=== Attributes User Access ===
Contributors: attributeswp
Tags: custom login, login page, registration, authentication, redirect
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.0.0
License: GPLv3 or later
License URI: https://www.gnu.org/licenses/gpl-3.0.html

Custom login, registration and account pages with role-based redirects for WordPress. Developer-friendly; Pro adds 2FA, security and more.

== Description ==

**Attributes User Access** replaces the generic `wp-login.php` screen with fully branded, on-theme **login, lost password, password reset and registration pages** — built with shortcodes or blocks, and completely compatible with WordPress core.

It is a lightweight, developer-friendly authentication toolkit: you get clean front-end forms, flexible role-based redirects, and template overrides, without a page builder and without touching WordPress core.

= Why site owners use it =

The default WordPress login page sends every visitor to an unbranded `/wp-admin/` screen. Attributes User Access lets you serve a login and registration experience that matches your site, control exactly where each role lands after signing in, and keep everything update-safe.

= Free features =

* **Custom authentication pages** — Login, Lost Password, Reset Password and Registration, as shortcodes or blocks.
* **Redirect the native login** — send `wp-login.php` requests to your own branded pages.
* **Role-based & context-aware redirection** — define where users go after login and logout, per role.
* **Theme template overrides** — copy any form template into your theme (`your-theme/attributes/front/forms/login-form.php`) for full markup control; overrides survive updates.
* **Built for developers** — PSR-4 autoloading, object-oriented, extensible with action and filter hooks (e.g. `attrua_login_form_fields`, `attrua_after_login_form`).
* **Lightweight by design** — selective asset loading, transient caching, and minified production assets.
* **Update-safe** — adapts to WordPress core changes so your login pages keep working.

= Upgrade to Attributes User Access Pro =

Pro turns the plugin into a complete authentication, security and user-management suite — the kind of stack most sites assemble from five or six separate plugins (login customizer, 2FA, IP firewall, audit log, SMTP, password policy, maintenance mode), unified in one.

* **Member pages** — Account, Profile, Settings and Onboarding flows.
* **Visual Form Builder** — 20+ field types with validation, conditional logic, storage mapping to WordPress user columns/meta, and dynamic default-value tokens.
* **Authentication methods** — Two-Step (2FA), Passwordless email login, and Social OAuth sign-in.
* **Security** — IP blocking (single IP, CIDR range, IPv6, with expiry), reCAPTCHA, and a password policy (complexity, expiration, history).
* **Audit log** — 50+ security events across categories, retention control and CSV export.
* **Registration control** — email verification, disposable-email blocking and domain validation.
* **Email & SMTP** — Gmail / Google Workspace and Microsoft 365 via OAuth2, App Password, Resend or custom SMTP, plus templated emails and broadcast messaging.
* **Maintenance mode** — proper 503 response, role/IP whitelist, bypass URL and scheduling.
* **Block Editor & Elementor** — native form widgets with full style controls.
* **Emergency admin access** — an anti-lockout safeguard for administrators.

Learn more and view pricing at [attributeswp.com](https://attributeswp.com/). All Pro plans include updates, support and a 30-day money-back guarantee.

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/attributes-user-access/`, or install it through the **Plugins > Add New** screen in WordPress.
2. Activate the plugin through the **Plugins** screen.
3. Go to **User Access** in the admin menu to create your login, registration and password pages.
4. (Optional) Set your role-based redirects and, if you use a page builder, drop the Attributes blocks or shortcodes onto your pages.

== Frequently Asked Questions ==

= Will this work with my theme? =
Yes. The forms are built to work with any properly coded WordPress theme and adapt to your theme's styling. Developers can also override the templates from within the theme for complete control.

= Do I need coding knowledge? =
No. Custom login pages, registration and redirects are set up from the admin with a few clicks. Developers get extensive hooks and filters for deeper customization.

= Which WordPress version is this tested with? =
This release is tested up to WordPress 7.1 and follows WordPress coding standards. We update regularly to track new WordPress releases.

