oOMF!

<p>oOMF! Access gives WordPress sites a better front door: a polished login page, guided account flows, passwordless magic links, social sign-in, safe redirects, CAPTCHA, hide-admin controls, honeypots, throttling, and lockout protection.</p>
<p>It is built for agencies, membership sites, product teams, and site owners who want a professional sign-in experience without hand-rolling templates, OAuth plumbing, redirect rules, and abuse controls for every project.</p>
<h4>Why teams use it</h4>
<ul>
<li><strong>A login page worth sharing</strong> – replace the default WordPress screen with a branded page powered by <code>[oomf_access_form]</code>, theme-aware styling, logo controls, custom copy, gradients, and live admin previews.</li>
<li><strong>One flow for every access moment</strong> – keep login, registration, lost password, password reset, logged-in states, and magic-link requests inside the same consistent interface.</li>
<li><strong>Passwordless and social sign-in</strong> – offer email magic links plus Google, Apple, GitHub, Microsoft, and Facebook providers with provider-specific setup hints.</li>
<li><strong>Redirects you can trust</strong> – send people to the right page after login/logout while validating <code>redirect_to</code> values and exposing filters for approved external hosts.</li>
<li><strong>Layered anti-abuse controls</strong> – enable reCAPTCHA, hCaptcha, honeypots, soft throttling, lockouts, secret login paths, and emergency bypass flows from wp-admin.</li>
<li><strong>Developer-friendly internals</strong> – focused hooks and filters let you customize destinations, CAPTCHA behavior, provider handling, inline CSS, and allowed redirect hosts.</li>
</ul>
<h4>Built for the real WordPress admin</h4>
<p>The settings screen includes a live preview, grouped controls for content/appearance/behavior/security, provider previews, and setup copy for external services. Frontend and admin assets load only where needed and are versioned with <code>filemtime()</code>.</p>
<h3>Privacy</h3>
<p>oOMF! Access does not send data to oOMF! services. CAPTCHA and social login features connect only when you enable them and provide your own third-party credentials. Removing the plugin deletes its settings, and the generated login page can also be removed via the <code>oomf_access/delete_page_on_uninstall</code> filter.</p>
<h3>External services</h3>
<p>oOMF! Access connects to outside services only when the related feature is enabled.</p>
<h4>Google reCAPTCHA (v2/v3)</h4>
<ul>
<li>Purpose: spam and abuse protection for access forms.</li>
<li>Endpoints: <code>https://www.google.com/recaptcha/api.js</code> and <code>https://www.google.com/recaptcha/api/siteverify</code>.</li>
<li>Data sent: site key/secret, visitor response token, action name, and optionally visitor IP.</li>
<li>Terms: https://policies.google.com/terms</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>hCaptcha</h4>
<ul>
<li>Purpose: CAPTCHA validation.</li>
<li>Endpoints: <code>https://js.hcaptcha.com</code> and <code>https://hcaptcha.com/siteverify</code>.</li>
<li>Data sent: site key/secret, response token, action name, and optionally visitor IP.</li>
<li>Terms: https://www.hcaptcha.com/terms</li>
<li>Privacy: https://www.hcaptcha.com/privacy</li>
</ul>
<h4>Google OAuth</h4>
<ul>
<li>Purpose: sign in with Google.</li>
<li>Endpoints: <code>accounts.google.com/o/oauth2/v2/auth</code>, <code>oauth2.googleapis.com/token</code>, and <code>openidconnect.googleapis.com/v1/userinfo</code>.</li>
<li>Data sent: authorization code, code verifier, redirect URI, client credentials, and selected scopes. Returned data can include name, verified email, avatar, and locale.</li>
<li>Terms: https://policies.google.com/terms</li>
<li>Privacy: https://policies.google.com/privacy</li>
</ul>
<h4>Apple Sign In</h4>
<ul>
<li>Purpose: sign in with Apple.</li>
<li>Endpoints: <code>appleid.apple.com/auth/authorize</code> and <code>appleid.apple.com/auth/token</code>.</li>
<li>Data sent: authorization code, client ID, redirect URI, and signed JWT assertions generated from your Apple key. Returned data can include name and email.</li>
<li>Terms: https://www.apple.com/legal/internet-services/terms/site.html</li>
<li>Privacy: https://www.apple.com/legal/privacy/</li>
</ul>
<h4>GitHub OAuth</h4>
<ul>
<li>Purpose: sign in with GitHub.</li>
<li>Endpoints: <code>github.com/login/oauth/authorize</code>, <code>github.com/login/oauth/access_token</code>, <code>api.github.com/user</code>, and <code>api.github.com/user/emails</code>.</li>
<li>Data sent: authorization code, client credentials, redirect URI, and scopes. Returned data can include ID, email, name, and avatar.</li>
<li>Terms: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li>Privacy: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement</li>
</ul>
<h4>Microsoft OAuth</h4>
<ul>
<li>Purpose: sign in with Microsoft.</li>
<li>Endpoints: <code>login.microsoftonline.com/common/oauth2/v2.0/authorize</code>, <code>login.microsoftonline.com/common/oauth2/v2.0/token</code>, and <code>graph.microsoft.com/v1.0/me</code>.</li>
<li>Data sent: authorization code, client credentials, redirect URI, and scopes. Returned data can include ID, email, name, and locale.</li>
<li>Terms: https://www.microsoft.com/licensing/terms/productoffering/MicrosoftOnlineServices/MOSPT</li>
<li>Privacy: https://privacy.microsoft.com/privacystatement</li>
</ul>
<h4>Facebook Login</h4>
<ul>
<li>Purpose: sign in with Facebook.</li>
<li>Endpoints: <code>facebook.com/v18.0/dialog/oauth</code>, <code>graph.facebook.com/v18.0/oauth/access_token</code>, and <code>graph.facebook.com/v18.0/me</code>.</li>
<li>Data sent: authorization code, app credentials, redirect URI, and scopes. Returned data can include ID, email, name, and avatar.</li>
<li>Terms: https://www.facebook.com/legal/terms</li>
<li>Privacy: https://www.facebook.com/policy.php</li>
</ul>
<h3>Hooks & Extension Points</h3>
<ul>
<li><code>oomf_access_redirect_destination</code> – override the final destination after login.</li>
<li><code>oomf-access/allowed_redirect_hosts</code> – allow approved external redirect hosts.</li>
<li><code>oomf-access/captcha/allow_external</code> – control whether CAPTCHA network calls are allowed.</li>
<li><code>oomf_access_captcha_is_required</code> – decide whether CAPTCHA is required for a request.</li>
<li><code>oomf_access_captcha_validate_result</code> – customize CAPTCHA validation results.</li>
<li><code>oomf-access/inline_css</code> – inject extra CSS into the admin preview and frontend.</li>
</ul>


oOMF! Access

Turn the default WordPress login into a branded, passwordless, social-ready access hub with redirects and layered anti-abuse controls.

Storm Consultancy

<p>Perform a 301 redirect from an uppercase URL to the lowercase version for all non-admin, non-file URLs</p>


Force Lowercase URLs

Perform a 301 redirect from an uppercase URL to the lowercase version for all non-admin, non-file URLs

oOMF! Access vs Force Lowercase URLs