Bang! Invites - Invite People to Register by Email
| 开发者 | bangplugins |
|---|---|
| 更新时间 | 2026年8月14日 19:53 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Invite one or several people at once by email.
- Choose the role new registrants receive.
- A branded, editable invitation email with a secure one-click link.
- A registration form via the [banginvites_form] shortcode, with optional auto-login and a redirect of your choosing.
- A welcome email and a team notification on each new registration.
- Tracking list with resend, regenerate-link, copy-link, delete and bulk delete.
安装:
- Upload the plugin through Plugins > Add New > Upload, or copy the
bang-invitesfolder to/wp-content/plugins/. - Activate it.
- Create a page containing the shortcode [banginvites_form].
- Under Bang! Invites > Settings, choose that page, the default role, and where people go after registering.
- Send your first invitation from the Invite tab.
屏幕截图:
常见问题:
A used invitation link still shows the registration form
That is a page cache serving an old copy of the registration page. The plugin sends no-cache headers, sets the DONOTCACHEPAGE constant, and sets a cookie on invite-link requests, which prevents caching on virtually all hosts and caching plugins. If your host's cache still stores the page, add your registration page (e.g. /portal-setup/) to the host's cache exclusion list (on 20i: StackCache > Cache Exclusions) and purge the cache once.
Do invited people need an existing account?
No. The invite link lets them create one. If they already have an account, they are told to log in instead.
How long is a link valid?
14 days by default, configurable from 1 to 365 days under Settings.
Can a link be reused?
No. A link is single-use and is consumed when the account is created.
Can an invited person choose their own role?
No. The role is chosen by an administrator when the invitation is sent, stored on the server, and never read from the visitor's request. For security, invitations can only assign low-privilege roles: no role that can edit or publish content, or manage the site, is ever offered or applied. The check is capability-based rather than a fixed list, so custom roles work too - any low-privilege role on your site, whether registered by a membership or LMS plugin or created by you, appears in the role selector automatically. To give someone a higher role such as Editor, invite them and then promote their account under Users once they have registered. The role is checked again at the moment the account is created.
Can I use my own registration form, or another registration plugin?
Yes. Under Settings, switch "Registration form" to "I'm using another registration plugin", then put that plugin's form on your registration page instead of the [banginvites_form] shortcode. Invite links, expiry, single-use enforcement and tracking all carry on working exactly as before. An invitation is marked accepted when a new account is created using the email address it was sent to, so the person does need to register with the address you invited.
Can I invite several people at once?
Yes. Paste in as many addresses as you like, separated by commas, semicolons, spaces or new lines. Everyone in one batch gets the same role. Afterwards you get a breakdown showing what was sent, what was skipped because an account already exists, and anything that could not be emailed.
What happens when an invitation expires?
The link stops working and the person is told to ask for a new one. On the Tracking tab you can either "Resend", which emails a fresh link, or "New link", which mints one for you to copy and pass on yourself. Both replace the old link, so the previous one stops working straight away.
The invitation email did not arrive. What now?
Invitations go out through the standard WordPress mail function, so if your site struggles to send email at all, invitations are affected like everything else. An SMTP plugin is the usual fix. In the meantime, every pending invitation on the Tracking tab has a "Copy link" button, so you can send the link yourself by any means you like.
Can I change what the emails say?
Yes. The invitation email and the welcome email each have their own tab with a full editor and an editable subject, plus click-to-insert tokens for the registration button, the plain link, the expiry date, the person's name and more. You can also set the From name, From address and Reply-To.
What username do invited people get?
One is made for them from the first and last name they enter, for example john.smith, with a number added if that name is already taken. If no name is available it falls back to the part of their email address before the @. They can sign in with either the username or their email address.
Does it work with membership, LMS or client-area plugins?
Yes. The role list is worked out from what each role can actually do rather than from a fixed list of names, so any low-privilege role on your site appears in the role selector automatically, whether you created it yourself or another plugin registered it.
How secure is an invitation link?
Each link carries a 20-character code from WordPress's own secure generator. It only works when the code, the email address and the expiry all check out, and it is single use, consumed the moment the account is created. The role is read from the record on the server and never from the link, and it is checked again at the moment the account is created.
Can I stop people reaching the registration page without an invitation?
Yes, and it is on by default. Anyone opening that page without a valid invitation sees a notice you can word yourself, rather than the form. Anyone who can create users is exempt, so you can still edit and preview the page while logged in.
What happens if I delete the plugin?
Deleting it from the Plugins screen removes its settings and its invitation records. Deactivating does not, so you can safely deactivate and reactivate. Accounts people have already created are left alone either way, they are ordinary WordPress users from the moment they register.
更新日志:
- Fixed: switching the welcome email off also stopped the team notification. Both emails were sent by one piece of code sitting behind the welcome email's on/off setting, so a site that turned the welcome off - as the help text suggests doing when another registration plugin sends its own - quietly stopped being told when anybody registered, with the notification addresses still saved and looking live. The two are now independent and each answers only to its own setting. If you have notification addresses saved and the welcome email switched off, those alerts will start arriving again after you update.
- The team notification now has its own on/off switch, on by default, and its addresses are edited one per row with an "Add another" button instead of one comma-separated field. Saved addresses are split into rows automatically, and an entry that is not a valid email address is flagged on screen rather than being ignored in silence.
