atshift Members Reference

Assign the pages in Members settings. Request handling and privacy headers depend on detecting the shortcode in the page content; this is different from calling only its rendering function from a theme.

Email changes use a dedicated view within the account editing page and require confirmation of the new address. Email and role changes are not treated as arbitrary profile-field updates.

[atshme_registration]
[atshme_account]
[atshme_account_edit]
[atshme_password_reset]
[atshme_withdraw]

atshme_dashboard combines available sections. atshme_account_links and atshme_post_links show only account and posting actions respectively. They are hidden for logged-out or suspended users, and omit links to unconfigured account pages.

class adds CSS classes. heading_tag accepts h2-h6 or p, defaulting to h2. Individual shortcodes support title to change the heading. Attributes do not execute arbitrary HTML.

limit accepts 1-20, default 5, for integrations that supply approval information. atshme_approval_status is a Pro integration point; the free plugin alone does not supply a post-approval workflow.

[atshme_dashboard class="member-home" heading_tag="h2"]
[atshme_account_links title="Account" heading_tag="h3"]
[atshme_post_links title="Write a post" heading_tag="h3"]

atshme_member_directory accepts class, heading_tag, and per_page. The heading accepts h2-h6 or p and defaults to h3. Page size is 1-100, default 20. Multiple directories on one page share the page number.

The directory remains hidden until explicitly enabled. Attributes cannot broaden access. Only active members are listed, and individual exclusions override listing rules. Classification filters require the compatible integration.

When a display name exactly matches the login name or email, the fallback is Member. This does not remove personal information from biographies or other free text. Hiding core author links also does not block every independent third-party user-data output.

[atshme_member_directory class="member-list" heading_tag="h3" per_page="20"]

atshme_attachments provides an attachment list and upload controls for authorized users. post_id selects a post but does not bypass its access rules. atshme_image accepts a private-image ID and alternative text.

Supported image, gallery, file, video, and classic-editor media workflows normally avoid manual shortcode entry. Documents use download links; a PDF preview is not provided.

Supported formats include JPEG, PNG, GIF, WebP, PDF, Word, Excel, PowerPoint, text, ZIP, MP4, and WebM. Upload limits come from WordPress and the server. Some formats require additional PHP extensions.

Macro-enabled Office formats and encrypted modern Office files that cannot be validated are excluded. Format checking is not antivirus scanning. Cloud storage, external video services, and custom third-party upload interfaces require separate consideration.

[atshme_attachments]
[atshme_attachments post_id="123"]
[atshme_image id="456" alt="A diagram from the member guide"]

Site configuration and storage changes require an administrator. Operators have scoped member and content-management duties, not administrator, plugin, or site-wide configuration control. A native WordPress role alone does not open every Members administration function.

Post-type grants check current member state and rules for creating, publishing, editing, and deleting the member's own content. They do not grant blanket access to other authors' editing or private posts. Missing classification integration does not turn restricted rules into unconditional grants.

Suspension does not make all published content private. Public content may remain visible to logged-out visitors. Verify the distinct effects of closure, revoked posting permission, and membership-state changes.

Cloudflare Turnstile loads its browser script on registration and password-reset request forms. Submission sends the response token and administrator secret key to Siteverify. Cloudflare may process browser and network signals under its policies. Failed verification blocks the request.

Pwned Passwords is called when this plugin validates a new or changed password. Only the first five hexadecimal characters of its SHA-1 hash are sent to the range API, never the password or complete hash. Returned candidates are compared for the current request and are not stored.

Passwords must have at least 12 characters and no more than 256 bytes, without leading or trailing spaces or control characters. The range request has a five-second timeout and fails closed on unavailable or invalid responses. An administrator can define ATSHME_PWNED_PASSWORDS_ENABLED as false to disable only the breach lookup; this changes the protection provided and needs an operational decision.

Mail uses the site's configured WordPress mail transport. Verify real delivery.

• Cloudflare Turnstile
• Cloudflare terms
• Cloudflare privacy
• Pwned Passwords
• Pwned Passwords terms
• Pwned Passwords privacy

Request email addresses are kept for at most 30 minutes plus cron delay. Completion proofs last 15 minutes; audit events expire after seven days plus cron delay. Secret proofs are stored as hashes, and source, email, and cookie counters use keyed hashes. Hashing is pseudonymization, not anonymization.

Redact confirmation tokens from web-server, proxy, and analytics logs outside WordPress. Confirmation pages send no-referrer and no-store headers but cannot automatically manage those external logging or cache configurations.

Closure normally erases the account and data. It requires a final confirmation and login within the previous ten minutes. Explicitly selected contributions may transfer to a non-login site custodian as drafts; unselected owned content is deleted. Large jobs continue through WP-Cron.

Shared physical files, third-party services, unsupported plugins, and backups impose explicit deletion limits. Do not describe this plugin as guaranteeing complete erasure from every storage system.

For missing confirmation messages, check the address, spam folder, mail transport, and WP-Cron. The response intentionally does not reveal whether an address is registered, so an accepted request does not guarantee a new-registration message was sent. Repeated requests are rate-limited.

For unavailable registration, check its enabled setting, HTTPS, Turnstile hostname and keys, external connectivity, InnoDB, and single-site mode. If a freshly opened form still fails, inspect member-page caching.

For a missing directory, check enabled state, audience, active membership, classifications, and individual exclusions. For inaccessible files, check the storage connection, membership, and parent-content permissions.

• Pre-launch checks
• Support