Koloshare

Koloshare puts a real intranet inside the WordPress site your business already has. There is no separate hosting to buy, no per-user pricing, and no data leaving your server. Files live in your Media Library, content lives in your database, and staff sign in on your own address. It was built for a trade supplier with a warehouse, a trade counter and vans, and it shows: everything is designed to work one-handed on a phone in a van as well as on a desk. What your team gets, free

• A file library that finds things. Nested folders, drag-and-drop uploads, PDF-first thumbnails, live search across titles and tags, grid and list views, full-screen previews for PDFs, images, video, audio, Word documents and spreadsheets, and one-tap sharing.
• A branded sign-in on your own address, with brute-force lockouts, signed download links and a staff role that cannot reach wp-admin. The full list is under Security below.

What the paid plans add

• A news feed (Standard). One place for everything the company announces, with a pinned lead story, bylines, featured images and department targeting so an article only reaches the teams it concerns. Articles can carry an optional AI-content disclosure.
• Urgent banners (Standard). When something cannot wait, a banner scrolls across the top of every screen until the moment you choose, and arrives without anyone reloading anything.
• A team directory (Standard). Staff cards with photos, departments, quick call and email actions, birthday and work-anniversary badges.
• An external contacts book (Standard). Suppliers, couriers and partners, with per-person contacts under each company.
• A What's new bell (Standard). New files, articles and Spotlight updates collect in a short list that survives a refresh. Open a row and it opens the item.
• Analytics (Standard). Downloads, views, logins and searches, scoped to intranet users only, with charts, CSV export and a manageable event log.

What the person running it gets The Command Centre is a single-screen admin app built for people who do not enjoy the WordPress dashboard: files and folders, tags, users, trash and every setting in one place, with the paid sections (news, banners, team, contacts, analytics, branding) appearing there when a plan includes them. A guided setup wizard on first activation gets a working intranet up in about ten minutes. Security

• A custom branded sign-in that never exposes wp-login.php
• Brute-force lockouts with a configurable threshold and duration
• 24-hour temporary passwords that must be replaced on first sign-in
• Signed, time-limited download URLs, so a copied link expires
• A dedicated Koloshare User role that can use the intranet and cannot reach wp-admin
• Self-healing when a cache serves a logged-in visitor a stale login page

Free, and what the paid plans add The free Starter tier is the private file library with no cap on it, and it is not a trial: folders, tags, document previews, search, share links, the branded sign-in, all of the security, the setup wizard and the Command Centre. The free plugin contains none of the paid code, so there is nothing in it waiting to be unlocked. Standard adds the news feed and emailing an article to every account, the What's new bell, urgent banners in your own colours, the team directory, the contacts book, the homepage background photo, multi-select with bulk download and share, download locks by department, and analytics. Premium adds custom branding (your logo, colours and a choice of 12 fonts), search inside PDFs and Office documents, a read-only Policies tab, per-file passwords, named-user file visibility, the Spotlight story builder, seasonal decorations, advanced analytics and email support from the Command Centre. Paid plans are sold per site, one price however many staff sign in, through Freemius. A licence installs the premium version over the top of the free one, sharing every file, setting and user. If it lapses nothing is deleted: the workspace drops back to the free tier, keeps every file and setting, and shows the news, team and contacts again when a licence returns. Hosting Koloshare stores everything in your existing WordPress site and does not provide its own backup utility. Before making it your team's single source of truth, check your hosting plan has enough storage for a growing file library, working automatic backups you have actually tested restoring, and upload limits big enough for your largest files.

1.7.2

• The Activity log opens again. Hiding it from the sidebar had unregistered it, so the page refused access and its charts never loaded.
• A site that filters in a self-hosted font no longer warns twice on every page load, and no longer asks Google for a font it does not use.
• Search terms, indexed document text and company contact details are sanitised as soon as they are read.
• The two search-index diagnostics send X-Content-Type-Options: nosniff alongside their plain-text content type.
• Document text is checked with wp_is_valid_utf8() on WordPress 6.9 and later, which replaced the deprecated seems_utf8().
• The setup wizard no longer prints a PHP deprecation above the page. It had been registered without a parent menu, so WordPress had no title to render.
• A fresh install opens the setup wizard again. The licence opt-in screen was consuming the one-shot redirect, so the wizard was silently skipped.
• Settings, Users and the two bulk tools open again. Hiding them from the sidebar had unregistered them, which broke the dashboard links and the password-help email.

