{"id":260508,"date":"2026-05-13T22:00:01","date_gmt":"2026-05-13T22:00:01","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/oomf-access\/"},"modified":"2026-05-13T21:59:36","modified_gmt":"2026-05-13T21:59:36","slug":"oomf-access","status":"publish","type":"plugin","link":"https:\/\/en-za.wordpress.org\/plugins\/oomf-access\/","author":23408428,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"1.0.0","stable_tag":"1.0.0","tested":"6.9.4","requires":"6.2","requires_php":"8.1","requires_plugins":null,"header_name":"oOMF! Access","header_author":"oOMF!","header_description":"Craft a secure, branded login experience with magic links, social sign-in, redirects, and protective anti-abuse tools from oOMF! Access.","assets_banners_color":"333333","last_updated":"2026-05-13 21:59:36","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/oomf-dev?tab=repositories","header_author_uri":"https:\/\/github.com\/oomf-dev","rating":0,"author_block_rating":0,"active_installs":0,"downloads":39,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"oomf","date":"2026-05-13 21:59:36"}},"upgrade_notice":{"1.0.0":"

Major feature release with captcha providers, Hide Admin, and social login improvements. Review new security settings after updating to tailor them to your site.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3531414,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3531414,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3531439,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3531439,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3531439,"resolution":"1","location":"assets","locale":"","width":1280,"height":900},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3531439,"resolution":"2","location":"assets","locale":"","width":1280,"height":900}},"screenshots":{"1":"Login card with accent color, form labels, remember-me toggle, and links.","2":"Admin settings screen with live preview and content, behavior, and security controls."},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[710,2604,602,726,600],"plugin_category":[38,54],"plugin_contributors":[262849],"plugin_business_model":[],"class_list":["post-260508","plugin","type-plugin","status-publish","hentry","plugin_tags-authentication","plugin_tags-branding","plugin_tags-login","plugin_tags-redirects","plugin_tags-security","plugin_category-authentication","plugin_category-security-and-spam-protection","plugin_contributors-oomf","plugin_committers-oomf"],"banners":{"banner":"https:\/\/ps.w.org\/oomf-access\/assets\/banner-772x250.png?rev=3531439","banner_2x":"https:\/\/ps.w.org\/oomf-access\/assets\/banner-1544x500.png?rev=3531439","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/oomf-access\/assets\/icon-128x128.png?rev=3531414","icon_2x":"https:\/\/ps.w.org\/oomf-access\/assets\/icon-256x256.png?rev=3531414","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/oomf-access\/assets\/screenshot-1.png?rev=3531439","caption":"Login card with accent color, form labels, remember-me toggle, and links."},{"src":"https:\/\/ps.w.org\/oomf-access\/assets\/screenshot-2.png?rev=3531439","caption":"Admin settings screen with live preview and content, behavior, and security controls."}],"raw_content":"\n

oOMF! Access delivers a polished WordPress login experience with guided flows for login, registration, lost password, and password reset. Offer passwordless magic links, social sign-in, and smart redirect control while layering in hide-admin, CAPTCHA, honeypot, and soft throttling safeguards \u2014 all without writing custom code.<\/p>\n\n

Key features\n- Branded login page rendered via the [oomf_access_form]<\/code> shortcode, with activation creating a dedicated page stored in oomf_access_page_id<\/code>\u2014and the \/oomf-access\/<\/code> route continues to load the bundled template even if that page is removed.\n- Smart and safe post-login redirects with Redirects::validate_safe_redirect()<\/code> and pluggable filters.\n- Passwordless magic link login plus social providers (Google, Apple, GitHub, Microsoft, Facebook) with admin previews.\n- Multiple CAPTCHA providers (reCAPTCHA v2 checkbox, v2 invisible, v3, and hCaptcha) and honeypot\/throttle helpers to slow abuse.\n- Hide Admin \/ secret login path support to obscure \/wp-login.php<\/code> and \/wp-admin<\/code> from anonymous users while keeping emergency bypasses available.\n- Minimal asset footprint: frontend\/admin JS & CSS load only where needed and are versioned with filemtime()<\/code>.\n- Developer hooks and filters to customize redirects, captcha behavior, allowed hosts, provider scopes, and more.<\/p>\n\n

Privacy<\/h3>\n\n

oOMF! Access does not send data to oOMF! services. If you enable CAPTCHA or Social Login, your site sends authentication and verification requests to those third-party providers as described in the External services section below. Removing the plugin deletes its settings (and the generated login page if you opt in via the oomf_access\/delete_page_on_uninstall<\/code> filter).<\/p>\n\n

External services<\/h3>\n\n

oOMF! Access only connects to outside services when you enable the related feature and provide your own credentials. Each integration below explains what is sent and links to the provider policies:<\/p>\n\n

