate-limits OTP requests and verifies them through protected AJAX actions. If a firewall plugin blocks OTP, check System Status and allowlist the WPsigner actions it reports.

Identity verification (KYC)

KYC uses the Didit.me integration to verify a government-issued ID, selfie match, and liveness result before signing.

1. Configure and test Didit under WPsigner → More → Integrations → Didit.
2. Return to Security & Compliance.
3. Choose Always, Per document, or Off.

The KYC policy is unavailable or ineffective until Didit credentials are configured. WPsigner stores verification status and decision metadata; identity images remain with Didit.

Access codes

An access code is a six-digit secret associated with the signing request. The stored code is hashed rather than saved in readable form.

When access codes are required:

1. WPsigner generates or accepts the document’s code.
2. Choose whether WPsigner should email the code to signers.
3. The signer must enter the code before continuing.

For stronger separation, deliver the signing link and access code through different channels.

WordPress login (per signer)

This gate is opt-in per signer and off by default. It is not a global Security & Compliance policy and it does not replace OTP, KYC, or access codes.

When Require WordPress login with this email is checked on a signer:

1. The visitor must be logged in to WordPress.
2. The logged-in account email must match that signer’s email (case-insensitive).
3. The unique signing link is not enough on its own.

If nobody is logged in, the signing page asks them to log in and then returns to the same link. If they are logged in with a different account, they see that mismatch and can log out, then log in as the matching user.

Use this when the signer already has a WordPress account on your site (members, staff, LMS users). The checkbox is refused if that email is not a WordPress user — create the account first, or leave the option off. Leave it off for guests and external counterparties. Public campaign links and Bulk Send CSV rows do not use this gate — those flows have no preassigned WordPress user.

You cannot activate a public campaign on a document that already has a gated signer, and you cannot turn the checkbox on while that document has an active campaign. If someone still reaches a public link and types a gated signer’s email, WPsigner re-checks the login requirement and refuses the signature until the matching WordPress account is signed in. Individual signing links for a gated signer are never redirected to the campaign URL.

The invitation email adds a short note when the flag is on. Customized email templates need the require_wp_login variable if you want that sentence in your own copy.

Evidence capture

Control	Evidence added
Capture geolocation	Approximate signer location when permission and browser support allow
Capture device information	Browser/device metadata in the audit record
Digital ID (PKI)	Cryptographic PDF certificate signature
Timestamp provider (TSA)	Trusted time evidence for the document hash
Immutable timestamping	Additional configured timestamp evidence

Geolocation may be unavailable when the signer denies permission, the browser blocks it, or the network obscures the location.

Compliance score

The screen displays an orientation score based on selected controls:

Factor	Maximum contribution
OTP policy	25
Geolocation	10
Device information	5
Custom Digital ID certificate	10
Timestamp provider	Up to 50

KYC and access codes are important gates but do not currently add points to this score.

Displayed level	Score / conditions
SES	0–39
SES+	40–64
AdES	65–79
HA (QES-oriented)	80+ plus an active PKI certificate and qualified/custom TSA

The score is configuration guidance, not a legal classification or QES certification. A true Qualified Electronic Signature depends on regulated identity, certificate, provider, and jurisdictional requirements outside a score.

Recommended profiles

Routine internal acknowledgement

• OTP: Per document
• KYC: Off
• Access code: Off or Per document
• Device information: On
• Geolocation: Based on privacy policy
• Audit trail and secure backups: On

Higher-risk external agreement

• OTP: Always
• KYC: Per document or Always
• Access code: Per document
• Device and geolocation evidence: On where lawful
• Commercial certificate and reliable TSA

Document the reason for each control and avoid collecting more personal data than necessary.

Before enabling a gate globally

1. Send a test document to accounts you control.
2. Test on desktop and mobile.
3. Confirm SMTP, Twilio, Didit, and TSA connectivity as applicable.
4. Verify the final PDF and audit trail.
5. Publish signer-facing privacy and support instructions.
6. Define retention and deletion policies for collected data.

Troubleshooting

KYC cannot be enabled

Configure and test Didit first. The KYC gate only operates when the integration is available.

SMS is unavailable

Install and configure the WPsigner Twilio integration, then reload the Security & Compliance screen.

OTP requests fail

Check SMTP, spam filtering, caching, and security-plugin logs. Use WPsigner → More → System Status to test email and identify blocked AJAX actions.

Signers are unexpectedly asked for a gate

Check both the global policy and the document’s Review settings. Always overrides per-document choice; Per document follows the document’s saved security settings.

The score is lower than expected

Confirm the Digital ID is active and the selected TSA provider is recognized. KYC and access codes do not increase the current score.

Require WordPress login cannot stay checked

The signer email must already belong to a WordPress user. Create that account first, or leave the option off. WPsigner does not create users.

You also cannot turn the checkbox on while the document has an active public campaign, and you cannot activate a campaign if any named signer already has the gate on.

Signer sees a WordPress login page instead of the PDF

That row has Require WordPress login with this email on. They must sign in with the WordPress account that uses the same email, then they return to the signing link. A different logged-in account is rejected.

Related guides

• Creating Documents — user picker, Add me as signer #1, and the checkbox
• Didit.me KYC
• Digital ID
• Timestamping
• Audit Trails
• System Status, Storage & Retention