1.7.1

• A font name supplied by another plugin through the branding filters is now restricted to what a CSS font-family accepts before it reaches the inline stylesheet.

1.7.0

• The plugin is now called Koloshare. Same plugin, new name: the old one was close enough to an unrelated project's to cause confusion.
• The free plugin no longer carries any licence or plan machinery. There is no licence key field, no feature table and no upgrade prompts. Everything it ships is simply available. Paid features live in a separate plugin, as they already did.
• The setup wizard drops its licence step. It now runs welcome, name, folders, intranet page, done.
• The remaining inline script and stylesheet blocks are enqueued through the WordPress asset API.
• The two administration tools for rebuilding the search index are signed now, in line with the others.

1.6.2

• Fixed: on the free plan, Continue on the setup wizard's "Logo & font" step reported that nothing had saved. The step is Premium-only and had nothing to save, but the free build had no handler answering it at all, so the wizard treated the empty reply as a failure. Skip was unaffected.
• Renaming a tag across the library no longer asks the database to count the rows it is about to rewrite.
• Housekeeping: a development-only patch file from the licensing SDK is no longer included in the download.

1.6.1

• The What's new bell is now part of Standard and Premium. It rings for new files, articles and Spotlight updates, and the articles and updates come with a paid plan, so the bell belongs with them.
• Seasonal decorations are now a Premium feature, and they work: a switch in Settings turns them on, a preview picker forces one theme for checking, and each person can turn them off from their account menu. The layer shipped in earlier versions without any way to switch it on.
• Nothing else on the free tier has changed.

1.6.0

• The free tier is now the file library with no cap on it. The ten-file limit has gone.
• Paid features ship in a separate premium version, installed through your Koloshare account when a licence is activated, rather than sitting locked inside the free plugin. The free plugin contains no paid code and makes no request to any outside service.
• The news feed, email broadcast and analytics move to Standard. On a free site, existing articles, team members and contacts stay in the database and are shown again the moment a licence is activated. Nothing is deleted.
• Free sites update in place. Paying sites are offered the premium version from the Plugins screen or their Koloshare account; installing it carries over every file, setting and user.

1.5.5

• Admin maintenance links (clear lockouts, re-run the search index, re-run setup) are signed now. They acted on a plain web address before, which meant an administrator could be made to fire one by following a link.
• The document-index diagnostic page is development-only, and no longer accepts a document password in the address bar, where it would have been written to the server log.
• Failed sign-ins are no longer written to the server log with the username attached.
• Documented what the plugin talks to and what it does with server tools like pdftotext, and where every bundled library came from.

1.5.4

• Six ready-made Spotlight arrangements instead of four, between them showing every block the builder offers. The recruitment one has gone: it only made sense to someone who did not work there yet.
• The arrangement picker fits the editor again. It was laid out in columns wider than the space it had, so the third one sat under the inspector panel.

1.5.3

• Spotlight introductions are centred again, and consecutive paragraphs have space between them. A typography reset was overriding both.

1.5.2

• The What's new bell rings again when a file is replaced. Swapping the document behind an existing entry counts as news; renaming, retagging or moving it still does not.

1.5.0

• Every third-party library now ships with the plugin instead of loading from a CDN. PDF.js and its worker, JSZip, Chart.js and docx-preview join SheetJS in the plugin itself, so the workspace works on a network that cannot reach a CDN and no executable code is fetched from anywhere else.
• The Starter upgrade reminder appears only on Koloshare's own screens, can be dismissed, and stays dismissed.
• The setup wizard no longer asks for a licence key it cannot use. Where the licence is managed by your Koloshare account, the wizard says so and links to it instead. Older entries are in changelog.txt, alongside the plugin.