- Naming and structure tidied for the plugin directory. The admin screen's page identifier now carries the plugin's own prefix, so it cannot collide with another plugin's menu. The old unprefixed registration shortcode has been removed - if you were using it, replace it on your registration page with [banginvites_form], which has always been the documented shortcode and behaves identically. The plugin's functions are no longer wrapped in existence checks, so a name collision surfaces as a clear error rather than quietly disabling part of the plugin.
- Invitations are now restricted to low-privilege, subscriber-like roles. No role that can edit or publish content (Contributor, Author, Editor) or manage the site (options, users, plugins, themes) can be assigned by an invitation link; membership and client-area roles built on read-level access are unaffected. The role is re-checked at the moment the account is created, so a tampered record or a role that later gained capabilities falls back safely to your default role. To give someone a higher role, invite them and promote their account under Users after they register.
- Registration is processed before the page renders rather than while the registration page is being output. On sites where the theme or a page builder (Elementor's image-loading module is one) sends output early, the post-registration login and redirect could previously fail with "headers already sent" warnings and the person would not be logged in or moved on. Handling it earlier removes that class of conflict.
- An accepted invitation can no longer be flipped back to Pending by generating a new link for it (previously possible from a stale Tracking tab). Send a fresh invitation instead.
- Every settings screen with more than one section now has an "On this page" index down the side that tracks where you are as you scroll and jumps to any section when clicked. Fields and help text fill the full width of the panel; below a narrow width the index becomes a row of pills above the content.
- Stronger cache prevention on invitation links, covering every class of cache: no-cache headers for standards-respecting caches and CDNs, the DONOTCACHEPAGE constant for WordPress caching plugins, a dedicated header for LiteSpeed servers, and a session cookie for platform caches that override the site's own headers (20i's StackCache among them) - the same layered approach WooCommerce uses to keep checkouts out of caches. A hint under the registration page selector and an FAQ entry cover the rare host cache that ignores all of these, where the page should be added to the host's cache exclusion list.
- Invitation links are never cached. Page caches were able to serve a stale copy of the registration page from before an invitation was accepted, so a used single-use link could keep showing the registration form to logged-out visitors. Requests carrying invite parameters, and the registration page itself, now send no-cache headers and set the DONOTCACHEPAGE constant that the major cache plugins respect.
- Re-inviting an address now clears its old accepted record too (previously only pending ones), so Tracking no longer shows a stale Accepted row beside the fresh Pending invitation.
- Deleting a WordPress user now clears their accepted invitation record, so Tracking never shows Accepted for an address with no account behind it. Pending invitations for that address are left live, so the person can use their link again.
- Housekeeping for the plugin directory. All admin and front-end CSS and JavaScript now goes out through WordPress's own enqueue system against a registered handle, instead of being printed as raw style and script tags. The admin's Inter font is served as four ordinary font files rather than being base64-encoded into the stylesheet on every page load, which is both lighter and no longer looks like obfuscated code to a scanner. Author details updated to Bang! Plugins.
- New admin logo: the "bang! invites free" artwork now heads the plugin screens.
- Settings tab tidy-up. The shortcode now appears exactly once, as a click-to-copy chip right under the registration page selector (it used to be mentioned three times, with copying possible only at the bottom); the Invite tab's setup reminder uses the same chip. Cards are reordered to follow the setup flow: Registration method, then the form's styling directly beneath it (so in external mode everything greyed out sits together), then invitation behaviour, then Pages - which now also holds the invitation-only protection toggle, since that protects the page, with the redirect and login destinations. In external mode the page hint now says to place your registration plugin's form there instead of the shortcode.
- Works alongside other registration plugins. A new "Registration method" choice at the top of Settings lets you say "I'm using another registration plugin": place that plugin's form on your registration page instead of the shortcode, and everything else keeps working. Invite links, expiry and tracking are unchanged; the moment the other plugin (or an admin) creates the account, the invitation is marked accepted, the invited role is applied, and the welcome and notification emails send. In this mode the page itself validates every invite link on load - a valid pending link shows the page, a used link shows "you have already signed up" with a Log in button, and an invalid or expired link shows a notice - so single-use enforcement no longer depends on the built-in form. Acceptance matches by the invited email address. Settings that belong to the built-in form (post-registration destination, auto-login, form styling) are greyed out, not hidden, while this mode is on.
- Review fixes. Silencing WordPress's own account emails no longer triggers PHP warnings from core on PHP 8 (the filter now returns a properly-shaped value). A custom post-registration destination on another domain now actually redirects there instead of silently falling back to the dashboard. Tracking no longer offers "Copy link" on an expired invitation, since that link is dead - use New link or Resend, which issue a fresh one.
- Clear "already signed up" handling on the registration page. Someone who revisits a used invite link now sees "You have already signed up - this invitation has been used" with a Log in button pointing at your chosen login page, instead of the generic invalid-or-expired notice. The same applies when an account already exists for the invited email even though the invite is still pending (e.g. registered another way). A logged-in visitor now gets a "Go to your client area" button pointing at your post-registration destination. All of these notices share one branded style, tinted from your registration-button colour. Earlier versions: the complete history back to 1.0.0 ships in this plugin's changelog.txt.