WPCalibrate Registration Manager

Adds a secure front-end user registration, login, password recovery, email verification, approval, profile-management, and registration-form system to WordPress.

📖 About

WPCalibrate Registration Manager is a production-grade, extensible WordPress registration and user management system designed specifically for modern sites that require custom registration workflows without sacrificing security or creating fragmented user silos.

Native WordPress Source of Truth

Unlike third-party plugins that store users in proprietary database tables, WPCalibrate Registration Manager uses native WordPress users (wp_users and wp_usermeta) as the absolute source of truth. Every registered user is a real WordPress user account immediately compatible with:

• Core WordPress roles, capabilities, and permissions
• WooCommerce customer accounts and order histories
• LMS plugins (LearnDash, LifterLMS, Tutor LMS)
• Membership plugins and custom post type access controls
• Core user export/import tools and WP-CLI commands

Zero Bloat & Strict Architecture

• Pure Native WP Standards: Strict PSR-4 autoloading, zero external PHP framework overhead, and zero jQuery dependencies.
• Enterprise Security: Cryptographically secure email verification tokens (HMAC-SHA256), strict role privilege escalation guards, anti-enumeration defenses, timing attack mitigation, and spreadsheet formula injection defenses on CSV exports.
• Modern Accessibility & UX: Clean, WCAG 2.1 AA accessible front-end forms with responsive flexbox styling, client/server validation, and native Gutenberg block integration.

✨ Features

📋 Custom Registration Form Builder

• Custom Post Type (wpcalreg_form): Create and manage unlimited unique registration forms tailored for different user groups (e.g., standard members, partners, wholesale applicants, beta testers).
• Custom Form Fields: Configure text, email, select dropdowns, textareas, checkboxes, radio buttons, numbers, and URLs.
• Field-Level Validation: Mandatory flags, regex validation, min/max length rules, and custom helper instructions.
• Strict Role Isolation: Assign default roles per form from a strictly sanitized allowlist. High-privilege roles like administrator are protected against escalation.

🛡️ Four Operating Workflows

🔒 Enterprise Spam & Abuse Defenses

• Invisible Honeypot Trap: Transparent, CSS-hidden anti-bot honeypot fields that catch automated form submission scripts without disturbing human visitors.
• Cloudflare Turnstile Support: Built-in adapter for privacy-preserving, non-intrusive CAPTCHA challenges with safe fallback handling.
• Transient-Based Rate Limiting: Enforces submission attempt limits per IP address to safeguard against automated brute-force flooding.
• Anti-Enumeration Safeguards: Prevents malicious actors from probing whether specific usernames or email addresses exist on the system.

👤 Profile & Account Management

• Front-End Profile Editor: Let users manage their display name, email, password, and custom registration fields without ever needing access to wp-admin.
• Front-End Authentication: Dedicated shortcodes and Gutenberg blocks for Login, Password Recovery, and Logout.
• Custom Redirects: Configurable redirect routing upon login, registration, logout, and verification.

📊 Admin Tools & Overview Dashboard

• Branded Dashboard Menu: Features official WPCalibrate branding with dark/white responsive SVG/PNG icons and streamlined layout.
• Overview Tab: System snapshot cards displaying total registered users, active accounts, pending verification, and pending approvals, alongside architecture guides and quickstart instructions.
• Dedicated Registrations Table: Enhanced WP_List_Table with filter tabs (All, Pending Email, Pending Approval, Active, Rejected), batch actions, status badges, and 1-click CSV export with formula injection sanitization.
• GDPR Privacy Compliance: Registered with WordPress core Personal Data Exporter and Personal Data Eraser.
• Lifecycle Management: Safe, idempotent database schema migrations and optional destructive data purge upon uninstallation.

🔄 Updating from WordPress Dashboard

This plugin features built-in GitHub Release Update Integration:

• Whenever a new release is published on GitHub, WordPress automatically discovers the update during its scheduled background transient checks.
• You will see the update notification badge under Dashboard → Updates and Plugins → Installed Plugins.
• Click "Update Now" or click "View version details" to view changelogs and upgrade directly inside your WordPress dashboard.
• Compatible with Git Updater and standard WordPress update pipelines via Update URI and GitHub Plugin URI headers.

