Attributes User Access

Attributes User Access replaces the generic wp-login.php screen with fully branded, on-theme login, lost password, password reset and registration pages — built with shortcodes or blocks, and completely compatible with WordPress core.

It is a lightweight, developer-friendly authentication toolkit: you get clean front-end forms, flexible role-based redirects, and template overrides, without a page builder and without touching WordPress core.

Why site owners use it

The default WordPress login page sends every visitor to an unbranded /wp-admin/ screen. Attributes User Access lets you serve a login and registration experience that matches your site, control exactly where each role lands after signing in, and keep everything update-safe.

Free features

• Custom authentication pages — Login, Lost Password, Reset Password and Registration, as shortcodes or blocks.
• Redirect the native login — send wp-login.php requests to your own branded pages.
• Role-based & context-aware redirection — define where users go after login and logout, per role.
• Theme template overrides — copy any form template into your theme (your-theme/attributes/front/forms/login-form.php) for full markup control; overrides survive updates.
• Built for developers — PSR-4 autoloading, object-oriented, extensible with action and filter hooks (e.g. attrua_login_form_fields, attrua_after_login_form).
• Lightweight by design — selective asset loading, transient caching, and minified production assets.
• Update-safe — adapts to WordPress core changes so your login pages keep working.

Upgrade to Attributes User Access Pro

Pro turns the plugin into a complete authentication, security and user-management suite — the kind of stack most sites assemble from five or six separate plugins (login customizer, 2FA, IP firewall, audit log, SMTP, password policy, maintenance mode), unified in one.

• Member pages — Account, Profile, Settings and Onboarding flows.
• Visual Form Builder — 20+ field types with validation, conditional logic, storage mapping to WordPress user columns/meta, and dynamic default-value tokens.
• Authentication methods — Two-Step (2FA), Passwordless email login, and Social OAuth sign-in.
• Security — IP blocking (single IP, CIDR range, IPv6, with expiry), reCAPTCHA, and a password policy (complexity, expiration, history).
• Audit log — 50+ security events across categories, retention control and CSV export.
• Registration control — email verification, disposable-email blocking and domain validation.
• Email & SMTP — Gmail / Google Workspace and Microsoft 365 via OAuth2, App Password, Resend or custom SMTP, plus templated emails and broadcast messaging.
• Maintenance mode — proper 503 response, role/IP whitelist, bypass URL and scheduling.
• Block Editor & Elementor — native form widgets with full style controls.
• Emergency admin access — an anti-lockout safeguard for administrators.

Learn more and view pricing at attributeswp.com. All Pro plans include updates, support and a 30-day money-back guarantee.

1. Upload the plugin files to /wp-content/plugins/attributes-user-access/, or install it through the Plugins > Add New screen in WordPress.
2. Activate the plugin through the Plugins screen.
3. Go to User Access in the admin menu to create your login, registration and password pages.
4. (Optional) Set your role-based redirects and, if you use a page builder, drop the Attributes blocks or shortcodes onto your pages.

1. 

   Branded custom login page rendered on the front end.

2. 

   Registration form with role-based redirection settings.

3. 

   Role and redirect configuration in the admin.

4. 

   Template override structure for developers.

5. 

2.0.0

Core and Pro are published together as 2.0.

• Fixed: a broken installation — an upload that stopped halfway, a restored
  backup — switches the plugin off with a notice instead of taking the site
  down with it.
• Fixed: a refused sign-in says why. Any error the extensions raise — a
  password policy, a reCAPTCHA challenge, a second factor — reached the form as
  “An unknown error occurred”. The sentence it was given is now shown. The key
  used to carry that sentence was drawn from an alphabet the reader lowercased,
  so it almost never matched and the generic message showed regardless; the two
  now agree.
• Removed: two public AJAX endpoints, attrua_check_username and
  attrua_check_email, that answered “does this account exist?” to anyone with no
  limit of any kind. Nothing called them — the registration form makes no such
  request — and the Pro extension already dropped its own copies for the same
  reason.
• Fixed: the emergency access link that reaches wp-login.php exchanges its token
  for a short-lived cookie and comes back without the token in the address,
  where it would otherwise sit in access logs, browser history and Referer
  headers. When Pro is active, every use and refusal is written to the audit
  log. It declines the redirect to a custom login page and nothing more — a
  second factor still applies.
• Changed: the nonce-refresh endpoint, which hands a fresh sign-in nonce to a
  cached login page, is served to signed-out visitors only. Its logged-in
  registration handed a session-bound nonce to any page that could make the
  browser ask, and served nobody — someone already signed in is not looking at
  a sign-in form.
• Removed: a decorative nonce on the settings tabs. It protected nothing — the
  tab was already chosen before it was checked — and expired, so a bookmarked
  tab URL stopped working after a day.
• Added: the plugin speaks five languages — French, Spanish, Simplified
  Chinese, Japanese and Traditional Chinese (Taiwan).
• Changed: the footer of the plugin’s own admin screens reports the state of
  the site — authentication pages live, wp-login.php, registration — instead of
  asking for a review. Each fact links to the screen that changes it.
• Changed: the download is a third of the size, 3.31 MB down to 1.14 MB. The
  icon font shipped in three formats and browsers only ever requested one.
• Changed: the version is read from the plugin header alone. It used to be
  written a second time as a constant, and the two could disagree.
• Fixed: after an update, “Create Page” could do nothing. The admin script’s
  address carried the WordPress version instead of the plugin’s, so browsers
  and caches kept serving the previous copy. Each file’s address now changes
  with the package.
• Fixed: the Elementor widget’s Max Width setting was ignored at 380px and
  below.
• Changed: the admin screens no longer advertise the Elite plan. The
  “WooCommerce Pages” rows and the Elite card of the “Unlock More with
  Attributes User Access” section are held back — they promised a tier that
  does not ship yet. Nothing was deleted; both come back from one switch. The
  Pro half of that section still appears on a site running Core alone.
• Maintenance: two .bak copies and a dead redefinition of the version constant
  in uninstall.php are gone.

Everything else in this release is on the Pro side; see its changelog.

1.3.0

• Compatibility: tested with WordPress 7.0.
• Maintenance: regenerated all minified assets from original sources.
• Maintenance: improved asset loading consistency across admin and front end.