Understand how VentraConnect links provider identities to existing WordPress users and avoids unnecessary duplicate accounts.
Social Login is not only about creating new users. A large part of the login flow is safely identifying whether the provider account belongs to an existing WordPress user.
This guide covers:
- Linked provider identities
- Existing-user matching
- Verified-email matching
- Avoiding duplicate accounts
- What happens when a safe match cannot be made
- Managing linked identities
- How Guardrails affect new-user creation
How Social Login Identifies a User
When a user authenticates with a Social Login provider, VentraConnect receives an identity from that provider and uses it to determine which WordPress user should be authenticated.
Linked Provider Identities
Once a provider identity is linked to a WordPress account, that provider can be used to authenticate the same user on future logins.
Preferred path: authenticate using the already-linked provider identity whenever possible rather than trying to rematch the user on every login.
Users can manage linked Social Login identities through the profile/account experiences provided by VentraConnect.
Matching an Existing WordPress Account
If the provider identity has not been linked before, VentraConnect may need to determine whether the person already has a WordPress account.
Email alone is not enough if the provider has not explicitly indicated that it is verified. VentraConnect Free v1.4.4 hardened this behaviour to prevent unsafe account matching.
Verified Email Matching
VentraConnect only uses provider email data for account matching when the provider gives a trusted, explicit verified-email signal.
This reduces the risk of linking a Social Login identity to an existing WordPress account based only on an email address that the provider has not confirmed as trusted.
Avoiding Duplicate Accounts
If a person already has a WordPress account, the correct result is usually to authenticate or safely link that existing account rather than create a second user.
If an existing user cannot sign in with Social Login:
- Confirm the provider identity is linked to the expected WordPress user
- Confirm the provider returned the expected email address
- Confirm the provider explicitly marks that email as verified when email matching is required
- Check whether the user already has a different provider identity linked
- Review VentraConnect diagnostics before creating another WordPress account
Do not create a duplicate user as the first troubleshooting step. Fix the provider link or account match instead.
When a Safe Existing-User Match Cannot Be Made
If VentraConnect cannot safely associate the provider identity with an existing WordPress user, it should not force an account match.
Social Login does not use the Magic Link / Email OTP Login Only / Login & Register selector. Its account-creation behaviour follows Guardrails and the surrounding flow.
Managing Linked Social Accounts
VentraConnect provides account/profile experiences for users to manage their linked Social Login identities.
This is especially useful for users who want to connect more than one supported provider to the same WordPress account.
Account linking should always preserve the existing WordPress user. The goal is to attach another trusted sign-in method, not create a second profile for the same person.
Account Linking vs Account Creation
Keep these concepts separate. A provider button appearing on a login form does not automatically mean that form should create a new account.
Test Existing-User Linking
Recommended test:
- Create or use an existing WordPress test account
- Use a provider account that returns the expected trusted identity
- Test Social Login while logged out
- Confirm the correct existing WordPress account is authenticated
- Confirm a duplicate WordPress user is not created unnecessarily
- Log out and use the same provider again
- Confirm the already-linked identity authenticates the same WordPress user
- Test new-account behaviour separately on a surface where registration is intentionally allowed