Google reCAPTCHA (v2\/v3)<\/h4>\n\n
    \n
  • Purpose: spam\/abuse protection for the login forms.<\/li>\n
  • Endpoints: loads scripts from https:\/\/www.google.com\/recaptcha\/api.js and validates tokens via https:\/\/www.google.com\/recaptcha\/api\/siteverify.<\/li>\n
  • Data sent: your site key\/secret, the visitor\u2019s reCAPTCHA token, the page action name, and optionally the visitor IP if you enable the strict remote IP check.<\/li>\n
  • Terms: https:\/\/policies.google.com\/terms \u2014 Privacy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n

    hCaptcha<\/h4>\n\n
      \n
    • Purpose: CAPTCHA validation when you switch to the hCaptcha provider.<\/li>\n
    • Endpoints: loads scripts from https:\/\/js.hcaptcha.com and validates tokens via https:\/\/hcaptcha.com\/siteverify.<\/li>\n
    • Data sent: your site key\/secret, the response token, the page action, and optionally the visitor IP per hCaptcha requirements.<\/li>\n
    • Terms: https:\/\/www.hcaptcha.com\/terms \u2014 Privacy: https:\/\/www.hcaptcha.com\/privacy<\/li>\n<\/ul>\n\n

      Google OAuth (Social Login)<\/h4>\n\n
        \n
      • Purpose: allow users to sign in with their Google account.<\/li>\n
      • Endpoints: Google Accounts OAuth screen at https:\/\/accounts.google.com\/o\/oauth2\/v2\/auth, token exchange at https:\/\/oauth2.googleapis.com\/token, and profile data from https:\/\/openidconnect.googleapis.com\/v1\/userinfo.<\/li>\n
      • Data sent: OAuth authorization code, code verifier (for PKCE), redirect URI, and the scopes you configure. After exchanging the code we request the profile name, verified email, avatar, and locale.<\/li>\n
      • Terms: https:\/\/policies.google.com\/terms \u2014 Privacy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n

        Apple Sign In<\/h4>\n\n
          \n
        • Purpose: Sign in with Apple for Social Login.<\/li>\n
        • Endpoints: OAuth screen at https:\/\/appleid.apple.com\/auth\/authorize and token exchange at https:\/\/appleid.apple.com\/auth\/token.<\/li>\n
        • Data sent: OAuth authorization code, client ID, redirect URI, and signed JWT assertions generated from the private key you upload. Apple returns the user\u2019s name and email (when available).<\/li>\n
        • Terms: https:\/\/www.apple.com\/legal\/internet-services\/terms\/site.html \u2014 Privacy: https:\/\/www.apple.com\/legal\/privacy\/<\/li>\n<\/ul>\n\n

          GitHub OAuth<\/h4>\n\n
            \n
          • Purpose: Social login via GitHub accounts.<\/li>\n
          • Endpoints: OAuth screen at https:\/\/github.com\/login\/oauth\/authorize, token exchange at https:\/\/github.com\/login\/oauth\/access_token, and profile APIs at https:\/\/api.github.com\/user and https:\/\/api.github.com\/user\/emails.<\/li>\n
          • Data sent: OAuth authorization code, client ID\/secret, redirect URI, and scope list. After exchanging the code GitHub returns the user\u2019s numeric ID, primary email(s), display name, and avatar URL.<\/li>\n
          • Terms: https:\/\/docs.github.com\/en\/site-policy\/github-terms\/github-terms-of-service \u2014 Privacy: https:\/\/docs.github.com\/en\/site-policy\/privacy-policies\/github-privacy-statement<\/li>\n<\/ul>\n\n

            Microsoft (Azure AD \/ Entra ID)<\/h4>\n\n
              \n
            • Purpose: allow sign-in with Microsoft accounts.<\/li>\n
            • Endpoints: OAuth screen at https:\/\/login.microsoftonline.com\/common\/oauth2\/v2.0\/authorize and token exchange at https:\/\/login.microsoftonline.com\/common\/oauth2\/v2.0\/token. Profile data is requested from https:\/\/graph.microsoft.com\/v1.0\/me.<\/li>\n
            • Data sent: client ID, redirect URI, and selected scopes when the visitor starts Microsoft sign-in; then (on callback) the returned OAuth authorization code plus the configured client secret for token exchange. Microsoft returns the profile ID, email, name, and locale when available.<\/li>\n
            • Terms: https:\/\/www.microsoft.com\/licensing\/terms\/productoffering\/MicrosoftOnlineServices\/MOSPT \u2014 Privacy: https:\/\/privacy.microsoft.com\/privacystatement<\/li>\n<\/ul>\n\n

              Facebook Login<\/h4>\n\n
                \n
              • Purpose: Social login via Facebook accounts.<\/li>\n
              • Endpoints: OAuth screen at https:\/\/www.facebook.com\/v18.0\/dialog\/oauth and token\/profile APIs at https:\/\/graph.facebook.com\/v18.0\/oauth\/access_token and https:\/\/graph.facebook.com\/v18.0\/me.<\/li>\n
              • Data sent: OAuth authorization code, app ID\/secret, redirect URI, and scopes. Facebook returns the user ID, email (if available), and profile name\/avatar.<\/li>\n
              • Terms: https:\/\/www.facebook.com\/legal\/terms \u2014 Privacy: https:\/\/www.facebook.com\/policy.php<\/li>\n<\/ul>\n\n

