Two-Site WordPress SSO Setup

I’m spinning up two fresh WordPress instances: the primary site at X.pl and a sub-site at Y.X.pl. Each install will keep its own content—regular blog posts plus several custom post types—along with independent themes and plugins. What I need is a rock-solid bridge between them so every visitor enjoys a single account and a seamless login experience across both URLs.

Here’s the workflow I have in mind:

• Deploy clean WordPress cores on the domain and subdomain, each with its own content tables yet pointing to the same wp_users and wp_usermeta tables.
• Align table prefixes (e.g. wp_) so roles and capabilities remain in sync.
• Configure SSO using the specific plugin stack I’ll share with you—shared salts, keys, and a common COOKIE_DOMAIN (.X.pl) plus identical COOKIEHASH values. A logout from either site must terminate the session everywhere.
• Enforce HTTPS on both hosts and apply the correct Secure/SameSite flags to every auth cookie.
• Provide a short, clear hand-off document outlining what was changed, how to back up the split database structure, and the safest way to run future core, plugin, or theme updates without breaking the shared user table.

If you’ve handled multi-site or multi-domain SSO before and can deliver clean, maintainable code plus concise documentation, let’s get this running smoothly.