wp-comblock

The Comblock Login plugin implements a complete and secure authentication system on the frontend for WordPress. Through dedicated shortcodes, you can easily insert login and logout forms, user information displays, and the option to log out of all active sessions on your site’s content. The login process is strictly managed: user-entered data is sanitized, security is ensured through nonce verification to prevent CSRF attacks, and authentication is performed using native WordPress functions, with support for secure session storage and cookie management.
Logout not only allows you to securely end the current session, but also offers the advanced global logout feature, which ends all active user sessions on all devices, increasing security in case of compromise or accidental sharing of credentials. Custom dashboards, based on dedicated post types, are protected by access controls that limit visibility to authorized users only, redirecting other users to configured login pages, with failed attempts logged to improve security monitoring.
<h3>Features</h3>
<ol>
<li>Registration of the shortcode for the login form, logout button, logout button for all devices, and display of logged-in users.</li>
<li>Secure login management with nonce verification and input sanitization.</li>
<li>Custom redirects to the dashboard after login and to the login page after logout.</li>
<li>Creation of multiple dashboards by configuring which user roles can access them.</li>
<li>Logout functionality from all devices simultaneously.</li>
<li>Logging of errors related to access and permissions.</li>
</ol>
<h3>Usage</h3>
<ul>
<li>
Use the shortcode <code>[comblock_login]</code> to display the login form. You can insert this shortcode into any page or post. 
Simple example (only required attribute): 
<code>[comblock_login dashboard-post-id="8"]</code> 
Complete example (with all optional attributes): 
<code>[comblock_login id="subscriber-login" class="subscriber-form-login" dashboard-post-id="8" privacy-page-id="2"]</code> 
Where:
<ul>
<li><code>dashboard-post-id</code> is mandatory and represents the ID of a Dashboard post type created in the back office. </li>
<li><code>id</code>, <code>class</code>, and <code>privacy-page-id</code> are optional, where <code>privacy-page-id</code> refers to the privacy policy page ID.</li>
</ul>
</li>
<li>
Use the shortcode <code>[comblock_logout]</code> only within the <code>dashboard</code> post type to display the logout link. 
Simple example (without optional attributes): 
<code>[comblock_logout]</code> 
Complete example (with optional attributes): 
<code>[comblock_logout id="logout-link" class="btn-logout"]</code>
</li>
<li>
Use the shortcode <code>[comblock_disconnection]</code> within the <code>dashboard</code> post type to display the disconnection link. 
Simple example: 
<code>[comblock_disconnection]</code> 
Complete example: 
<code>[comblock_disconnection id="disconn-link" class="btn-disconnect"]</code>
</li>
<li>
Use the shortcode <code>[comblock_user_info]</code> within the <code>dashboard</code> post type to display user information. 
Simple example (only required attribute): 
<code>[comblock_user_info fields="display_name,user_email"]</code> 
Complete example (with title and all attributes): 
<code>[comblock_user_info title="my-section-title" fields="display_name,user_email"]</code> 
The <code>fields</code> attribute contains user meta fields separated by commas. Note that some meta fields cannot be used for security or privacy reasons.
To address this, the plugin provides two filters hooks:
<ul>
<li><code>comblock_login_user_ban_fields</code> allows you to add meta fields that you shouldn’t use. </li>
<li><code>comblock_login_user_info_allowed_fields</code> permits extending the list of meta fields that are allowed for searching and displaying user metadata.</li>
</ul>
These hooks enable developers to customize which user data can be displayed via the shortcode while maintaining control over security and privacy.
</li>
</ul>
<h3>Security</h3>
The plugin implements the following security mechanisms:
<ul>
<li>Nonce verification for all critical login and logout actions to protect against CSRF.</li>
<li>Sanitization of input from login forms to prevent injection.</li>
<li>Authentication via WordPress’ secure <code>wp_signon()</code> function.</li>
<li>Strict session cookie management with SSL support.</li>
<li>Granular control of access permissions based on user roles defined for each dashboard.</li>
<li>Complete destruction of user sessions upon logout from all devices.</li>
</ul>

Comblock Login

Secure frontend login/logout with user dashboards, session management, and role-based access control for WordPress sites.

