Attributes User Access vs Mandate App Security

Attributes User Access is a lightweight and flexible authentication solution for WordPress. It empowers site administrators with detailed control over login processes, enhancing user authentication and access experience with a focus on security and performance. Core Features Custom Login Page Creation Generate fully integrated login pages with WordPress Use shortcode-based forms for easy theme compatibility Automatically adapts to WordPress core updates Template override system for complete customization Flexible Login Redirection Redirect native WordPress login requests Define role-based and context-aware redirection rules Custom redirect URLs per user role Developer-Focused Architecture PSR-4 autoloading and object-oriented design Extensible with action and filter hooks Modular components for easy customization Comprehensive API for extensions Security & Performance WordPress.org compliant security practices Nonce verification on all forms and AJAX requests Transient-based error handling (no PHP sessions) Optimized asset loading Minified CSS and JavaScript for production Shortcode Usage Basic login form: [attributes_login_form] With parameters: [attributes_login_form redirect=”/dashboard” remember=”false”] Available parameters: redirect – Target URL after login (default: Dashboard) remember – Show “Remember Me” checkbox (default: true) form_id – Custom form identifier (default: attributes_login_form) label_username – Custom username field label label_password – Custom password field label label_remember – Custom remember me label label_log_in – Custom login button text Template System Template System Override templates in your theme for complete customization. Template location in theme: your-theme/attributes/front/forms/login-form.php Original template location: wp-content/plugins/attributes-user-access/templates/front/forms/login-form.php Copy the original template to your theme and customize as needed. The plugin automatically uses your theme’s template when available. Developer Hooks Actions: attrua_before_login_form – Fires before rendering the login form wrapper attrua_after_login_form – Fires after rendering the login form attrua_login_form_fields – Hook for adding custom fields to login form attrua_login_failed – Fires when a login attempt fails attrua_successful_login – Fires after successful authentication attrua_before_page_creation – Fires before creating authentication pages attrua_after_page_creation – Fires after creating authentication pages Filters: attrua_login_redirect_url – Customize login redirection attrua_login_error_message – Modify login error messages attrua_login_credentials – Filter login credentials before authentication attrua_action_links – Modify plugin action links attrua_row_meta – Modify plugin row meta links Privacy Policy Attributes User Access does not: Collect any user data Send data to external servers Use cookies for tracking Store sensitive information The plugin only stores: Plugin settings in WordPress options table Temporary error messages in WordPress transients (auto-expire) Page IDs for custom authentication pages All data is stored locally in your WordPress database and is completely removed upon plugin uninstallation. Support & Contributing Documentation: https://attributeswp.com/docs Support Forum: https://wordpress.org/support/plugin/attributes-user-access GitHub Repository: https://github.com/attributeswp/attributes-user-access Report Issues: https://github.com/attributeswp/attributes-user-access/issues Contributions are welcome! Please feel free to submit pull requests or open issues on GitHub.

WordPress Application Passwords prove identity. They do not limit what an authenticated request can do. If the user behind a password is an admin, every tool that authenticates as that user has admin-level access — with no native way to narrow it. Today, REST clients, automation platforms, AI agents, management tools, and MCP connectors all authenticate with Application Passwords. Any of them, if misconfigured or compromised, can do anything that user can do. Mandate App Security adds the missing layer: a capability policy per Application Password. You define what each credential is allowed to do. Mandate App Security enforces it on every request. Normal wp-admin sessions and user roles are unaffected. Instead of treating every Application Password as equally trusted, Mandate App Security lets administrators and password owners save a capability allowlist per password. An administrator can choose: a WordPress user one of that user’s Application Passwords the capabilities that password should be allowed to use an optional expiration date for that password whether the scope is locked so the password owner can view it but not edit it Users can scope their own Application Passwords when WordPress allows Application Passwords for their account. Only administrators can edit another user’s scope or lock a scope against owner edits. When a request is authenticated with that Application Password, Mandate App Security checks the saved allowlist and removes capabilities that are not allowed for that password. Mandate App Security never grants new permissions. It only narrows an Application Password to capabilities the selected user already receives from assigned roles. If the selected Application Password is past its saved expiration date, Mandate App Security removes all capabilities for that request. Normal browser and wp-admin sessions for the same user are not changed. Example scopes A reporting dashboard that only needs to read posts and media should never be able to edit settings or manage users. A content automation tool that publishes posts has no reason to access WooCommerce orders. An AI writing assistant does not need plugin management access. With Mandate App Security, each of those tools gets a dedicated Application Password scoped to exactly what it needs. Nothing more. Source Code Mandate App Security is available at https://wpmandate.com. The public development repository, release packages, and build documentation are at https://github.com/FernleafSystems/Mandate-for-WordPress.