Atshift Members Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
atshift Members provides the essential pages and controls for a straightforward WordPress membership site. It keeps member registration, account management, posting permissions, protected content, and private attachments in one place.
Set up the member experience
- Create the registration, account, account-editing, password-reset, and account-closure pages together.
- Add a member home page with links to the account and the post types each member can use.
- Accept registrations immediately or hold new accounts for an administrator to approve.
- Use email confirmation for registration, email-address changes, and password resets.
Manage members and content
- Activate, suspend, or return accounts to pending status from a dedicated member list.
- Allow active members to create selected WordPress post types while keeping them from editing other users’ content.
- Protect selected posts or pages for active members without changing public content elsewhere on the site.
- Hide standard author archives and username-based author links.
Publish an optional member directory
The directory is disabled by default. When enabled, it can be public, restricted to active members, restricted to site operators, or limited through an optional classification integration. Choose whether to display a member’s name, affiliation, and biography, and exclude individual accounts such as site builders.
Store member-only attachments
Private attachments can be stored in a non-public directory on the WordPress server or on a file-server/NAS share already mounted by the host. Each download checks the current member and the parent content. Ordinary WordPress uploads remain public.
Extend profiles and administration when needed
The plugin works on its own with basic name and biography fields. Optional integrations add configurable profile fields, passkeys, user classifications, delegated administration, post review, scheduled announcement delivery, and CSV invitations. Paid add-ons are separate products and are not included in this plugin.
The current release supports WordPress single-site installations. Test the complete registration, email, cache, content, file-storage, and account-closure flows on a staging site before opening registration.
Shortcodes
Core account pages:
[atshme_registration][atshme_account][atshme_account_edit][atshme_password_reset][atshme_withdraw]
Member navigation and directory:
[atshme_dashboard][atshme_account_links][atshme_post_links][atshme_approval_status](shows Pro approval data when the add-on is active)[atshme_member_directory]
The dashboard shortcodes accept class, heading_tag, title, and limit where applicable. The directory accepts class, heading_tag, and per_page. Shortcode attributes cannot broaden the access configured by an administrator.
External services
Cloudflare Turnstile is used on registration and password-reset request forms to reduce automated abuse. Its browser script loads when one of these forms is displayed. When a request is submitted, the plugin sends the Turnstile response token and the site administrator’s secret key to Cloudflare’s Siteverify endpoint. Cloudflare may also process browser and network signals as described in its policies. Registration and password-reset requests cannot proceed when verification fails.
Service: https://www.cloudflare.com/products/turnstile/
Terms: https://www.cloudflare.com/terms/
Privacy: https://www.cloudflare.com/privacypolicy/
Pwned Passwords is queried whenever this plugin validates a new or changed password. The plugin sends only the first five hexadecimal characters of the password’s SHA-1 hash to the range endpoint at api.pwnedpasswords.com. The password and full hash are never sent. Returned suffixes are used only for the current comparison and are not stored. Password validation fails closed if the service is unavailable (five-second timeout). A site administrator can disable this check by defining ATSHME_PWNED_PASSWORDS_ENABLED as false.
Service: https://haveibeenpwned.com/Passwords
Terms: https://haveibeenpwned.com/TermsOfUse
Privacy: https://haveibeenpwned.com/Privacy
WordPress mail uses the site’s configured mail transport and is not a service supplied by this plugin. Test both external services with credentials for the target site before opening registration.
Privacy and access
Pending requests retain email addresses for at most 30 minutes plus cron delay; completion proofs last 15 minutes. Secret proofs are stored only as hashes. Source, email, and cookie counters use keyed hashes. Audit events expire after seven days plus cron delay. Hashing is pseudonymization, not anonymization. Raw tokens should be redacted from web-server, access, and analytics logs outside WordPress; confirmation pages send no-referrer and no-store headers.
Private downloads recheck membership and parent-content access. Public content can remain visible to logged-out visitors when a member is suspended. CDN and page caches, reverse proxies, and third-party profile, API, and SEO plugins require separate integration testing.
Account closure permanently erases the account and plugin-managed data by default. Members can explicitly transfer selected contributions to a non-login site custodian. Shared physical files, backups, and data stored by unrelated plugins have limits explained before final confirmation.
Screenshots
Create and review the five required member pages and an optional member home page.
Choose registration availability, administrator approval, and the profile fields used by member forms.
Set member posting permissions independently for each registered post type and hide username-based author links.
Search and manage members, account status, roles, and available post types from one list.
Give each active member a simple home page with account and posting links relevant to that user.
Publish an optional directory with an administrator-controlled audience, fields, and per-user exclusions.
