oOMF!

<p>oOMF! Access gives WordPress sites a better front door: a polished login page, guided account flows, passwordless magic links, social sign-in, safe redirects, CAPTCHA, hide-admin controls, honeypots, throttling, and lockout protection.</p>
<p>It is built for agencies, membership sites, product teams, and site owners who want a professional sign-in experience without hand-rolling templates, OAuth plumbing, redirect rules, and abuse controls for every project.</p>
<h4>Why teams use it</h4>
<ul>
<li><strong>A login page worth sharing</strong> – replace the default WordPress screen with a branded page powered by <code>[oomf_access_form]</code>, theme-aware styling, logo controls, custom copy, gradients, and live admin previews.</li>
<li><strong>One flow for every access moment</strong> – keep login, registration, lost password, password reset, logged-in states, and magic-link requests inside the same consistent interface.</li>
<li><strong>Passwordless and social sign-in</strong> – offer email magic links plus Google, Apple, GitHub, Microsoft, and Facebook providers with provider-specific setup hints.</li>
<li><strong>Redirects you can trust</strong> – send people to the right page after login/logout while validating <code>redirect_to</code> values and exposing filters for approved external hosts.</li>
<li><strong>Layered anti-abuse controls</strong> – enable reCAPTCHA, hCaptcha, honeypots, soft throttling, lockouts, secret login paths, and emergency bypass flows from wp-admin.</li>
<li><strong>Developer-friendly internals</strong> – focused hooks and filters let you customize destinations, CAPTCHA behavior, provider handling, inline CSS, and allowed redirect hosts.</li>
</ul>
<h4>Built for the real WordPress admin</h4>
<p>The settings screen includes a live preview, grouped controls for content/appearance/behavior/security, provider previews, and setup copy for external services. Frontend and admin assets load only where needed and are versioned with <code>filemtime()</code>.</p>
<h3>Privacy</h3>
<p>oOMF! Access does not send data to oOMF! services. CAPTCHA and social login features connect only when you enable them and provide your own third-party credentials. Removing the plugin deletes its settings, and the generated login page can also be removed via the <code>oomf_access/delete_page_on_uninstall</code> filter.</p>
<h3>External services</h3>
<p>oOMF! Access connects to outside services only when the related feature is enabled.</p>
<h4>Google reCAPTCHA (v2/v3)</h4>
<ul>
<li>Purpose: spam and abuse protection for access forms.</li>
<li>Endpoints: <code>https://www.google.com/recaptcha/api.js</code> and <code>https://www.google.com/recaptcha/api/siteverify</code>.</li>
<li>Data sent: site key/secret, visitor response token, action name, and optionally visitor IP.</li>
<li>Terms: https://policies.google.com/terms</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>hCaptcha</h4>
<ul>
<li>Purpose: CAPTCHA validation.</li>
<li>Endpoints: <code>https://js.hcaptcha.com</code> and <code>https://hcaptcha.com/siteverify</code>.</li>
<li>Data sent: site key/secret, response token, action name, and optionally visitor IP.</li>
<li>Terms: https://www.hcaptcha.com/terms</li>
<li>Privacy: https://www.hcaptcha.com/privacy</li>
</ul>
<h4>Google OAuth</h4>
<ul>
<li>Purpose: sign in with Google.</li>
<li>Endpoints: <code>accounts.google.com/o/oauth2/v2/auth</code>, <code>oauth2.googleapis.com/token</code>, and <code>openidconnect.googleapis.com/v1/userinfo</code>.</li>
<li>Data sent: authorization code, code verifier, redirect URI, client credentials, and selected scopes. Returned data can include name, verified email, avatar, and locale.</li>
<li>Terms: https://policies.google.com/terms</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Apple Sign In</h4>
<ul>
<li>Purpose: sign in with Apple.</li>
<li>Endpoints: <code>appleid.apple.com/auth/authorize</code> and <code>appleid.apple.com/auth/token</code>.</li>
<li>Data sent: authorization code, client ID, redirect URI, and signed JWT assertions generated from your Apple key. Returned data can include name and email.</li>
<li>Terms: https://www.apple.com/legal/internet-services/terms/site.html</li>
<li>Privacy: https://www.apple.com/legal/privacy/</li>
</ul>
<h4>GitHub OAuth</h4>
<ul>
<li>Purpose: sign in with GitHub.</li>
<li>Endpoints: <code>github.com/login/oauth/authorize</code>, <code>github.com/login/oauth/access_token</code>, <code>api.github.com/user</code>, and <code>api.github.com/user/emails</code>.</li>
<li>Data sent: authorization code, client credentials, redirect URI, and scopes. Returned data can include ID, email, name, and avatar.</li>
<li>Terms: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li>Privacy: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement</li>
</ul>
<h4>Microsoft OAuth</h4>
<ul>
<li>Purpose: sign in with Microsoft.</li>
<li>Endpoints: <code>login.microsoftonline.com/common/oauth2/v2.0/authorize</code>, <code>login.microsoftonline.com/common/oauth2/v2.0/token</code>, and <code>graph.microsoft.com/v1.0/me</code>.</li>
<li>Data sent: authorization code, client credentials, redirect URI, and scopes. Returned data can include ID, email, name, and locale.</li>
<li>Terms: https://www.microsoft.com/licensing/terms/productoffering/MicrosoftOnlineServices/MOSPT</li>
<li>Privacy: https://privacy.microsoft.com/privacystatement</li>
</ul>
<h4>Facebook Login</h4>
<ul>
<li>Purpose: sign in with Facebook.</li>
<li>Endpoints: <code>facebook.com/v18.0/dialog/oauth</code>, <code>graph.facebook.com/v18.0/oauth/access_token</code>, and <code>graph.facebook.com/v18.0/me</code>.</li>
<li>Data sent: authorization code, app credentials, redirect URI, and scopes. Returned data can include ID, email, name, and avatar.</li>
<li>Terms: https://www.facebook.com/legal/terms</li>
<li>Privacy: https://www.facebook.com/policy.php</li>
</ul>
<h3>Hooks & Extension Points</h3>
<ul>
<li><code>oomf_access_redirect_destination</code> – override the final destination after login.</li>
<li><code>oomf-access/allowed_redirect_hosts</code> – allow approved external redirect hosts.</li>
<li><code>oomf-access/captcha/allow_external</code> – control whether CAPTCHA network calls are allowed.</li>
<li><code>oomf_access_captcha_is_required</code> – decide whether CAPTCHA is required for a request.</li>
<li><code>oomf_access_captcha_validate_result</code> – customize CAPTCHA validation results.</li>
<li><code>oomf-access/inline_css</code> – inject extra CSS into the admin preview and frontend.</li>
</ul>


