1. Getting started

1.1 What Attributes User Access does

Attributes centralizes everything around who can access your site and how:

• Branded authentication pages — custom Login, Lost Password, Password Reset, and Registration pages via shortcodes.
• Modern login methods — password, two-step (2FA), passwordless, and social login.
• Enterprise security — IP blocking, login throttling, reCAPTCHA, and a full audit log.
• Password policy — complexity, expiration, and reuse prevention.
• Member experience — Account, Profile, Settings, and Onboarding pages, a 20+ field visual Form Builder, and native Block Editor & Elementor form widgets (Pro).
• Communication — SMTP delivery, branded emails, and broadcast messaging.
• Site operations — role-aware, SEO-safe maintenance mode.

1.2 System requirements

1.3 Installation

Automatic (recommended) 1. In wp-admin, go to Plugins → Add New. 2. Search for Attributes User Access. 3. Click Install Now, then Activate. 4. Open User Access in the admin sidebar.

Manual 1. Download the plugin ZIP. 2. Go to Plugins → Add New → Upload Plugin. 3. Select the ZIP and click Install Now, then Activate.

1.4 Quick start (5 minutes)

1. Go to User Access in the sidebar to open the Login Page Manager.
2. On the Login row, confirm the page exists (or create it) and copy its shortcode [ attributes_login_form ].
3. Enable the Redirect toggle on the Login row so wp-login.php sends visitors to your custom page.
4. Repeat for Lost Password, Password Reset, and Registration.
5. Visit your login URL to confirm the branded form appears.

1.5 Free vs Pro

Free (WordPress.org): the four core authentication pages (Login, Lost Password, Password Reset, Registration), the wp-login.php redirect, role-based redirection, the template override system, and developer hooks.

Pro: everything else in this documentation — user pages, 2FA, passwordless, social login, IP manager, audit log, password policy, SMTP, broadcast messaging, maintenance mode, Form Builder, and more. Pro is licensed by number of sites (Personal / Developer / Agency).

1.6 Activating your license

1. Go to User Access → License.
2. Paste your license key and activate.
3. The status header shows Active, your Pro version, and expiry. All Pro features unlock immediately.

To move a license to another site, click Deactivate License first, then activate on the new site.

1.7 The admin interface

The plugin adds a User Access menu with two navigation layers:

• Tabs (top of the settings screen): Login, Authentication, Registration, User, Password Policy, Security, Notifications.
• Sidebar sub-pages: User Access, Form Builder, IP Manager, Audit Log, Broadcast Messaging, Maintenance Mode, License.

2. Login & authentication pages

2.1 The Login Page Manager

The Login Page Manager (User Access) lists your authentication pages in a table with columns for Page, Slug, Shortcode, Actions, and Redirect.

The four Core pages (available in Free) are:

2.2 Creating and managing a page

Each row gives you three actions:

• Edit Page — opens the page in the WordPress editor to add content around the form.
• View Page — opens the live page.
• Delete — removes the page (the shortcode still works if placed elsewhere).

Use the copy icon next to a shortcode to place the form on any page or widget area.

2.3 The redirect toggle

Each row has a Redirect toggle. When enabled, the default WordPress URL for that flow (for example wp-login.php) is replaced by your custom page. This hides the default WordPress login and keeps your branding consistent.

2.4 Shortcode parameters

The login form accepts parameters for fine control:

[ attributes_login_form redirect="/dashboard" remember="false"]

2.5 Pro: user pages

Pro unlocks four additional pages under User Pages, each with its own slug:

Build and customize these with the Form Builder (Chapter 8).

2.6 Template overrides (developers)

To fully control markup, copy a template from the plugin into your theme:

• Theme path: your-theme/attributes/front/forms/login-form.php
• Original: wp-content/plugins/attributes-user-access/templates/front/forms/login-form.php

The plugin automatically uses the theme copy when present, so overrides survive updates.

2.7 Block Editor blocks

Attributes registers four blocks under Attributes User Access in the block inserter: Login Form, Lost Password Form, Reset Password Form, and Registration Form. No shortcode is required — the block renders the live form right in the editor.

Select the Login Form block to open its Settings panel:

• Redirect URL — where to send users on success (leave empty for the default).
• Style Preset — for example Card.
• Show Form Links and Show Remember Me toggles.
• Layout: Form Max Width, Form Padding, Form Border Radius, and Input Radius (all in px).
• Colors (hex): Form Background, Form Border Color, Button Background, Button Text Color, and Input Border Color.
• Form Shadow — for example Soft.

