atshift Members Guide

Use HTTPS in production. HTTP is permitted only when the WordPress environment type is local. The initial WordPress.org release is in preparation; confirm availability and install in staging first.

Verify mail delivery and WP-Cron. Confirmation messages are processed from a queue, so registration cannot progress when cron is not running. Members does not supply a mail delivery service.

Exclude member pages, logged-in pages, and private-file delivery from shared caches at the plugin, server, and CDN layers. Check any other public registration forms and APIs separately.

As a site administrator, use the page preparation tools in Members. Each purpose has its own shortcode. Publish the relevant pages and verify their configured URLs.

Optionally generate a member-home draft. Existing generated pages are not overwritten, and neither the front page nor the post-login destination is automatically changed. Configure the directory separately if you need it.

• Account page shortcodes

Save the Cloudflare Turnstile site and secret keys in registration settings. Server constants take priority when defined. Cloudflare test keys are rejected in production.

A visitor submits an email address and follows the confirmation link. They then enter a username, password, and configured profile fields. The current username format is 1-60 letters, numbers, periods, hyphens, or underscores.

Rate limits cover sources, networks, browsers, and email destinations, alongside compromised-password checks. A failed Turnstile check blocks the request. By default, an unavailable Pwned Passwords service also prevents acceptance of a new password.

Without approval enabled, completion activates the member. With approval enabled, the account waits for review. These controls reduce abuse but do not replace a WAF, server maintenance, or operational monitoring.

• Data sent to external services

Standalone settings let you select native profile fields. When atshift User Profile Fields supplies its supported owner-form integration, its configuration takes priority over standalone selections. Supported ordering, groups, and conditions are retained; admin-only fields are not accepted as member input.

Classification-based posting and directory rules require a compatible atshift User Profile Fields Pro classification integration. Do not assume that removing a provider or its classifications should broaden a restricted audience.

Freeform Login can provide passkey management on the account editing page, including without atshift User Profile Fields. Availability depends on Freeform Login settings and its environment requirements.

• User Profile Fields
• Freeform Login

Members discovers post types using the normal WordPress editor and capability mapping. It does not automatically create types or change their names or URLs. Standard posts initially allow active members; pages and other types initially allow none.

A grant allows creation, publication, editing, and deletion of the member's own content. It does not grant editing of other authors' work or member administration. Members service pages are not editable by ordinary members.

Posting permission and viewing restrictions are separate. Ordinary published posts remain public. Revoking permission does not automatically change or delete previously published content.

Choose a public, active-member, operator, or classification-based audience. Select which classifications to list and which fields to show: display name, affiliation, and biography.

Individual exclusions override listing rules without changing the account or its permissions. Making a directory public does not make a private profile page public.

Login names and email addresses are not dedicated output fields, but members may put personal information in free-text fields. Review the purpose and audience before enabling the directory.

[atshme_member_directory heading_tag="h3" per_page="20"]

• Directory attributes and limits

An administrator must create the directory first. In Members storage settings, specify the public directory containing WordPress and a separate nonpublic directory. Server constants can also configure these paths.

A NAS or file-server share must already be mounted on the WordPress server and addressed by an absolute server path. Members does not establish a NAS connection or provide cloud-storage integration.

With valid storage, supported media workflows offer public or members-only storage. Every private-file delivery checks membership and parent-content access. Existing public media is not moved or made private automatically.

• Formats, shortcodes, and limitations

Check confirmation mail, password resets, email changes, suspension and reactivation, posts, private attachments, directory visibility, and closure. Use disposable test accounts and data for deletion tests.

Local checks do not prove production delivery or performance. Verify live email, physical passkeys, actual NAS/VPN storage, large-scale loads, and your API, SEO, and caching integrations in the adoption environment.