On the wp-discourse Connection tab are you getting the ‘You are connected to Discourse!’ message?
If so, and you can’t get SSO working, are you using the DigitalOcean 1 click WordPress install? The last time I checked, it doesn’t install the php-curl extension. php-curl is required for SSO to work when HTTPS is enabled.
You can’t go wrong by installing it. This is a good guide: How To Install WordPress with LEMP on Ubuntu 16.04 | DigitalOcean
There is no Discourse login data saved on WordPress. The first time a user logs into Discourse from WordPress, Discourse checks if there is an existing user with the email address that is sent from Discourse. If there is, a SingleSignOnRecord is created for that user. The SingleSignOnRecord stores the user’s WordPress ID. On subsequent logins, the WordPress user’s ID is used to find the Discourse user. If a user without an account on Discourse logs in from WordPress, a new user and SingleSignOnRecord is created.
The biggest security risk in using SSO is if email addresses on the WordPress site are not being verified. The wp-discourse plugin checks whether or not an email address is verified. If it isn’t, it tells Discourse to send an activation email before the user is able to login to Discourse.