2.8 Elementor widgets

The same four forms ship as Elementor widgets under Attributes User Access: Login Form, Lost Password Form, Reset Password Form, and Registration Form. Drag a widget onto the canvas, then use the Style tab to control every part of the form through dedicated sections: Design System, Form Container, Labels & Headings, Fields, Field Errors, Checkbox, Submit Button, Links, and Messages.

3. Authentication methods

Open the Authentication tab to choose how users sign in. One method is active at a time.

3.1 Choosing a method

3.2 Two-Step (2FA) login

With Two-Step active, two display options control the second step:

• Show Avatar — shows the user's avatar after step 1.
• Show Display Name — shows the user's display name after step 1.

Enable 2FA enforcement itself under Security → Two-Factor Authentication (Chapter 5).

3.3 Passwordless login

Passwordless replaces the password prompt with an emailed link or code. Combine it with SMTP (Chapter 7) to ensure reliable delivery.

3.4 Social login

Under Social Login, enable Show social login buttons to display provider buttons on the login form regardless of the active method. Attributes supports OAuth 2.0 / OIDC providers such as Google, Facebook, and GitHub.

3.5 Admin Emergency Access

The Admin Emergency Access box provides a permanent, tokenized link:

http://your-site/wp-login.php?attrua_emergency=XXXXXXXX

This link always opens the classic WordPress password login, bypassing the active authentication method and the wp-login.php redirect — so an administrator can never be locked out. Bookmark it. Use Regenerate link if the token is ever exposed.

4. Registration & user settings

4.1 Registration methods

On the Registration tab, pick how new users register:

4.2 Username generation (Email Only)

When Email Only is active, choose how usernames are generated: From Email, Random, or Custom. Custom exposes:

• Prefix separator — underscore (myname_abc123), dash (myname-abc123), or none (mynameabc123).
• Default prefix (optional) — pre-fills a prefix such as user, member, or guest.
• Random part length — minimum and maximum character counts.

4.3 Email requirements

Reduce fake sign-ups with:

• Validate email domain exists — checks the domain resolves.
• Block disposable email addresses — rejects throwaway inboxes.
• Require email verification before login — users confirm before access.

4.4 Username requirements

Set a minimum length and optionally require uppercase, lowercase, or numbers. These rules apply to auto-generated usernames.

4.5 Role-based redirections

On the User tab, set default redirect URLs and per-role exceptions for three events: Login Redirections, Logout Redirections, and Registration Redirections. Set a default page for all roles, then click Add Role Exception for specific roles.

4.6 Backend access restriction

Under Backend Access, enable Restrict Backend Access to keep selected roles out of wp-admin. Choose the Allowed Roles (Editor, Author, Contributor, Subscriber); roles not selected are redirected to the front-end when they try to reach wp-admin.

4.7 Enabling maintenance features

Website Maintenance → Enable Maintenance Mode turns on access to maintenance features. Use the Maintenance Mode page or the admin-bar toggle to actually switch the site into maintenance (Chapter 7).

5. Security

Open the Security tab to configure protection for authentication and access.

5.1 Security modes

Choose a Security Mode to apply protections as a preset:

5.2 IP management

Toggle IP Blocking to block login attempts from suspicious IP addresses. Manage lists in IP Manager (sidebar):

• Blocked IPs / Allowed IPs tabs with live counts of active and expired entries.
• Add New IP, plus Import IPs / Export IPs for bulk management.
• Per-entry Added By, Added Date, Expiry Date, and Notes — entries can expire automatically.
• IP Management Tools: Clean Up Now (remove expired), Export All, and IP Lookup to check any address.
• Your Current IP is displayed so you never block yourself.

5.3 Two-factor authentication

Enable 2FA under Two-Factor Authentication → Enable 2FA to require a second verification step at login. Pair with the Two-Step authentication method (Chapter 3) for the front-end flow.

5.4 reCAPTCHA

Enable reCAPTCHA Integration → Enable reCAPTCHA to protect forms against spam and bot attacks. Add your reCAPTCHA keys to activate.

5.5 Audit logging

Enable audit logging to record security events, then review them in Audit Log (sidebar), where the header shows Total Events and Retention Days.

