oOMF!

<p>oOMF! Access gives WordPress sites a better front door: a polished login page, guided account flows, passwordless magic links, social sign-in, safe redirects, CAPTCHA, hide-admin controls, honeypots, throttling, and lockout protection.</p>
<p>It is built for agencies, membership sites, product teams, and site owners who want a professional sign-in experience without hand-rolling templates, OAuth plumbing, redirect rules, and abuse controls for every project.</p>
<h4>Why teams use it</h4>
<ul>
<li><strong>A login page worth sharing</strong> – replace the default WordPress screen with a branded page powered by <code>[oomf_access_form]</code>, theme-aware styling, logo controls, custom copy, gradients, and live admin previews.</li>
<li><strong>One flow for every access moment</strong> – keep login, registration, lost password, password reset, logged-in states, and magic-link requests inside the same consistent interface.</li>
<li><strong>Passwordless and social sign-in</strong> – offer email magic links plus Google, Apple, GitHub, Microsoft, and Facebook providers with provider-specific setup hints.</li>
<li><strong>Redirects you can trust</strong> – send people to the right page after login/logout while validating <code>redirect_to</code> values and exposing filters for approved external hosts.</li>
<li><strong>Layered anti-abuse controls</strong> – enable reCAPTCHA, hCaptcha, honeypots, soft throttling, lockouts, secret login paths, and emergency bypass flows from wp-admin.</li>
<li><strong>Developer-friendly internals</strong> – focused hooks and filters let you customize destinations, CAPTCHA behavior, provider handling, inline CSS, and allowed redirect hosts.</li>
</ul>
<h4>Built for the real WordPress admin</h4>
<p>The settings screen includes a live preview, grouped controls for content/appearance/behavior/security, provider previews, and setup copy for external services. Frontend and admin assets load only where needed and are versioned with <code>filemtime()</code>.</p>
<h3>Privacy</h3>
<p>oOMF! Access does not send data to oOMF! services. CAPTCHA and social login features connect only when you enable them and provide your own third-party credentials. Removing the plugin deletes its settings, and the generated login page can also be removed via the <code>oomf_access/delete_page_on_uninstall</code> filter.</p>
<h3>External services</h3>
<p>oOMF! Access connects to outside services only when the related feature is enabled.</p>
<h4>Google reCAPTCHA (v2/v3)</h4>
<ul>
<li>Purpose: spam and abuse protection for access forms.</li>
<li>Endpoints: <code>https://www.google.com/recaptcha/api.js</code> and <code>https://www.google.com/recaptcha/api/siteverify</code>.</li>
<li>Data sent: site key/secret, visitor response token, action name, and optionally visitor IP.</li>
<li>Terms: https://policies.google.com/terms</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>hCaptcha</h4>
<ul>
<li>Purpose: CAPTCHA validation.</li>
<li>Endpoints: <code>https://js.hcaptcha.com</code> and <code>https://hcaptcha.com/siteverify</code>.</li>
<li>Data sent: site key/secret, response token, action name, and optionally visitor IP.</li>
<li>Terms: https://www.hcaptcha.com/terms</li>
<li>Privacy: https://www.hcaptcha.com/privacy</li>
</ul>
<h4>Google OAuth</h4>
<ul>
<li>Purpose: sign in with Google.</li>
<li>Endpoints: <code>accounts.google.com/o/oauth2/v2/auth</code>, <code>oauth2.googleapis.com/token</code>, and <code>openidconnect.googleapis.com/v1/userinfo</code>.</li>
<li>Data sent: authorization code, code verifier, redirect URI, client credentials, and selected scopes. Returned data can include name, verified email, avatar, and locale.</li>
<li>Terms: https://policies.google.com/terms</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Apple Sign In</h4>
<ul>
<li>Purpose: sign in with Apple.</li>
<li>Endpoints: <code>appleid.apple.com/auth/authorize</code> and <code>appleid.apple.com/auth/token</code>.</li>
<li>Data sent: authorization code, client ID, redirect URI, and signed JWT assertions generated from your Apple key. Returned data can include name and email.</li>
<li>Terms: https://www.apple.com/legal/internet-services/terms/site.html</li>
<li>Privacy: https://www.apple.com/legal/privacy/</li>
</ul>
<h4>GitHub OAuth</h4>
<ul>
<li>Purpose: sign in with GitHub.</li>
<li>Endpoints: <code>github.com/login/oauth/authorize</code>, <code>github.com/login/oauth/access_token</code>, <code>api.github.com/user</code>, and <code>api.github.com/user/emails</code>.</li>
<li>Data sent: authorization code, client credentials, redirect URI, and scopes. Returned data can include ID, email, name, and avatar.</li>
<li>Terms: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li>Privacy: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement</li>
</ul>
<h4>Microsoft OAuth</h4>
<ul>
<li>Purpose: sign in with Microsoft.</li>
<li>Endpoints: <code>login.microsoftonline.com/common/oauth2/v2.0/authorize</code>, <code>login.microsoftonline.com/common/oauth2/v2.0/token</code>, and <code>graph.microsoft.com/v1.0/me</code>.</li>
<li>Data sent: authorization code, client credentials, redirect URI, and scopes. Returned data can include ID, email, name, and locale.</li>
<li>Terms: https://www.microsoft.com/licensing/terms/productoffering/MicrosoftOnlineServices/MOSPT</li>
<li>Privacy: https://privacy.microsoft.com/privacystatement</li>
</ul>
<h4>Facebook Login</h4>
<ul>
<li>Purpose: sign in with Facebook.</li>
<li>Endpoints: <code>facebook.com/v18.0/dialog/oauth</code>, <code>graph.facebook.com/v18.0/oauth/access_token</code>, and <code>graph.facebook.com/v18.0/me</code>.</li>
<li>Data sent: authorization code, app credentials, redirect URI, and scopes. Returned data can include ID, email, name, and avatar.</li>
<li>Terms: https://www.facebook.com/legal/terms</li>
<li>Privacy: https://www.facebook.com/policy.php</li>
</ul>
<h3>Hooks & Extension Points</h3>
<ul>
<li><code>oomf_access_redirect_destination</code> – override the final destination after login.</li>
<li><code>oomf-access/allowed_redirect_hosts</code> – allow approved external redirect hosts.</li>
<li><code>oomf-access/captcha/allow_external</code> – control whether CAPTCHA network calls are allowed.</li>
<li><code>oomf_access_captcha_is_required</code> – decide whether CAPTCHA is required for a request.</li>
<li><code>oomf_access_captcha_validate_result</code> – customize CAPTCHA validation results.</li>
<li><code>oomf-access/inline_css</code> – inject extra CSS into the admin preview and frontend.</li>
</ul>


