Alynt Account Gateway

Alynt Account Gateway provides a branded account experience for WordPress login, registration, password management, customer dashboards, account emails, WooCommerce account handling, privacy exports, and account-related integrations.

This is private Alynt-distributed software. The plugin header includes GitHub Plugin URI: NichlasB/alynt-account-gateway for Alynt Plugin Updater compatibility.

Features

• Branded replacements for login, registration, lost password, reset password, set password, and logout confirmation screens.
• Configurable login path, account action base, after-login redirect, and emergency bypass key for direct wp-login.php access.
• Frontend output disabled by default so site owners can configure settings before public changes appear.
• Setup readiness checks that summarize critical configuration before public frontend output is enabled.
• Brand controls for logo, logo max width, background image, accessible live color pickers and hex values, custom font stacks with concrete Blocksy-loaded font examples, and four local/system typography presets with an accessible live preview.
• Screen-specific instruction copy for account gateway forms and states.
• Confirmation-first registration flow that creates a WordPress user only after the visitor confirms email and sets a valid password.
• Configurable safe role assignment for confirmed registrations, defaulting to Customer with Subscriber fallback when WooCommerce is unavailable.
• Email-only login by default, with optional email-or-username login for legacy sites that need it.
• Password validation requiring at least 12 characters with uppercase, lowercase, number, and symbol characters.
• Optional Cloudflare Turnstile and Reoon Email Verifier registration protection, plus transient-backed rate limiting.
• Branded HTML account email templates with WordPress-native Visual/Text editors, preview and test-send tools, and a reversible unsaved-change guard that stays stable across editor modes and canceled navigation.
• Custom full-page dashboard with optional WooCommerce My Account takeover that delegates standard endpoints to WooCommerce.
• Branded WooCommerce customer dashboard overview with quick links for orders, addresses, and account details.
• Custom dashboard links with labels, icons, ordering, role visibility, and new-tab support.
• Account-created webhook delivery with optional request signing, admin delivery summaries, metadata logging, and optional debug payload logging.
• Privacy exporter/eraser support for plugin-owned account, consent, verification, webhook, and audit records.
• Scheduled retention cleanup for logs and diagnostics.
• Admin diagnostics with redacted context, recent event display, CSV export, and clear controls.
• Multilingual-ready strings and generated POT file in languages/.

Requirements

• WordPress 6.0 or newer.
• PHP 7.4 or newer.
• WooCommerce is optional and only required for WooCommerce account takeover.
• Cloudflare Turnstile and Reoon integrations require site-owned API credentials.

Installation

1. Download the release zip from the Alynt GitHub release channel.
2. Install it through WordPress admin under Plugins -> Add New -> Upload Plugin.
3. Activate Alynt Account Gateway.
4. Open Settings -> Account Gateway and configure the plugin before enabling frontend output.

Basic Configuration

Recommended first pass:

1. Set the Login URL Path and Account Action Base.
2. Confirm the After Login Redirect.
3. Upload the brand logo and optional gateway background image.
4. Review colors and button colors, then choose a typography preset or customize the font stacks.
5. Configure Terms and Privacy relative paths.
6. Confirm the safe role assigned to newly confirmed registrations.
7. Decide whether public registration should be enabled.
8. Configure Turnstile or Reoon before enabling registration on public sites.
9. Preview/test account emails.
10. Enable the dashboard and WooCommerce takeover only after confirming account pages locally.
11. Enable Frontend Output when the configuration is ready.

Gateway Screens And Preview

The gateway uses a single-column layout below 800px and an optional two-column layout at wider widths. The configured background image appears only in the desktop layout; tall portrait artwork around 1280 x 1920 pixels gives the most reliable crop.

Use Settings -> Account Gateway -> Advanced / Tools -> Gateway Screen Preview to inspect every branded screen while Frontend Output remains disabled. Preview is administrator-only and does not enable public routing.

FAQ

Does the emergency bypass sign me in?

No. wp-login.php?alynt_ag_bypass={key} only bypasses the branded screen redirect. It does not authenticate the visitor or grant access to wp-admin.

Why is the Create Account link missing?

It is intentionally omitted whenever Enable Public Account Creation is disabled. Existing customers can still log in or reset a password.

Can I use the dashboard without WooCommerce?

Yes. The custom dashboard is optional and works without WooCommerce. WooCommerce takeover and its account endpoints require WooCommerce to be active.

Can I customize email formatting?

Yes. Each email body uses WordPress's Visual/Text editor with safe HTML formatting. The plugin owns the email wrapper and action-button presentation so account mail remains consistent and resilient in mailbox clients.

Security Notes

• The emergency bypass only restores access to the native WordPress login screen; it does not authenticate anyone or grant admin access.
• Administrators and shop managers may access wp-admin; other users are redirected to the configured account destination.
• Turnstile tokens are verified server-side when Turnstile is configured.
• Webhook payload bodies are stored only when Debug Payload Logging is enabled.
• Secrets must be stored in plugin settings, not in code or documentation.

Privacy Notes

• Review docs/PRIVACY_AND_GDPR.md before enabling public registration, Turnstile, Reoon, webhooks, diagnostics, or WooCommerce takeover on production sites.
• The plugin provides WordPress personal-data exporter and eraser callbacks for plugin-owned records, but WordPress users, WooCommerce orders, media-library files, and third-party provider records remain under their owning systems.
• Site owners remain responsible for privacy notice wording, lawful-basis decisions, processor contracts, retention policy, and qualified legal review where required.

Uninstall

Deleting the plugin removes its settings, schema version, custom tables, rate-limit and operation-lock state, and scheduled retention and webhook events. Multisite cleanup covers every separately activated site. WordPress users, WooCommerce data, media-library attachments, menus, and third-party provider records are retained.

Development

npm install
php ./composer.phar install
npm run build
npm run lint
npm test

If Composer is available globally, composer install can be used instead of php ./composer.phar install.

Documentation

• Settings reference
• Hooks reference
• Operations guide
• Privacy and GDPR guide
• Production rollout playbook
• Readiness plan
• Changelog

License

GPL-2.0-or-later.