By SBS Login WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

The By SBS login screen as a plugin: particle wordmark, SBS palette, and a signature that links home. One repo, so an edit reaches every site.

Why a plugin

It began as theme/<prefix>/inc/login.php and was copied per project. By the time it was worth keeping, eight repos carried a version of it and seven were still on the 210-line starter. A file in eight places does not get updated in eight places — it drifts, and the oldest copy is the one a client sees.

Install on a site

1. Install and activate the plugin.
2. In the same step, delete theme/<prefix>/inc/login.php and its require in functions.php. They do not fatal together, but both hook login_head, so leaving the old one gives two stylesheets and two particle canvases stacked on each other.

Nothing else. No prefix rename, no enqueue wiring, no build step.

Releasing

Always attach the built zip. ./build.sh produces dist/bysbs-login.zip with bysbs-login/ as its top-level directory; upload that to the release.

GitHub's generated source zip unpacks to psnac-bysbs-login-<sha>/, and WordPress names the plugin folder after whatever it finds inside the archive. A fresh install from the zipball therefore lands in psnac-bysbs-login-<sha>/. It runs — but the first update then renames the folder underneath a running plugin. upgrader_source_selection cannot rescue the install case: the plugin is not loaded yet, so its filters are not registered. Shipping a correct archive is the only fix, and inc/updater.php prefers an uploaded .zip asset over the zipball for exactly this reason.

./build.sh
gh release create v1.1.0 --notes "…" dist/bysbs-login.zip

Updating every site

Tag a release. Each site's twice-daily update cron sees it and — because auto-updates are on by default — installs it without anyone logging in.

Bump the Version: header and BYSBS_LOGIN_VERSION, then cut a release as above. Verified end to end: a site's own cron sees the release, installs it, keeps the folder name and stays active.

Pin a site by putting define('BYSBS_LOGIN_AUTOUPDATE', false); in its wp-config.php.

What it covers

Every screen wp-login.php renders: login, logged-out, lost password, reset password (including the strength meter states), register, check-your-email, confirm-admin-email, the GDPR confirm-action screen, error notices, and the interim-login modal that appears over wp-admin when a session expires. Wordfence's 2FA overlay is repainted too.

reCAPTCHA: the widget is a cross-origin iframe served by google.com, so no CSS can reach inside it. The plugin hands it data-theme="dark" before Google renders, which is the only lever there is — verified against a live widget. A plugin that calls grecaptcha.render() with its own theme option overrides this; that is a setting in that plugin.

Not covered: wp_die() error pages — the white screen you get from, say, an expired logout nonce. That is WordPress's global error handler, not the login screen; restyling it means replacing wp_die_handler for the entire site.

Requirements

WordPress 6.0+, PHP 7.4+. No build step, no dependencies, no external requests from the visitor's browser — the font and the mark are served from this plugin. The only outbound call is the update check to api.github.com, from the server, cached for 12 hours.