Sarala Login Page – Social Login & Login Security
| 开发者 | nayan4321 |
|---|---|
| 更新时间 | 2026年11月10日 01:02 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Social login and registration: Google, Facebook, Apple, Microsoft, LinkedIn, X (Twitter), GitHub, Discord, Reddit and Yahoo.
- Forgery-proof logins: ID token signatures are checked against each provider's live public keys, so nobody can fake a social login to get into your site.
- WooCommerce login: My Account, registration and checkout (guests sign up and come back to checkout with their cart).
- Limit login attempts: lock out IP addresses after too many failed logins.
- Custom login URL: hide wp-login.php and wp-admin from bots.
- Force password reset: make passwords expire after a number of days.
- Login CAPTCHA: a simple math question on login and registration forms, no Google reCAPTCHA needed.
- Failed login log: every failed attempt with IP address, device and location.
- Connected accounts: users connect and disconnect social accounts from their profile.
- Shortcode
[sarala_login_page]to place the login buttons on any page, with any theme or page builder.
- Apple (Sign in with Apple)
- Microsoft (personal, work and school accounts)
- X (Twitter)
- GitHub
- Discord
- Yahoo
- Reddit (Reddit never shares email addresses, so people connect Reddit to an existing account from their profile and then log in with it)
- Buttons on the WordPress login and registration pages.
- Buttons on the WooCommerce My Account login and registration forms.
- Buttons at the top of the WooCommerce checkout, so guests can sign up or log in and come straight back to checkout with their cart kept.
- WooCommerce's own "create an account during checkout" option keeps working.
- A
[sarala_login_page]shortcode to place the buttons anywhere.
- If WooCommerce is active, every new sign-up becomes a Customer.
- If not, new sign-ups get the "New User Default Role" from Settings > General (Subscriber by default).
- Admins can change any user's role at any time from Users, as usual.
- Standard OAuth 2.0 / OpenID Connect with a one-time state value tied to the visitor's browser.
- Secrets are never shown again after saving.
- No tracking and no data sent anywhere except to the login provider the visitor chooses.
安装:
- Upload the
sarala-login-pagefolder to/wp-content/plugins/, or install the plugin from Plugins > Add New. - Activate the plugin.
- Go to Sarala Login in the admin menu.
- Open each provider you want, copy its Redirect URI into the provider's developer console, paste the keys back, and tick "Enable".
- Save. The buttons appear on the login, registration, My Account and checkout pages.
屏幕截图:
常见问题:
How do I add Google login to WordPress?
Install and activate Sarala Login Page, open Sarala Login > Settings, switch on Google and paste the Client ID and Client Secret from Google Cloud Console. The settings screen shows the exact steps and the redirect URI to copy. The "Continue with Google" button then appears on your login and registration pages, and on WooCommerce My Account and checkout.
Does it limit login attempts and stop brute-force attacks?
Yes. After 5 failed logins within 15 minutes (you can change both numbers) the IP address is locked out for 30 minutes, even if it then tries the right password. You can allow your own IP addresses, and see and unlock lockouts on the Failed logins screen.
Can I hide or change the wp-login.php URL?
Yes. Choose your own login address, for example example.com/my-login. Visitors who open wp-login.php or wp-admin without being logged in see your 404 page.
Can I force users to change their password regularly?
Yes. Turn on "Force password reset" and choose after how many days passwords expire, for every role or only some. Users with an expired password are emailed a link to choose a new one.
Does it work with my theme, Elementor or other page builders?
Yes. The buttons are added to the standard WordPress and WooCommerce forms, and the [sarala_login_page] shortcode works in any page builder, widget or theme.
Does Sign in with X (Twitter) give me the user's email address?
Yes, when you switch on "Request email from users" in your app on the X Developer Portal. Without it, people who already have an account can still connect X and log in with it.
Do I need WooCommerce?
No. Without WooCommerce, the buttons appear on the WordPress login and registration pages, and anywhere you use the shortcode.
What role do new users get?
Customer when WooCommerce is active, otherwise the default role in Settings > General. You can change a user's role any time. Developers can use the saralopa_new_user_role filter.
Can I stop new accounts being created?
Yes. Untick "Create a new account…" in the settings. Existing users can still log in with connected accounts.
Someone already has an account. What happens when they use Google?
If Google (or the other provider) confirms the same email address, they are logged into their existing account and Google is connected to it. If the provider has not verified the email, they are asked to log in with their password first and connect the account from their profile, which stops anyone from taking over an account with an unverified email.
Can guests sign up at checkout?
Yes. Guests see the buttons at the top of the checkout page. After signing up or logging in they return to checkout with their cart, and their name and email are filled in.
Where do people go after logging in?
Back to the page they came from when it is known (for example checkout), otherwise My Account for WooCommerce customers, the dashboard for editors and admins, or the home page. Developers can change this with the saralopa_login_redirect filter.
Can I change the security questions?
The four questions are 11 + 2, 7 + 9, 2 + 6 and 4 + 13; one is picked at random. You can turn the question off for login or registration in the settings.
What is the "Powered by Laghavi Digital" link?
A small link under the login buttons to the plugin's page. It is on when you install the plugin. To hide it, untick "Show a small Powered by Laghavi Digital link under the buttons" in Sarala Login › Settings › Login page URL.
更新日志:
- New: log in and sign up with GitHub, Discord and Yahoo, and log in with Reddit.
- Security: ID token signatures (Google, Apple, Microsoft, LinkedIn, Yahoo) are now checked against each provider's live public keys, and tokens issued in the future are refused.
- The "Powered by Laghavi Digital" link is on for new installs and links to the plugin page. Its setting is now under Login page URL.
- Upgrade links open the plugin page.
- New: sign up and log in with X (Twitter), using OAuth 2.0 with PKCE.
- New: limit login attempts. Lock out an IP address after too many failed logins, with an allow list, and see and unlock lockouts on the Failed logins screen. On by default (5 attempts in 15 minutes, 30-minute lockout).
- Clearer Google setup steps: no API needs to be enabled, and the app must be published.
- New: force password reset. Passwords can expire after a number of days, for all or chosen roles; users are emailed a link to choose a new one.
- New: a "Pro features" screen that shows what Sarala Login Page Pro adds (login page templates, super admin, activity log, per-role restrictions), with links to the Pro plans. Shown only on this plugin's screens and hidden when Pro is installed. Nothing in the free plugin is locked.
- Code names now use the prefix "saralopa". Settings, connected accounts and the login log are moved over automatically.
- First release: Google, Facebook, Apple, Microsoft and LinkedIn login and sign-up, WooCommerce My Account and checkout support, connected accounts, and a math question on login and registration forms.