ROBOTSTXT Software

Login customizer

Choose or create a real physical upload subfolder (not a virtual one) from the classic Add Media screen.

Information

Author:

ROBOTSTXT

Download

Price:

€0.00
Log in to download

A free ROBOTSTXT account is required. Log in, then install the Manager (by ROBOTSTXT) plugin on your site and connect it with your API key to install this plugin and receive updates — at no cost.

Requirements

Version:

1.1.0

WordPress:

5.9

–

7.1

PHP >=

8.0

Changelog

1.1.0

Release date: 2026-09-17

Highlights

  • Live preview on the settings page.

Added

  • Live preview of the login screen with unsaved changes: an iframe of the real wp-login.php plus an AJAX endpoint that returns the draft CSS built by the same generate_css() used on the login screen (no drift possible). The button text, custom message, footer, and visibility toggles are applied to the frame dynamically; the language dropdown gets a preview-only CSS stand-in because core removes it server-side. Capability- and nonce-protected like the settings form.

Security

  • The preview endpoint enforces the same capability and nonce as the settings form; draft values pass through the full sanitization pipeline and are never stored.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

1.0.0

Release date: 2026-09-17

Highlights

  • First stable release.

Added

  • Spanish (es_ES) and Catalan (ca) translations (all 76 runtime strings, compiled .mo files shipped).
  • Logo size option: width and height in pixels (empty keeps the WordPress 84×84 default; the image scales to fit).
  • “Hide the logo entirely” toggle: removes the logo area including the default WordPress logo.
  • Text-mode logo: when no logo image is set but the logo title is, the title text replaces the default WordPress logo (the image still wins when both are set; hiding wins over everything).
  • “Do not link the logo” toggle: the logo is not clickable (the link URL field is ignored; the anchor points at the login page itself as a no-op for keyboard users).
  • Button color option: a dedicated hex color for the login button, falling back to the accent color when empty (the accent now colors the links only).
  • Button text color option: a dedicated hex color for the login button label, keeping white (the WordPress default) when empty.
  • Custom button text is skipped when the request carries wp_lang (the login language selector), so the chosen locale’s own button text applies.
  • Button border options: width in pixels (empty = the WordPress default) and a dedicated border color (empty = follows the button color). The radius row now shows radius and border width together.
  • Visibility toggle: hide the “Remember Me” checkbox on the login form.
  • Background image for the login screen: media-library picker with a “stretch to cover” option (unchecked tiles the image); combines with the background color.
  • Default redirect after login: destination used when none was specifically requested (requested destinations are always honored).
  • Custom footer text shown at the bottom of the login screen (wp_kses_post, 2000 characters).
  • Password-reset blocking and custom button text are opt-in only and empty by default; the login screen is untouched until something is configured.

Security

  • Pre-deploy audit fixes: the lost-password endpoint block now reads $_REQUEST (mirroring core), so body-only POST requests cannot bypass it; the logo URL is resolved once at save time in the saving context (works network-wide on Multisite) and percent-encoded for the CSS url() context; server-side length caps for every settings field (200/300/2000 characters, radius clamped to 200); X-Content-Type-Options: nosniff on the settings export; defense-in-depth esc_html() on the custom tab title and logo title.

Fixed

  • Duplicate “Settings saved.” notice after saving in the network admin: the redirect now uses a dedicated saved flag instead of updated, which the network settings.php parent page reacts to with its own notice.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: 3.13.6
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.5.0

Release date: 2026-09-17

Highlights

  • Settings import and export.

Added

  • “Download settings file” action: serves the canonical settings as a JSON download (nonce and capability protected).
  • “Import settings” form: uploads a previously exported JSON file, validates it (JSON, size limit of 100 KB), re-sanitizes every value, and replaces the stored settings. Success and error notices after the redirect.

Security

  • Both handlers enforce the same capability and nonce as the settings form; imported data passes through the same sanitization pipeline as the form input, so unknown or malicious fields are dropped.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: pending
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.4.0

Release date: 2026-09-17

Highlights

  • Optional /login/ shortcut.

Added

  • “Redirect /login/ to the login screen” toggle: on template_redirect, a request for exactly login (with or without trailing slash) redirects to wp-login.php. Resolved at request time instead of via rewrite rules, so the network-level toggle takes effect immediately on every site with no rewrite flushing. Singular queries are never hijacked: an existing page or post with the slug “login” keeps serving normally.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: pending
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.3.0

Release date: 2026-09-17

Highlights

  • Optional lost password endpoint block.

Added

  • “Block the lost password endpoint” toggle with a warning in the settings page: when enabled, wp-login.php?action=lostpassword and its retrievepassword alias are redirected to the login form via login_init, removing the self-service password reset (reset links inside already-sent emails keep working; action=rp/resetpass are never blocked).

Security

  • The endpoint block is enforced server-side on login_init, before the lost-password form renders; hiding the link alone never blocks the endpoint.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: pending
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.2.0

Release date: 2026-09-17

Highlights

  • Visibility toggles for the login screen.

Added

  • “Hide the Lost your password? link” toggle: hides only that link (the rest of the login nav, e.g. the register link, stays visible).
  • “Hide the Back to site link” toggle.
  • “Hide the language selector” toggle via the login_display_language_dropdown filter.
  • “Disable the shake animation” toggle: empties the shake_error_codes filter, so core never hooks wp_shake_js (the hook moved from login_head to login_footer in current WordPress versions).

Changed

  • The color fields now use the WordPress core color picker, with wider inputs and a Default button that clears back to the WordPress default.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: pending
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending

0.1.0

Release date: 2026-09-17

Highlights

  • Initial development release: core login customizer (Phase 0 + Phase 1).

Added

  • Plugin scaffolding: main plugin file robotstxt-logincustomizer.php, matching the plugin directory name, with full plugin headers and Network: true (network-activated default; settings live at network level).
  • Settings page (Settings > Login customizer in the network admin on Multisite, Settings > Login customizer on single site) with nonce and capability protection (manage_network_options / manage_options), storing a single network option robotstxt_logincustomizer_settings.
  • Logo customization: image from the media library (picker script loaded only on the settings page), rendered as the #login h1 a background via inline CSS; link URL (defaults to the site home via login_headerurl); title text via login_headertext.
  • Browser tab title via login_title.
  • Colors: background (body.login), accent (links and #wp-submit button, including hover/focus), and text (#login), validated with sanitize_hex_color().
  • Button customization: text via a gettext filter hooked on login_form matching the English source string Log In (works on any site language), and border radius.
  • Optional custom message above the login form via login_message, sanitized with wp_kses_post().
  • Inline CSS generated from the options on login_enqueue_scripts — no physical CSS files, no cache issues.
  • Delete-data-on-uninstall switch (settings preserved by default).
  • Uninstall routine that preserves plugin data by default and only removes it when the network owner explicitly opts in.
  • Development tooling: PHPCS (WordPress-Core, WordPress-Docs, WordPress-Extra), PHPStan level 9, PHPCompatibility, PHPUnit with plugin header tests, bin/preflight.sh, bin/deploy.sh.
  • Translation template languages/robotstxt-logincustomizer.pot.

Compatibility

  • WordPress: 6.9 – 7.1
  • PHP: 8.2 – 8.5

Tests

  • PHP Coding Standards: pending
  • WordPress Coding Standards: 3.4.1
  • Plugin Check (PCP): pending