Konstantin Obenland

This plugin lets you approve or reject user registrations. 
While a user is unapproved, they can’t access the WordPress Admin.
On activation of the plugin, all existing users will automatically be flagged Approved. The site admin will never experience restricted access and does not need approval. 
This plugin is probably not compatible with WooCommerce.
<h4>Translations</h4>
I will be more than happy to update the plugin with new locales, as soon as I receive them! 
Currently available in:
<ul>
<li>Dutch</li>
<li>Deutsch</li>
<li>English</li>
<li>Hebrew</li>
<li>Persian</li>
<li>Russian</li>
</ul>
<h4>Plugin Hooks</h4>
<h3>Actions</h3>
wpau_approve (int)
<blockquote>
User-ID of approved user.
</blockquote>
wpau_unapprove (int)
<blockquote>
User-ID of unapproved user.
</blockquote>
<h3>Filter</h3>
wpau_default_options (array)
<blockquote>
Default options.
</blockquote>
wpau_update_message_handler (string)
<blockquote>
Allows to return custom update messages.
</blockquote>
wpau_message_placeholders (array)
<blockquote>
Filters the placeholders in approve/unapprove emails.
</blockquote>

WP Approve User

The plugin is not working as promised, so

1. No Settings
2. It didn't display Custom Menu for each user


Thanks, but need to uninstall.

Not Working!

This site has over 360k registered users. Upon activating the plugin, it timed out as it tried to add >720k user meta keys. Not sure why it doesn't just meta select only users who do not have the fields (which would have still timed out, but at least it would continue on the next time Activate was attempted). I "fixed" that by adding them with my own script and then uncommented the activation hook. It appeared to be working fine after that, but then I discovered (via Query Monitor) that it was adding over 6 seconds (with Redis caching!) to every admin page load because the constructor pulls a list of all unapproved users.

It would also have been nice if there was a checkbox like "Delete plugin data when uninstalled" or whatever so I didn't have to re-add over 720k meta fields to my dev box after deleting the plugin to move it as a submodule (obviously, I should have just deleted the directory, but I didn't look at the code and realize that it was going to asplode everything on my dev instance).

I get it - 360k+ users is a lot, but for plugins (plural: the others failed too, for the same reason) that assume a site is soliciting registrations from anon, you'd expect them to handle a lot of registrations. If you don't have many users/registrations, you don't really need a plugin to manage them, right?

I'm assuming that it loads a list of every unapproved user on every admin page load solely for the unapproved user count badge on the admin menu (I didn't look - I stopped trying to hack it and just decided to tell the users to manage it manually, which was unpopular).

+3 stars because it's free and doesn't use Freemius.

EDIT - Also, you can change the instantiation because I don't think it needs to run during cron or Ajax requests:
if( !wp_doing_cron() && !wp_doing_ajax() ) new Obenland_Wp_Approve_User();

You can probably check for is_admin() before running code in various places, too.

Does Not Scale


We are looking for a way to minimise the amount of emails which we send out to dead addresses (often Gmail) via fake bbPress signups to our forum. The first step is user approval.



Konstantin's plugin is simple and focused, with straightforward settings in a settings panel. There's no top level left column item (frankly any plugin which wants to put its settings in the main left window should require approval from the plugin moderation team, if in the plugin directory, the left top-level menu is now hopelessly cluttered on most WordPress sites). The main interface are simple text additions to the existing user table Approve | Unapprove.



Frankly user approval should be built into WordPress. But until it is, thank heavens for simple solutions. No adware, no pro version, no bloatware frills, native interface.



I like the idea of a previous reviewer to allow unapproved users to be kept in the database to prevent additional signups with the same address. We'd also like an improved workflow where no email goes out to users until admin approval, at which point the signup email would arrive.



What would happen to a new user is that s/he would be auto-logged in at the time of signup with very limited privileges until approved or unapproved but no email would be sent without approval. This would allow simple comments to be left on a weblog post or bbPress without sending out emails to dead addresses (and damaging sender reputation).



We can add these features fairly easily ourselves, but it would be great to see them in the core functionality of WP Approve User.



Thank you Konstantin for your hard work on WP Approve User and for making it free.


Nice, simple and focused

Adds action links to user table to approve or unapprove user registrations.

Comblock Login vs WP Approve User