The log table. Filter by search term, Category, Status, and Event Type, and page through results (20 / 50 / 100 / 200 per page). Each row records Timestamp, Category, Action, User, IP, Device/Browser, and Status. Two links expand a row:

• View (in Device/Browser) — shows the full User Agent string.
• View All Details — shows the event payload: the changed option, its old and new value, and the source.

Settings. The Settings dialog controls Enable Audit Logging, the Log Retention Period (days, after which entries auto-delete), and exactly which Events to Log, grouped into categories:

• Authentication — successful login, failed login attempt, logout, and password reset requested / successful / failed.
• User Management — new registration, account deleted, role changed, created by admin, profile updated, email changed, and password changed.
• Security — security-related events.

Export. The Export Logs dialog outputs CSV for a chosen Date From / Date To range and one or more Event Types (leave All Event Types selected to export everything).

Clear. Clear All Logs permanently deletes every entry — login/logout records, registration history, security tracking, and IP block history. It requires an explicit confirmation checkbox and cannot be undone.

6. Password policy

Open the Password Policy tab and enable Enforce Password Policy to apply rules to all users.

6.1 Enforcement rules

• Minimum length — required character count (default 8).
• Character requirements — require uppercase, lowercase, numbers, and/or special characters.
• Disallowed values — block the username or email in the password, and check against a common-password list.

6.2 Reset behavior

• Reset token expiration — hours before a reset link expires (default 24).
• Reset notifications — email users when their password changes.
• Admin notifications — alert the administrator on suspicious reset activity.

6.3 Expiration

Enable Password Expiration to force periodic changes:

• Expiration period — days before a password expires (default 90).
• Expiration warning — days before expiry to start warning users (default 7).
• Grace period — days after expiry during which users can still log in but are redirected to reset (default 3).

6.4 Password history

Enable Password History to prevent reuse, and set Password History Size (default 5) — the number of previous passwords remembered and blocked.

7. Communication & site operations

7.1 Email notification settings

On the Notifications tab, set:

• Email From Name — defaults to your site name.
• Email From Address — defaults to the admin email.
• Email Template — Default (WordPress native) or an enhanced template with richer formatting.

7.2 SMTP configuration

Enable Mail System to send through a custom SMTP server instead of WordPress's default mailer, then choose a provider:

• Other SMTP (manual), Gmail / Google Workspace, Microsoft 365 / Outlook, or Resend.

For Other SMTP, enter SMTP Host, Port, and Encryption (25 none / 465 SSL / 587 TLS), plus Username and Password. Click Test SMTP Connection to verify. The From Name and From Address from General Settings are used.

For Gmail / Google Workspace and Microsoft 365 / Outlook, choose an Authentication Method: App Password (a 16-character app password) or Connect Account (OAuth2). OAuth2 takes a Client ID and Client Secret and shows a Redirect URI to register in the provider's console, then connects with one click.

7.3 User notifications

Toggle which emails go to users, including Welcome Email, Password Reset Email, and Account Locked Email. Some notifications activate only when their feature is enabled elsewhere:

• Password Expiry Email — requires Password Expiration (Chapter 6).
• Two-Factor Code Email — requires 2FA (Chapter 5).
• Maintenance Notification Email — requires "Notify Users Before Maintenance" (User settings).

Each enabled email has an editable Subject and Content, a Preview, and a Send Test button. Templates support variables such as {site_name}, {site_url}, {login_url}, {user_login}, {user_display_name}, and {user_email}.

7.4 Admin notifications

Set Notification Recipients (comma-separated) and choose which alerts to receive: New User Registration, Failed Login Attempts, User Locked Out, and Blocked IP.

7.5 Broadcast messaging

Enable Broadcast Messaging (Notifications), then open Broadcast Messaging (sidebar):

1. On Compose Message, enter a Subject.
2. Choose Recipients (user groups / roles).
3. Write the Message Content.
4. Set Delivery Schedule — Send Now or scheduled.
5. Preview Message, then Send Message.

The status header tracks Total Messages Sent, Scheduled Messages, and Total Users; the Scheduled Messages and Message History tabs show queued and past sends.

