Shameem - a11n

HappyAccess simplifies the process of granting temporary admin access to support engineers, developers, and agencies – securely, transparently, and GDPR-compliantly.
It removes the need for merchants to manually create/delete admin users or share passwords, while maintaining full control and audit visibility.
<h4>Key Features</h4>
Access & Authentication
<ul>
<li>OTP-Based Authentication: Generate secure 6-digit codes instead of sharing passwords.</li>
<li>Magic Link Authentication: One-click login links with short expiration (1-10 minutes), single-use.</li>
<li>OTP Share Links: Generate secure single-view links to share OTP codes safely with auto-expiry.</li>
<li>Reusable Access Codes: Support engineers can log in multiple times with the same code until it expires.</li>
<li>One-Time Use Option: Generate codes that automatically revoke after first use for maximum security.</li>
<li>Role Selection: Assign any WordPress role (Administrator, Editor, Shop Manager, or custom roles).</li>
<li>Time-Limited Access: Automatically expires after the set duration (1 hour to 30 days).</li>
</ul>
Access Restrictions
<ul>
<li>Admin Menu & Submenu Restrictions: Block temp users from specific admin pages with a visual picker. Supports top-level menus and individual sub-pages (WooCommerce tabs, EDD sections, BuddyPress, or any plugin).</li>
<li>Direct URL Blocking: Restricted pages are inaccessible even when accessed by typing the URL directly.</li>
<li>Hide Admin Bar: Option to hide the WordPress admin bar for temporary users.</li>
<li>Main Admin Protection: Temp users cannot see, edit, or delete the site owner. Dangerous bulk actions are blocked.</li>
<li>Plugin Self-Protection: HappyAccess is hidden from the plugins list for temp users.</li>
<li>Activate/Deactivate Toggle: Suspend a temp user’s access without deleting them, and reactivate later with one click.</li>
</ul>
Security
<ul>
<li>reCAPTCHA v3 Protection: Optional invisible bot protection for OTP login.</li>
<li>IP Allowlist: Optionally restrict access codes to specific IP addresses.</li>
<li>Rate Limiting: Failed attempt lockouts and IP tracking prevent brute force attacks.</li>
<li>Emergency Lock: One-click admin bar button to instantly revoke all active tokens.</li>
<li>Session Management: Logout all temp sessions without revoking tokens.</li>
</ul>
Monitoring & Compliance
<ul>
<li>Full Audit Log: Track all access, logins, restrictions, and actions with filterable event log and CSV export.</li>
<li>Live Countdown Timer: Real-time expiry countdown in the admin bar with auto-logout.</li>
<li>Login Count Tracking: See first login vs re-logins in the audit log.</li>
<li>Active Token Management: View all active codes, see usage status, generate magic links, and revoke anytime.</li>
<li>Email Notifications: Send access codes and magic links to admin or support email.</li>
<li>Automatic Cleanup: Temporary users and old logs are deleted automatically when access expires.</li>
<li>GDPR Compliant: Built-in consent workflow, privacy policy integration, and data export/erasure support.</li>
<li>Native WordPress UI: Clean interface matching WordPress and WooCommerce admin styles.</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Go to Users → HappyAccess in your WordPress admin.</li>
<li>Click Generate Access tab.</li>
<li>Choose duration (1 hour to 30 days) and role.</li>
<li>Optionally enable email notification.</li>
<li>Accept GDPR terms and click Generate Access Code.</li>
<li>Share the 6-digit code with your support engineer.</li>
<li>They enter the code at your login page – no username/password needed.</li>
<li>Access automatically expires and user is deleted.</li>
</ol>
<h4>Perfect For</h4>
<ul>
<li>Support Engineers – Quick access without password hassles.</li>
<li>Agencies – Manage client access professionally.</li>
<li>Store Owners – Maintain security while getting help.</li>
<li>Developers – Troubleshoot without credential sharing.</li>
</ul>
<h4>GDPR & Security</h4>
<ul>
<li>All access must be disclosed in your Terms & Conditions.</li>
<li>Complete audit trail of all actions.</li>
<li>Data stored locally on your WordPress site.</li>
<li>Automatic data cleanup after 30 days.</li>
<li>Rate limiting prevents brute force attacks.</li>
</ul>
<h4>Third-Party Services</h4>
This plugin optionally connects to the following third-party service:
Google reCAPTCHA v3 (optional)
When enabled in Settings, HappyAccess loads Google reCAPTCHA v3 on the WordPress login page to protect the OTP field from automated attacks. This sends the user’s IP address, browser information, and interaction data to Google for bot detection.
<ul>
<li>Service URL: <a href="https://www.google.com/recaptcha/" rel="nofollow ugc">https://www.google.com/recaptcha/</a></li>
<li>Terms of Service: <a href="https://policies.google.com/terms" rel="nofollow ugc">https://policies.google.com/terms</a></li>
<li>Privacy Policy: <a href="https://policies.google.com/privacy" rel="nofollow ugc">https://policies.google.com/privacy</a></li>
</ul>
reCAPTCHA is disabled by default and must be explicitly enabled by an administrator. When disabled, no data is sent to Google.
<h3>Privacy Policy</h3>
HappyAccess stores access logs locally on your WordPress site. No data is sent to external services unless you enable optional integrations (see Third-Party Services above).
The plugin collects: 
* IP addresses of users accessing with temporary codes. 
* Browser information (user agent). 
* Access times and durations. 
* Actions performed (audit log).
This data is automatically deleted after 30 days unless configured otherwise.
When Google reCAPTCHA v3 is enabled, the user’s IP address, browser fingerprint, and interaction data are sent to Google for bot detection. See Google’s <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a> for details.
You must disclose in your Terms & Conditions that you may grant admin access to third parties for support purposes.

