Talisa @ Page Authority

<p>Allowed Email Domains gives administrators a simple way to restrict WordPress user accounts to approved email domains.</p>
<p>The plugin is designed for sites where only users from specific organizations, companies, clients, or teams should be added as WordPress users.</p>
<p>Features include:</p>
<ul>
<li>Admin-managed allowed domain list</li>
<li>Standard WordPress registration enforcement</li>
<li>REST API user creation/update enforcement</li>
<li>WooCommerce registration enforcement</li>
<li>Existing User Audit tools</li>
<li>Optional login enforcement</li>
<li>Per-user unauthorized account removal with content reassignment</li>
<li>Multisite-aware protections</li>
<li>Lightweight architecture with no custom database tables</li>
</ul>
<h3>Security Notes</h3>
<p>The plugin includes:</p>
<ul>
<li>Capability checks</li>
<li>Nonce verification (verified before any state-changing logic runs)</li>
<li>Sanitization and escaping</li>
<li>Live revalidation before destructive actions</li>
<li>Current-admin protection</li>
<li>Multisite Super Admin protection</li>
<li>Explicit content reassignment or delete confirmation before user removal</li>
</ul>
<p>Recommended operational practices:</p>
<ul>
<li>Review the Existing User Audit before enabling login blocking</li>
<li>Test custom registration and SSO flows before production rollout</li>
<li>Maintain regular database backups before deleting users</li>
<li>Restrict plugin management access to trusted administrators only</li>
</ul>
<h3>Uninstall</h3>
<p>Deleting the plugin removes its current options:</p>
<ul>
<li><code>pageauth_allowed_domains</code></li>
<li><code>pageauth_audit_log</code></li>
<li><code>pageauth_block_unauthorized_logins</code></li>
</ul>
<p>It also cleans up internal flags, transients, user meta, and any leftover keys from prior plugin versions that used the <code>paad_</code> or <code>aed_</code> prefixes. On multisite, the matching network options are removed as well.</p>


Page Authority – Allowed Domains

Restrict WordPress user accounts to administrator-approved email domains.

webhosting4ugr

<p>WH4U Domains is a WordPress plugin that allows website owners and resellers to offer domain name services directly from their WordPress site. It integrates with the DomainsReseller API to provide real-time domain availability checking, registration, and transfer capabilities.</p>
<h4>Features</h4>
<ul>
<li><strong>Domain Search</strong> — Visitors can search for domain availability via a shortcode or Gutenberg block</li>
<li><strong>Public Registration & Transfer</strong> — Anonymous visitors can submit domain registration and transfer requests that admins review and approve</li>
<li><strong>Admin Dashboard</strong> — Full admin panel for managing orders, viewing API status, and monitoring the retry queue</li>
<li><strong>Reseller Support</strong> — Per-user API credentials allow multi-reseller setups</li>
<li><strong>Retry Queue</strong> — Failed API calls are automatically retried with exponential backoff</li>
<li><strong>Shopping Cart Redirect</strong> — Optional redirect to WHMCS, Blesta, ClientExec, Upmind, or custom cart URL with the domain pre-filled when visitors click Register or Transfer</li>
<li><strong>Internationalization</strong> — Fully translatable; Greek translation included</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and activate the plugin</li>
<li>Configure your DomainsReseller API credentials under Domains > Settings</li>
<li>Add the <code>[wh4u_domain_lookup]</code> shortcode or the “Domain Lookup” block to any page</li>
<li>Visitors search for domains — available domains can be registered, and taken domains can be transferred through the frontend form (or, if configured, sent to your WHMCS/Blesta/ClientExec/Upmind cart with the domain in the URL)</li>
<li>Admins review and approve/reject public orders from the WordPress admin</li>
</ol>
<h3>Third-Party Service</h3>
<p>This plugin connects to the <strong>DomainsReseller API</strong> provided by WebHosting4U to perform all domain-related operations.</p>
<h4>What data is sent</h4>
<ul>
<li><strong>Domain lookups</strong>: The domain name being searched is sent to check availability</li>
<li><strong>Domain registration</strong>: Registrant contact information (name, email, phone, address, company, country), the domain name, registration period, nameservers, and addon preferences are sent to process the registration</li>
<li><strong>Domain transfer</strong>: Domain name, registration period, and EPP code are sent</li>
<li><strong>TLD queries</strong>: Requests for available TLDs are sent</li>
</ul>
<h4>When data is sent</h4>
<ul>
<li>When a visitor performs a domain search on the frontend</li>
<li>When an admin approves a public domain registration order</li>
<li>When an admin submits a registration or transfer order from the admin panel</li>
<li>When TLD lists are loaded (cached locally for 12 hours)</li>
</ul>
<h4>Service details</h4>
<ul>
<li><strong>Service provider</strong>: WebHosting4U</li>
<li><strong>Service URL</strong>: <a href="https://webhosting4u.gr" rel="nofollow ugc">https://webhosting4u.gr</a></li>
<li><strong>Terms of Service</strong>: <a href="https://webhosting4u.gr/terms-of-service.php" rel="nofollow ugc">https://webhosting4u.gr/terms-of-service.php</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://webhosting4u.gr/privacy-policy.php" rel="nofollow ugc">https://webhosting4u.gr/privacy-policy.php</a></li>
</ul>
<h4>Cloudflare Turnstile (optional)</h4>
<p>When Turnstile bot protection is enabled in Settings, this plugin loads the Cloudflare Turnstile JavaScript widget on pages with the domain lookup form and sends the challenge response token to Cloudflare for server-side verification before processing public orders.</p>
<ul>
<li><strong>Service provider</strong>: Cloudflare, Inc.</li>
<li><strong>Service URL</strong>: <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">https://www.cloudflare.com/products/turnstile/</a></li>
<li><strong>Terms of Service</strong>: <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">https://www.cloudflare.com/terms/</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">https://www.cloudflare.com/privacypolicy/</a></li>
</ul>
<h4>Data stored locally</h4>
<p>This plugin stores the following data on your WordPress installation:</p>
<ul>
<li><strong>Order records</strong>: domain name, registration period, status, and encrypted registrant contact details (encrypted with AES-256-CBC + HMAC at rest)</li>
<li><strong>Public order submissions</strong>: stored as a custom post type with encrypted contact data until an administrator approves or rejects them</li>
<li><strong>API logs</strong> and <strong>notification records</strong>: request/response entries and email/webhook dispatch history with secrets redacted. A daily WP-Cron task prunes rows older than 30 days; the retention period is filterable via the <code>wh4u_log_retention_days</code> filter.</li>
<li><strong>Retry queue</strong>: failed API calls scheduled for exponential-backoff retry via WP-Cron</li>
<li><strong>Rate-limit counters</strong>: short-lived transients keyed by user ID or a salted SHA-256 hash of the visitor IP; used only for abuse protection and expire within minutes</li>
<li><strong>Reseller settings</strong>: per-user API credentials, with the API key and optional webhook secret encrypted at rest</li>
</ul>
<p>No data is sent to any third party other than the services listed above.</p>


WH4U Domains

Domain reseller plugin for searching, registering, and transferring domains via the DomainsReseller API.

Page Authority – Allowed Domains vs WH4U Domains