= What is the difference between the free plugin and Pro? =
The free plugin covers custom login, registration and password pages plus role-based redirects. Pro adds a visual form builder, two-factor and passwordless authentication, IP blocking, an audit log, SMTP, password policies, maintenance mode and more. See [attributeswp.com](https://attributeswp.com/).

= Does it replace or break the default WordPress login? =
It redirects the native login to your custom pages while keeping standard WordPress authentication intact underneath, so nothing in core is modified.

== Screenshots ==

1. Branded custom login page rendered on the front end.
2. Registration form with role-based redirection settings.
3. Role and redirect configuration in the admin.
4. Template override structure for developers.

== Changelog ==

= 2.0.0 =
Core and Pro are published together as 2.0.

* Fixed: a broken installation — an upload that stopped halfway, a restored
  backup — switches the plugin off with a notice instead of taking the site
  down with it.
* Fixed: a refused sign-in says why. Any error the extensions raise — a
  password policy, a reCAPTCHA challenge, a second factor — reached the form as
  "An unknown error occurred". The sentence it was given is now shown. The key
  used to carry that sentence was drawn from an alphabet the reader lowercased,
  so it almost never matched and the generic message showed regardless; the two
  now agree.
* Removed: two public AJAX endpoints, attrua_check_username and
  attrua_check_email, that answered "does this account exist?" to anyone with no
  limit of any kind. Nothing called them — the registration form makes no such
  request — and the Pro extension already dropped its own copies for the same
  reason.
* Fixed: the emergency access link that reaches wp-login.php exchanges its token
  for a short-lived cookie and comes back without the token in the address,
  where it would otherwise sit in access logs, browser history and Referer
  headers. When Pro is active, every use and refusal is written to the audit
  log. It declines the redirect to a custom login page and nothing more — a
  second factor still applies.
* Changed: the nonce-refresh endpoint, which hands a fresh sign-in nonce to a
  cached login page, is served to signed-out visitors only. Its logged-in
  registration handed a session-bound nonce to any page that could make the
  browser ask, and served nobody — someone already signed in is not looking at
  a sign-in form.
* Removed: a decorative nonce on the settings tabs. It protected nothing — the
  tab was already chosen before it was checked — and expired, so a bookmarked
  tab URL stopped working after a day.
* Added: the plugin speaks five languages — French, Spanish, Simplified
  Chinese, Japanese and Traditional Chinese (Taiwan).
* Changed: the footer of the plugin's own admin screens reports the state of
  the site — authentication pages live, wp-login.php, registration — instead of
  asking for a review. Each fact links to the screen that changes it.
* Changed: the download is a third of the size, 3.31 MB down to 1.14 MB. The
  icon font shipped in three formats and browsers only ever requested one.
* Changed: the version is read from the plugin header alone. It used to be
  written a second time as a constant, and the two could disagree.
* Fixed: after an update, "Create Page" could do nothing. The admin script's
  address carried the WordPress version instead of the plugin's, so browsers
  and caches kept serving the previous copy. Each file's address now changes
  with the package.
* Fixed: the Elementor widget's Max Width setting was ignored at 380px and
  below.
* Changed: the admin screens no longer advertise the Elite plan. The
  "WooCommerce Pages" rows and the Elite card of the "Unlock More with
  Attributes User Access" section are held back — they promised a tier that
  does not ship yet. Nothing was deleted; both come back from one switch. The
  Pro half of that section still appears on a site running Core alone.
* Maintenance: two .bak copies and a dead redefinition of the version constant
  in uninstall.php are gone.

Everything else in this release is on the Pro side; see its changelog.

= 1.3.0 =
* Compatibility: tested with WordPress 7.0.
* Maintenance: regenerated all minified assets from original sources.
* Maintenance: improved asset loading consistency across admin and front end.

== Upgrade Notice ==

= 2.0.0 =
Published together with Pro 2.0. If you run the Pro extension, read its upgrade
notice first: three of its security switches start enforcing what they promised.

= 1.3.0 =
Compatibility update for WordPress 7.0 plus asset-loading fixes. Recommended for all users.
