=== R2 Onboard ===
Contributors: rise2studio
Tags: login, registration, user accounts, front-end login, profile
Requires at least: 6.0
Tested up to: 6.7
Requires PHP: 8.0
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Front-end user accounts — sign in, register, reset a password and edit a profile on your own pages, styled by your own theme.

== Description ==

Five shortcodes, five ordinary pages, no wp-login.php in sight for your visitors.

* `[r2ob_login]` — sign-in form
* `[r2ob_register]` — registration, with optional e-mail activation
* `[r2ob_forgot_password]` — request a reset link
* `[r2ob_reset_password]` — choose a new password
* `[r2ob_profile]` — name, e-mail and password for the signed-in user

The pages are created for you on activation. The markup is plain and class-named, and the stylesheet does layout and focus rings only — typography and colour come from your theme.

= Built to be safe by default =

* **Rate limited.** Sign-in, registration, password reset and activation each allow 8 attempts per 15 minutes per IP, cleared on success. The address itself is never stored — the key is an HMAC under your site's own salt.
* **Failures are visible to your other tools.** A failed sign-in fires `wp_login_failed`, so Limit Login Attempts, a firewall rule or R2 Security Hardening's Login Guard still see it.
* **No account enumeration.** Registering with an address that already exists returns exactly what a successful registration returns, and the real owner is e-mailed that someone tried.
* **Fixed messages.** Responses travel as codes and are resolved to text server-side, so nobody can put words of their own on your login page with a crafted link.
* **Activation keys are stored hashed** and compared in constant time.
* **Redirect settings are validated against your site** when you save them, so they cannot become an open redirect.
* **New accounts can never be given the administrator role.**

= wp-login.php stays yours =

Sending visitors from `wp-login.php` to your own login page is optional and **off by default**. Even when it is on, administrators are never redirected, and it refuses to act if the login page is missing — so you cannot lock yourself out. `define( 'R2OB_DISABLE_LOGIN_BLOCK', true );` in `wp-config.php` switches it off from outside the admin if you ever need that.

Worth knowing before you turn it on: moving sign-in traffic off `wp-login.php` also moves it out of view of anything watching that URL.

= E-mail =

Mail goes out through `wp_mail()`. There is deliberately no SMTP transport built in — a dedicated plugin (FluentSMTP, WP Mail SMTP) gives you connection tests, delivery logs and retries, which a bundled transport never does. Set a From name and address in the settings if you want them.

== Installation ==

1. Upload the `r2-onboard` folder to `/wp-content/plugins/`.
2. Activate it. The five pages are created automatically.
3. Go to **Settings → User accounts** to choose the role for new accounts, whether e-mail activation is required, and where people land after signing in.

== Frequently Asked Questions ==

= Does it need ACF? =

No. Configuration is plain WordPress Settings API — no ACF, no other plugin, no Composer.

= Can people still use wp-login.php? =

Yes, unless you turn that off in the settings — and administrators always can, regardless.

= What happens to accounts and pages if I delete the plugin? =

Nothing. User accounts and the five pages are your content and are never removed. Only the plugin's own settings are deleted, and only if you tick the uninstall option first.

= Someone registered with my client's address by mistake =

They will have received an e-mail telling them an account already exists, and no second account was created. This is deliberate: registration answers identically whether or not the address is taken, so the form cannot be used to find out who has an account.

== Changelog ==

= 1.0.1 =
* The forms' CSS and JavaScript tags carry `data-no-minify`: WP Rocket names its minified copy after the file path, not the version, and could keep serving the previous version's file after an update.

= 1.0.0 =
* First release. Front-end sign-in, registration with optional e-mail activation, password reset and profile editing, as five shortcodes with generated pages and a Settings API screen.
* Per-IP throttling on every credential endpoint, with the IP stored only as an HMAC.
* Extracted from the RISE2 starter theme, where it shipped disabled. The extraction fixed an authentication bypass (an unactivated account could sign in and stay signed in), unauthenticated page creation on `init`, a complete absence of rate limiting on an AJAX endpoint that had displaced wp-login.php, account enumeration on registration, reflected message text in the non-JS fallback, and a missing `wp_unslash()` throughout. It also dropped the ACF PRO dependency and the built-in SMTP transport with its hardcoded RISE2 mail server. See CHANGELOG.md for the full list.
