What is single sign-on (SSO)?

Single sign-on (SSO) lets you log in once with one account and then use several websites or apps without logging in to each one again. You probably use it already: a single login to your Google account gets you into Gmail, Drive, YouTube and Google Analytics.

When another website shows a "Sign in with Google" button, you can log in there with your Google account. You don't need to create a new username and password for that site.

How does single sign-on work?

Single sign-on works by letting one service, the identity provider, confirm who you are to other apps. The identity provider holds your account: for a "Sign in with Google" button, that's Google. The website or app you want to use doesn't check your password itself. It trusts the identity provider's answer instead.

When you click a single sign-on button, the app sends you to the identity provider. If you aren't logged in there yet, you enter your login details once. The identity provider then sends the app a token, a secure piece of data that confirms who you are, and the app lets you in. When you open another app that trusts the same identity provider, it sends you there too. The identity provider sees that you're already signed in and confirms you straight away, without asking for your details again.

What are the benefits of single sign-on?

The main benefit of single sign-on is fewer logins, but a business with staff gains more from it than one person does.

• Fewer passwords to remember. You keep one set of login details instead of a separate one for every app, so there's less reason to write passwords down.
• One place to manage access. With a business single sign-on service such as Okta, switching off one account removes that person's access to all the connected apps, for example when they leave your business.

Is single sign-on secure?

Yes, as long as the one account behind it is well protected. If someone gets into your SSO login, they could reach far more than one app. Criminals may try to trick people into giving their passwords away, for example with phishing emails that link to fake login pages.

For an important account like this, the UK's National Cyber Security Centre (NCSC) advises a strong password that you don't use for any other account. Putting three random words together is one way to create a secure password. The NCSC also advises turning on 2-step verification, also known as two-factor authentication (2FA). You then need a second step as well as your password, such as a code sent to your phone or email.

You don't need to change that password on a fixed schedule, only when you think someone else might know it. The NCSC advises against forced regular changes, because people then tend to choose new passwords that are only small variations of the old ones.

Single sign-on protocols: SAML, OpenID Connect and OAuth

A protocol is the agreed format the identity provider and the app use to pass your login between them. The names you'll meet are SAML (Security Assertion Markup Language), OpenID Connect and OAuth.

OAuth is in this list because OpenID Connect is built on it. OAuth on its own doesn't log you in, and OpenID Connect adds the step that tells the app who you are. As a user you don't pick the protocol. The app's owner chooses it when they set up logins for the app.

Single sign-on providers

For a business, the identity provider holds your team's accounts and connects them to the apps you use. Well-known SSO providers include Okta, Ping Identity and Microsoft Entra ID. Entra ID is the new name Microsoft gave to Azure Active Directory, and it's where your team's accounts live if you already use Microsoft 365. Google Workspace can also act as the identity provider for other apps. A dedicated service such as Okta charges per user per month, billed annually. For a small team, the provider you already have is usually the simplest place to start. Before you choose one, check which identity providers your apps support.

Single sign-on for your WordPress website

You can also use single sign-on for your own website. If your WordPress site runs on Hosting for WordPress, Advanced Login Protection lets you log in to WP Admin, the admin area of your site, with your control panel details. You have one less login to remember, because you don't need a separate WordPress username and password. Your WordPress login page is also harder to attack, because anyone who tries it is sent to our login page instead.

Advanced Login Protection is switched on by default for new 1-click WordPress installations. In the WordPress section of the control panel, you can switch Advanced Login Protection on or off for each installation. When it's on, you choose whether it applies to all users or to admin users only. If editors or customers also log in to your site, we recommend admin users only. They can then keep logging in with their own WordPress details.

Set up WordPress with your Control Panel login

To set this up for your own site, choose a Hosting for WordPress plan and install WordPress with 1-click. You can then open WP Admin straight from the WordPress section of the control panel.