oOMF! Access

Turn the default WordPress login into a branded, passwordless, social-ready access hub with redirects and layered anti-abuse controls.

Scott Kingsley Clark

<p><em>Important:</em> It is not recommended you leave debugging enabled when you’re done, the debug information exposes file paths of files as well as PHP arguments passed into functions from the PHP <code>debug_backtrace()</code> which may contain sensitive information.</p>
<p>This is useful for those times when you have a lot of plugins / theme functions interacting that cause an unknown redirect. This tool helps you figure out what is redirecting and where it’s redirecting at in the code.</p>
<p>This plugin outputs information about each <code>wp_redirect()</code> and <code>wp_safe_redirect()</code> call done on the front and in the admin area of a site.</p>
<h4>Usage: Enabling with the setting</h4>
<p>You can enable redirect debugging by going to <code>Settings > Debug wp_redirect()</code> on your site or in your network settings (if network activated). You have the option to enable debugging for frontend requests and/or admin dashboard requests. You also have the ability to only show debugging if the person is logged in or is an admin.</p>
<p>If you encounter problems with this plugin blocking redirects you need for logging in or being able to disable the redirect, simply rename the plugin or define this in your wp-config.php file: <code>define( 'DEBUG_WP_REDIRECT', false );</code></p>
<h4>Usage: Enabling through wp-config.php</h4>
<p>You can define constants in your wp-config.php file to enable redirect handling for frontend / admin dashboard requests. Constants override any options set in the admin settings page.</p>
<ul>
<li>To enable redirect debugging on the frontend of a site: <code>define( 'DEBUG_WP_REDIRECT', true );</code></li>
<li>To enable redirect debugging in the admin dashboard of a site: <code>define( 'DEBUG_WP_REDIRECT_ADMIN', true );</code></li>
<li>To only show redirect debugging to logged-in admins of a site: <code>define( 'DEBUG_WP_REDIRECT_LOGGED_IN_ADMIN', true );</code></li>
<li>To only show redirect debugging to logged-in users of a site: <code>define( 'DEBUG_WP_REDIRECT_LOGGED_IN', true );</code></li>
<li>To only show redirect debugging to logged-in user ID(s) of a site: <code>define( 'DEBUG_WP_REDIRECT_LOGGED_IN_USER_ID', true );</code></li>
</ul>
<h4>Usage: Enabling debugging through PHP in your own code</h4>
<p>You can enable/disable debugging when you have your own code you want to start/stop debugging after a certain point.</p>
<p>These functions will start/stop debugging the redirects whether it’s on a frontend or admin dashboard request.</p>
<ul>
<li>Enable debugging: <code>debug_wp_redirect_enable()</code></li>
<li>Disable debugging: <code>debug_wp_redirect_disable()</code></li>
</ul>
<h4>Usage: As an mu-plugin</h4>
<p>Take the debug-wp-redirect.php file and add it to your mu-plugin folder in a location like: <code>/wp-content/mu-plugins/debug-wp-redirect.php</code></p>
<p>You won’t need any other files. The admin settings page will not show up so you will need to use mu-plugin mode specifically with the constants for wp-config.php as documented above.</p>
<h4>Contribute to make this plugin better</h4>
<p>You can help to make this plugin better through <a href="https://github.com/sc0ttkclark/debug-wp-redirect" rel="nofollow ugc">GitHub</a> or <a href="https://github.com/sponsors/sc0ttkclark" rel="nofollow ugc">sponsor my time</a>.</p>


Debug wp_redirect()

Worked really good. I had one issue where an object was echoed out like a string. A quick edit fixed that, and not it works perfectly. 5/5 if not for that error (on line 63).



Saved the day!

What the.. Where'd that redirect come from? This plugin helps to uncover redirects as they happen.

oOMF! Access vs Debug wp_redirect()