Attributes User Access

Attributes User Access replaces the generic wp-login.php screen with fully branded, on-theme login, lost password, password reset and registration pages — built with shortcodes or blocks, and completely compatible with WordPress core. It is a lightweight, developer-friendly authentication toolkit: you get clean front-end forms, flexible role-based redirects, and template overrides, without a page builder and without touching WordPress core. Why site owners use it The default WordPress login page sends every visitor to an unbranded /wp-admin/ screen. Attributes User Access lets you serve a login and registration experience that matches your site, control exactly where each role lands after signing in, and keep everything update-safe. Free features

• Custom authentication pages — Login, Lost Password, Reset Password and Registration, as shortcodes or blocks.
• Redirect the native login — send wp-login.php requests to your own branded pages.
• Role-based & context-aware redirection — define where users go after login and logout, per role.
• Theme template overrides — copy any form template into your theme (your-theme/attributes/front/forms/login-form.php) for full markup control; overrides survive updates.
• Built for developers — PSR-4 autoloading, object-oriented, extensible with action and filter hooks (e.g. attrua_login_form_fields, attrua_after_login_form).
• Lightweight by design — selective asset loading, transient caching, and minified production assets.
• Update-safe — adapts to WordPress core changes so your login pages keep working.

Upgrade to Attributes User Access Pro Pro turns the plugin into a complete authentication, security and user-management suite — the kind of stack most sites assemble from five or six separate plugins (login customizer, 2FA, IP firewall, audit log, SMTP, password policy, maintenance mode), unified in one.

• Member pages — Account, Profile, Settings and Onboarding flows.
• Visual Form Builder — 20+ field types with validation, conditional logic, storage mapping to WordPress user columns/meta, and dynamic default-value tokens.
• Authentication methods — Two-Step (2FA), Passwordless email login, and Social OAuth sign-in.
• Security — IP blocking (single IP, CIDR range, IPv6, with expiry), reCAPTCHA, and a password policy (complexity, expiration, history).
• Audit log — 50+ security events across categories, retention control and CSV export.
• Registration control — email verification, disposable-email blocking and domain validation.
• Email & SMTP — Gmail / Google Workspace and Microsoft 365 via OAuth2, App Password, Resend or custom SMTP, plus templated emails and broadcast messaging.
• Maintenance mode — proper 503 response, role/IP whitelist, bypass URL and scheduling.
• Block Editor & Elementor — native form widgets with full style controls.
• Emergency admin access — an anti-lockout safeguard for administrators.

Learn more and view pricing at attributeswp.com. All Pro plans include updates, support and a 30-day money-back guarantee.

2.0.0 Core and Pro are published together as 2.0.

• Fixed: a broken installation — an upload that stopped halfway, a restored backup — switches the plugin off with a notice instead of taking the site down with it.
• Fixed: a refused sign-in says why. Any error the extensions raise — a password policy, a reCAPTCHA challenge, a second factor — reached the form as "An unknown error occurred". The sentence it was given is now shown. The key used to carry that sentence was drawn from an alphabet the reader lowercased, so it almost never matched and the generic message showed regardless; the two now agree.
• Removed: two public AJAX endpoints, attrua_check_username and attrua_check_email, that answered "does this account exist?" to anyone with no limit of any kind. Nothing called them — the registration form makes no such request — and the Pro extension already dropped its own copies for the same reason.
• Fixed: the emergency access link that reaches wp-login.php exchanges its token for a short-lived cookie and comes back without the token in the address, where it would otherwise sit in access logs, browser history and Referer headers. When Pro is active, every use and refusal is written to the audit log. It declines the redirect to a custom login page and nothing more — a second factor still applies.
• Changed: the nonce-refresh endpoint, which hands a fresh sign-in nonce to a cached login page, is served to signed-out visitors only. Its logged-in registration handed a session-bound nonce to any page that could make the browser ask, and served nobody — someone already signed in is not looking at a sign-in form.
• Removed: a decorative nonce on the settings tabs. It protected nothing — the tab was already chosen before it was checked — and expired, so a bookmarked tab URL stopped working after a day.
• Added: the plugin speaks five languages — French, Spanish, Simplified Chinese, Japanese and Traditional Chinese (Taiwan).
• Changed: the footer of the plugin's own admin screens reports the state of the site — authentication pages live, wp-login.php, registration — instead of asking for a review. Each fact links to the screen that changes it.
• Changed: the download is a third of the size, 3.31 MB down to 1.14 MB. The icon font shipped in three formats and browsers only ever requested one.
• Changed: the version is read from the plugin header alone. It used to be written a second time as a constant, and the two could disagree.
• Fixed: after an update, "Create Page" could do nothing. The admin script's address carried the WordPress version instead of the plugin's, so browsers and caches kept serving the previous copy. Each file's address now changes with the package.
• Fixed: the Elementor widget's Max Width setting was ignored at 380px and below.
• Changed: the admin screens no longer advertise the Elite plan. The "WooCommerce Pages" rows and the Elite card of the "Unlock More with Attributes User Access" section are held back — they promised a tier that does not ship yet. Nothing was deleted; both come back from one switch. The Pro half of that section still appears on a site running Core alone.
• Maintenance: two .bak copies and a dead redefinition of the version constant in uninstall.php are gone.

Everything else in this release is on the Pro side; see its changelog. 1.3.0

• Compatibility: tested with WordPress 7.0.
• Maintenance: regenerated all minified assets from original sources.
• Maintenance: improved asset loading consistency across admin and front end.