HappyAccess

Secure temporary admin access for WordPress support engineers. Generate OTP-based access without sharing passwords.

Ravinthranath A

RoleGuard lets you assign time-limited roles to any WordPress user. When the clock runs out, the user is automatically reverted to their original role. No more forgotten elevated permissions, no more security risks from stale access.
<h4>Who is this for?</h4>
<ul>
<li>Agencies managing freelance contractors who need temporary editor access</li>
<li>Multi-author blogs bringing in guest contributors for a limited run</li>
<li>Membership sites offering trial access to premium content</li>
<li>Client sites where clients need temporary admin for review and approval</li>
<li>LMS platforms with time-limited instructor or teaching assistant roles</li>
<li>eCommerce stores granting seasonal staff temporary shop manager access</li>
</ul>
<h4>How it works</h4>
<ol>
<li>Go to any user’s profile page</li>
<li>Select a temporary role and expiration (quick presets: 7, 14, 30, or 90 days)</li>
<li>RoleGuard stores the original role, applies the new one, and starts the countdown</li>
<li>When time expires, the user’s role is automatically reverted to what it was before</li>
</ol>
<h4>Free Features</h4>
<ul>
<li>Assign temporary roles with date-based expiration</li>
<li>Quick presets: 7, 14, 30, or 90 days — or set any custom date</li>
<li>Automatic role reversion via WP-Cron (hourly checks)</li>
<li>Admin safety net: checks on admin page loads if cron hasn’t run in 2+ hours</li>
<li>Email notifications to both users and admins on role expiry</li>
<li>Advance warning emails (configurable: 1–30 days before expiry)</li>
<li>“Temp Role” and “Expires” columns in the Users list (sortable, color-coded)</li>
<li>Dedicated RoleGuard section on every Edit User profile screen</li>
<li>Bulk action: revoke temporary roles for multiple users at once</li>
<li>Privilege escalation prevention — cannot assign roles at or above your own level</li>
<li>Up to 10 active temporary role assignments</li>
<li>Settings page with active assignments dashboard</li>
<li>Fully translatable with proper text domain</li>
</ul>
<h4>What makes RoleGuard different?</h4>
<ul>
<li>Zero configuration — activate and start assigning, no setup wizard</li>
<li>Security first — privilege escalation prevention built in from day one</li>
<li>Reliable expiration — hourly cron + admin safety net means roles never get stuck</li>
<li>Clean reversion — stores the exact original role, not just a fallback default</li>
<li>Lightweight — no JavaScript frameworks, no external API calls, no bloat</li>
</ul>
<h4>RoleGuard Pro</h4>
Need more? <a href="https://roleguard.dev/pro" rel="nofollow ugc">RoleGuard Pro</a> is a separate add-on that unlocks:
<ul>
<li>Unlimited temporary role assignments (removes the 10-user limit)</li>
<li>Full audit log with filtering, pagination, and export</li>
<li>Bulk assignment page with CSV import</li>
<li>Scheduled roles with future start dates</li>
<li>Slack and Zapier webhook notifications</li>
<li>Extended REST API for external integrations</li>
<li>WordPress dashboard widget showing upcoming expirations</li>
<li>License-gated — one clean upgrade, no feature nags</li>
</ul>

RoleGuard — Temporary Role Manager

Assign time-limited roles to freelancers, contractors, and guest authors. Roles expire automatically and revert — zero cleanup needed.

HappyAccess vs RoleGuard — Temporary Role Manager