7.6 Maintenance mode

Open Maintenance Mode (sidebar). General Settings include:

• Enable Maintenance Mode — shows a maintenance page to visitors.
• Maintenance Page Title and Custom Maintenance Message (rich text, supports HTML).
• Logo URL, Background Type / Background Color.
• Enable Countdown Timer and Enable Social Media Links.
• Maintenance Page Template and HTTP Status Code — set 503 – Service Unavailable so search engines treat downtime correctly and your SEO is protected.

Whitelist Settings. Choose Whitelisted User Roles (Administrator, Editor, Author, Contributor, Subscriber) and add Whitelisted IP Addresses — both bypass maintenance mode. A Bypass URL (for example ?maintenance-bypass) lets anyone with the link through temporarily. Counts of whitelisted IPs and roles appear in the status header.

Schedule Settings. Enable Scheduled Maintenance to start and end automatically: set a Scheduled Start Time, a Scheduled End Time, and a Recurring Schedule (for example, one-time). Notify Users Before Maintenance emails users ahead of a scheduled window.

The admin bar shows a Maintenance ON/OFF toggle for switching maintenance on and off instantly.

8. Form Builder (Pro)

The Form Builder (sidebar) builds the authenticated-experience forms for the Account, Profile, Dashboard, Settings, and Onboarding flows.

8.1 Flows and structure

• Current Flow — pick the flow you're editing (for example, Account - Draft).
• Organize the form into Sections (for example, Account and Security), each containing fields.
• The live Preview renders the form; a Draft banner marks a form not yet visible on the front-end. Publish when ready.
• Quick Settings toggle Draft / published state and Column layout; Reset Template restores defaults. Layout and display options (List vs Grid, Show Section Name, Reload After Save, Submit Button Text, CSS Class) live in the flow's Advanced Settings, which also holds Import / Export JSON (see 8.5).

8.2 Adding fields

Click + Add Field to open the field library. Attributes ships a broad set of field types:

• Input: Text Input, Email, Textarea, Number, Phone, URL, Date Picker, Time Picker
• Choice: Select / Dropdown, Checkbox, Radio Buttons, Toggle / Switch, Color Picker
• Media: File Upload, Image Upload, Profile Photo
• Layout & content: Title / Subtitle, Divider, HTML Block, Hidden Field
• Account actions: Password Change, Account Deletion

Drag fields to reorder them within a section.

8.3 Configuring a field

Selecting a field opens its settings panel with five tabs:

General — Label, Field Name (a unique slug, no spaces), Placeholder, Help Text (shown below the field), a Required toggle, and Field Width (Full, 1/2, or 1/3).

Validation — add rules that run on submit (for example, Min Length) with a Value and a custom Error message. Stack multiple rules with Add Rule.

Conditions — conditional logic to show, hide, require, or disable the field based on another field's value: IF field operator value THEN action. Add as many conditions as you need.

Storage — choose where the submitted value is saved via Storage Type (for example, a WP User Column such as display_name, or user meta) and map the exact User Column (for example, user_email).

Advanced (DEV) — CSS Class, ARIA Label override, Autocomplete, and a Default Value that accepts a literal or a token (see 8.4).

8.4 Dynamic default values (tokens)

The Default Value field supports tokens of the form {source:key:fallback}, resolved when the form loads. Sources include user, option, site, and request, and dot-notation reaches nested values:

• {user:user_email:} — the current user's email.
• {user:billing.city:} — a nested user-meta value.

Tokens pre-fill fields from the logged-in user, site options, or the request, so member forms open already populated.

8.5 Import / Export JSON

Use Import / Export JSON (in the flow's Advanced settings) to move a form definition between sites or back it up — ideal for agencies reusing a standard member layout across client sites.

9. Developer reference

9.1 Architecture

Attributes uses PSR-4 autoloading and an object-oriented, modular design. Forms use nonce verification on all submissions and AJAX requests, and transient-based error handling (no PHP sessions), which keeps it compatible with page caching and load-balanced environments.

9.2 Shortcodes

9.3 Action hooks

9.4 Filter hooks

9.5 Template overrides

Copy any template from wp-content/plugins/attributes-user-access/templates/… to your-theme/attributes/… (mirroring the sub-path). The theme copy is used automatically when present.

9.6 Privacy & data

Attributes stores data locally in your WordPress database and does not send data to external servers or track users. It stores plugin settings (options table), temporary error messages (auto-expiring transients), and page IDs for authentication pages. All plugin data is removed on uninstall.