Ready when the next guest is.
Free for the first 25 agreements a month. No card to start.
WordPress
A booking comes in, a guest needs to sign something, and somebody copies an address into another tab. The SignSealer plugin removes that step: put a form on a page with a block or a shortcode, and WordPress tells you who has signed. The signing, the evidence and the certificate stay with us, which is the point.
Version 1.0.1 is built and tested; it is not in the WordPress directory yet. Review there takes days to weeks. Ask and we will send you the plugin now — it is the same code, and it updates itself once the listing is live.
Connect the site once. After that it is a block on a page and a status you can read.
A SignSealer agreement block in the editor, or[signsealer_sign workflow="your-form"] if you prefer a shortcode. Your forms and their shortcodes are listed under Settings so you are not guessing at a name.
When somebody signs, SignSealer posts to your site and the plugin checks the signature, the freshness and whether it has seen that delivery before. WordPress keeps the id and the status, so a page can say whether a booking's waiver is done.
Every verified delivery fires signsealer_event. Hook it to close a task, unlock a download, mark an order, or message a host — the signature has already been checked before your handler runs.
Three limits on purpose. Each one is the reason a signature sent from WordPress is worth something later.
Signing happens on SignSealer's own pages. A canvas in WordPress posting an image to an API would make every line on the certificate untrue: the certificate says what the signing engine observed, and it cannot observe a drawing that arrived as a form field.
Ids, a status and a link. Restore a six-month-old backup of your site and nothing about any signature changes, because nothing about any signature was there. A record that a shared host can lose is a record that loses a dispute.
The connection is OAuth 2.0 with PKCE, scoped to one business, and you end it from your SignSealer account without touching WordPress. There is no credential on the site that reaches a second account.
Four steps, and the third is the one most plugins make you do by hand.
Add the plugin and activate it. It needs WordPress 6.4and PHP 7.4, and is tested to WordPress 7.1.
Register an application for the site in SignSealer, paste its id and secret once, and approve the scopes. The site gets its own credential, not your password.
Connecting registers the webhook endpoint and stores its signing secret for you. There is no address to copy between two screens and no secret to paste.
Drop the block on the page where people should sign. The form is the one you authored in SignSealer, so its text is the text the certificate commits to.
Written for the person who has to answer for it, not for the person who installs it.
| Question | Answer |
|---|---|
| What does it send you? | The template you chose, the values filled in, and the signer's name and email. It is listed field by field in the plugin's readme under External services, which the WordPress directory requires. |
| What does it keep on our site? | A document id, a status and a timestamp. Deleting the plugin removes them; it does not touch anything at SignSealer, because that is not the plugin's to delete. |
| Can a fake delivery mark something signed? | No. Every delivery is checked for an HMAC signature over the exact bytes sent, a five-minute freshness window, and whether it has been seen before. A rotation is handled: both signatures are offered and either passing is a pass. |
| Does it slow the site down? | Nothing runs on a page a visitor loads unless that page has the block on it. The admin lists are cached for five minutes. The plugin is about forty kilobytes and has no dependencies. |
| Will it work with WooCommerce? | Not yet, and it says so rather than half-doing it. The signsealer_event action is there now if you want to wire an order yourself; WooCommerce, the form plugins and the booking plugins are the next releases. |
Because the alternative is a signature that lives on a shared host.
A signing evidence chain must not depend on a server running thirty other plugins. Everything that makes a signature worth having — consent recorded as its own event before the signature, the document's exact text fingerprinted into every entry, a hash chain that breaks if anything is altered — happens on SignSealer and can be checked afterwards by anybody holding the certificate's code, without an account and without us.
What WordPress keeps is what WordPress is good at: a page, a booking, an order, and a status beside it.
The same agreement can start anywhere.
A form published through the plugin is the same form a member of staff can send by email or text, the same one a visitor can open from a QR code, and the same one that runs on a tablet at a counter. They are not four integrations — they are four doors into one workflow, and everything they produce lands on the same trail with the same certificate.
Free to install. You need a SignSealer account, and the free plan is enough to try it.
The plugin is free and open source, licensed GPL-2.0-or-later like WordPress itself. It is a client for a SignSealer account: the free plan covers a small number of documents a month, and the paid plans start where that runs out. Nothing about the plugin is a paid add-on.
SignSealer is a product of Mashdun LLC. The plugin is not affiliated with or endorsed by the WordPress Foundation or Automattic.
Free for the first 25 agreements a month. No card to start.