🚀 How to Use & Documentation

1. Shortcodes Reference

Embed forms and account interfaces anywhere using standard WordPress shortcodes:

Registration Form Shortcode

[wpcalreg_form]

Attributes:

• id: (Optional) Form post ID to render a specific registration form layout. If omitted, uses the default global form.
• redirect: (Optional) URL to redirect the user to after successful registration.

[wpcalreg_form id="142" redirect="/welcome/"]

Login Form Shortcode

[wpcalreg_login]

Attributes:

• redirect: (Optional) Custom destination URL after successful authentication.
• show_lost_password: (Optional, default: "yes") Set to "no" to hide the forgot password link.

[wpcalreg_login redirect="/my-account/" show_lost_password="yes"]

Profile Editor Shortcode

[wpcalreg_profile]

Renders a responsive front-end profile management screen allowing authenticated users to update their bio, custom fields, email, and password.

Lost Password Shortcode

[wpcalreg_lostpassword]

Renders a secure front-end password reset request form.

2. Native Gutenberg Blocks

WPCalibrate Registration Manager includes 4 native Gutenberg blocks in the block inserter under the WPCalibrate category:

1. WPCalibrate: Registration Form - Select which form layout to render and configure redirect parameters directly in the block inspector.
2. WPCalibrate: Login Form - Place a styled login component anywhere on landing pages or headers.
3. WPCalibrate: Profile Editor - Build branded member portals in the Site Editor or block pages.
4. WPCalibrate: Lost Password - Create dedicated password recovery pages.

3. Developer Hooks & API

Customize workflows using standard WordPress actions and filters:

// Hook into successful registrations
add_action( 'wpcalreg_after_registration', function( int $user_id, array $form_data ) {
    // Custom CRM sync or custom welcome notification logic
}, 10, 2 );

// Hook into administrator approval events
add_action( 'wpcalreg_user_approved', function( int $user_id, int $approver_id ) {
    // Notify external services or grant custom badges
}, 10, 2 );

// Filter allowed roles assignable by registration forms
add_filter( 'wpcalreg_allowed_registration_roles', function( array $roles ) {
    // Add custom custom post type contributor roles
    $roles['member'] = 'Member';
    return $roles;
} );

📥 Installation

Method 1: WordPress Dashboard Upload (Recommended)

1. Download the latest wpcalibrate-registration-manager-1.0.0.zip from Releases.
2. Navigate to your WordPress Admin dashboard: Plugins → Add New Plugin → Upload Plugin.
3. Choose the ZIP file and click Install Now.
4. Click Activate Plugin.

Method 2: Manual Installation via FTP

1. Extract the downloaded ZIP archive.
2. Upload the wpcalibrate-registration-manager folder to the /wp-content/plugins/ directory on your server.
3. In WordPress admin, navigate to Plugins → Installed Plugins and activate WPCalibrate Registration Manager.

📋 Changelog

[1.0.0] - 2026-10-10

• Initial Production Release:
  • Native WordPress user integration with zero third-party account silos.
  • Multi-form registration architecture via custom post types.
  • Custom field builder supporting text, email, select, textarea, checkbox, radio, number, and URL.
  • 4 distinct onboarding workflows: Direct, Email Verification, Admin Approval, and Two-Stage.
  • HMAC-SHA256 cryptographically secure single-use email verification tokens.
  • Front-end Login, Profile Editor, and Password Recovery forms with full shortcode & Gutenberg block support.
  • Invisible honeypot trap, transient-based IP rate limiting, and Cloudflare Turnstile integration.
  • Anti-enumeration protection on lost password and login endpoints.
  • Enhanced WP_List_Table for member management with CSV export & formula injection mitigation.
  • Dedicated Overview tab with operational guidelines, workflow matrix, and quickstart cards.
  • Built-in GitHub in-dashboard update checker and provider.
  • Full GDPR personal data export and erasure compliance.
  • Automated PHP and browser test suites passing 100%.

💬 Support & Community

• Website: https://wpcalibrate.com
• Marketplace: https://marketplace.wpcalibrate.com
• Documentation: https://docs.wpcalibrate.com
• Issues & Contributions: GitHub Issues
• Support Email: support@wpcalibrate.com

📄 License

This plugin is free software, licensed under the terms of the GNU General Public License v2.0 or later.

Copyright © 2026 WPCalibrate.