oOMF! Access

Turn the default WordPress login into a branded, passwordless, social-ready access hub with redirects and layered anti-abuse controls.

WebFactory

<p><a href="https://wp301redirects.com/?ref=wporg" rel="nofollow ugc">301 Redirects</a> helps you manage and create 301, 302, 307 redirects for WordPress site to <strong>improve SEO & visitor experience</strong>. 301 Redirects is easy to use. Perfect for new sites or repairing links after reorganizing your old content, or when your site has content that expires and you wish to avoid sending visitors to a 404 error page and want to create redirection instead. Use the 404 error log to identify problematic links & create new redirections.</p>
<p><strong>Having problems with spam, bots, or AI scrapers? Have a look at our <a href="https://wordpress.org/plugins/advanced-google-recaptcha/" rel="ugc">free Captcha plugin</a> used on over 200,000 sites.</strong></p>
<p>301 Redirects GUI is located in WP Admin – Settings – 301 Redirects<br />
404 Error Log widget can be found in the WP Admin – Dashboard – 404 Error Log</p>
<p><strong>Features</strong></p>
<ul>
<li>Choose from Pages, Posts, Custom Post types, Archives, and Term Archives from dropdown menu to create redirection</li>
<li>Or, set a custom destination URL!</li>
<li>Retain query strings across redirects</li>
<li>Super-fast redirection</li>
<li>404 error log</li>
<li>404 error log widget</li>
<li>Import/Export feature for bulk redirects management</li>
<li>Simple redirect stats so you know how much a redirection is used</li>
<li>Fully compatible with translation plugins (Weglot, TranslatePress, Gtranslate, Loco Translate) that use lang prefix in URL</li>
</ul>
<p><strong>Need more features?</strong><br />
<a href="https://wp301redirects.com/?ref=wporg" rel="nofollow ugc">WP 301 Redirects PRO</a> offers wildcard & regular expression URL matching, auto-typo fixing in URLs, complete redirect and 404 log, link scanner, and a centralized SaaS dashboard to monitor redirects on all your sites from one place.</p>
<p><strong>What is a 301 Redirect?</strong><br />
A redirect is a simple way to re-route traffic coming to a <em>Requested URL</em> to different <em>Destination URL</em>.</p>
<p>A 301 redirect indicates that the page requested has been permanently moved to the <em>Destination URL</em>, and helps pass on the <em>Requested URLs</em> traffic in a search engine friendly manner. Creating a 301 redirect tells search engines that the <em>Requested URL</em>  has moved permanently, and that the content can now be found on the <em>Destination URL</em>. An important feature is that search engines will pass along any clout the <em>Requested URL</em> used to have to the <em>Destination URL</em>.</p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/70Yn_lO_8BA?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p><strong>When Should I use 301 Redirects?</strong><br />
* Replacing an old site design with a new site design<br />
* Overhauling or re-organizing your existing WordPress content<br />
* You have content that expires (or is otherwise no longer available) and you wish to redirect users elsewhere</p>
<p><strong>Is the 404 error log GDPR friendly?</strong><br />
The 404 error log does not collect user IPs. It collects the following data: timestamp of the event, the (404) URL that was opened, and the user-agent string.</p>
<p><strong>Having problems with SSL? Moving a site from HTTP to HTTPS?</strong><br />
Install our free <a href="https://wordpress.org/plugins/wp-force-ssl/" rel="ugc">WP Force SSL</a> plugin. It’s a great way to enable SSL and fix SSL problems.</p>
<p><strong>External libraries used in the project</strong><br />
* <a href="https://github.com/donatj/PhpUserAgent" rel="nofollow ugc">PHP User Agent Parser</a></p>


301 Redirects – Redirect Manager

As soon as you install this plugin and try to access the settings, you're hit with this huge screen trying to get you to go to pro. I instantly uninstalled and will use something else.

Removed instantly


This plugin saves a lot of time for me. Recommended. 


Easy to use plugin

Useful

Manage 301 & 302 redirects. Simple redirection & redirects validation. Includes redirect stats & 404 error log.

oOMF! Access vs 301 Redirects – Redirect Manager