                Hooks & Extension Points<\/h3>\n\n

                Notable filters\/actions you can rely on when extending oOMF! Access:\n- oomf_access_redirect_destination<\/code> \u2014 override the final destination after login.\n- oomf-access\/allowed_redirect_hosts<\/code> \u2014 allow specific external redirect hosts.\n- oomf-access\/captcha\/allow_external<\/code> \u2014 control whether provider network calls are allowed on privacy-restricted sites.\n- oomf_access_captcha_is_required<\/code> \u2014 decide if captcha is required for a particular request.\n- oomf_access_captcha_validate_result<\/code> \u2014 customize captcha validation results.\n- oomf-access\/inline_css<\/code> \u2014 inject extra CSS into admin preview and frontend styles.<\/p>\n\n

                For developer notes on autoloading, templates, and class layout, see the repo README.md<\/code>.<\/p>\n\n\n

                  \n
                1. Upload the plugin folder to \/wp-content\/plugins\/<\/code> or install via Plugins \u2192 Add New by uploading the zip.<\/li>\n
                2. Activate the plugin. Activation creates the public \"Login\" page and stores its ID in oomf_access_page_id<\/code>.<\/li>\n
                3. Configure via Settings \u2192 oOMF! Access (branding, redirects, magic links, social providers, CAPTCHA, hide-admin slug, etc.).<\/li>\n<\/ol>\n\n\n
                  \n

                  Where is the login page?<\/h3><\/dt>\n

                  On activation the plugin creates a page (option oomf_access_page_id<\/code>) that contains [oomf_access_form]<\/code>. You can edit or move that page, and even if it is deleted the \/oomf-access\/<\/code> route will still render the branded experience.<\/p><\/dd>\n

                  Does it replace my theme template?<\/h3><\/dt>\n

                  The shortcode inherits your active theme when embedded elsewhere. The dedicated login page generated by the plugin automatically uses the bundled minimal template at templates\/oomf-access-page-template.php<\/code> to keep the experience consistent.<\/p><\/dd>\n

                  How do redirects work?<\/h3><\/dt>\n

                  If redirect_to<\/code> is supplied and validates as safe, it is used. Otherwise we fall back to the configured post-login destination, then to the default WP admin. Use the oomf-access\/allowed_redirect_hosts<\/code> filter to permit specific off-site domains and oomf_access_redirect_destination<\/code> to override the final destination.<\/p><\/dd>\n

                  What captcha providers are supported?<\/h3><\/dt>\n

                  reCAPTCHA v2 (checkbox & invisible), reCAPTCHA v3, and hCaptcha. Provider scripts are enqueued only on login pages; validation happens server-side via includes\/Security\/Captcha\/<\/code> providers. Use oomf_access_captcha_is_required<\/code> or oomf_access_captcha_validate_result<\/code> to customize behavior.<\/p><\/dd>\n

                  How does Hide Admin work?<\/h3><\/dt>\n

                  When enabled, the plugin rewrites or blocks direct access to \/wp-login.php<\/code> and \/wp-admin<\/code> for unauthenticated users and exposes a secret login slug (configurable). Emergency bypasses are available for specific flows and query flags.<\/p><\/dd>\n

                  How do I set up Social login?<\/h3><\/dt>\n

                  Open Settings \u2192 oOMF! Access \u2192 Social. Each provider has setup instructions and a callback\/redirect URL hint; create the corresponding OAuth app with that callback. Apple requires additional keys (Service ID, Team ID, Key ID, Private Key .p8) and server-side OpenSSL support.<\/p><\/dd>\n\n<\/dl>\n\n\n

                  1.0.0 - 2026-03-24<\/h4>\n\n
                    \n
                  • Fixed: Magic link nonce verification now derives the nonce action from validated token data to prevent user-controlled input from influencing verification.<\/li>\n
                  • Fixed: Documented emergency bypass parameters as intentionally nonce-free for break-glass use.<\/li>\n
                  • Fixed: Settings AJAX handler now reads serialized form data with a sanitizing filter up front.<\/li>\n
                  • Added: Captcha provider integrations (reCAPTCHA v2\/v3 and hCaptcha) with admin preview and server-side validation.<\/li>\n
                  • Added: Hide Admin feature with configurable secret login slug and graceful bypass flows.<\/li>\n
                  • Improved: Social login \u2014 full Sign in with Apple implementation; admin preview for Microsoft\/Facebook; ordering and provider preview improvements.<\/li>\n
                  • Improved: Asset loading and versioning via filemtime()<\/code>, reduced unnecessary DOM injection for sticky nav fallbacks.<\/li>\n
                  • Developer: New filters and clearer extension points for redirects and captcha.<\/li>\n<\/ul>","raw_excerpt":"Craft a secure, branded login experience with magic links, social sign-in, smart redirects, and layered anti-abuse tools.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/260508","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=260508"}],"author":[{"embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/oomf"}],"wp:attachment":[{"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=260508"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=260508"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=260508"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=260508"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=260508"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/en-za.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=260508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}