Description
User registration, login, profiles and member directories for WordPress
WP User Manager replaces the default WordPress login and registration with forms that live on your own pages and match your theme. Members get a public user profile and an account page to edit their details, and you can list them in a searchable member directory.
Use it to build a membership site, a community, a client portal, or simply a better registration form and login page than WordPress gives you out of the box.
What you can build with the free plugin:
- A custom registration form on any page, with your own user fields, terms and privacy checkboxes, and automatic login after signup
- A frontend login form and login page, with password recovery, so users never see wp-login.php
- User profile pages with custom avatars, cover images and tabs for each member’s posts and comments
- A member directory with search, sorting and filtering by role, displayed anywhere with a block or shortcode
- An account page where members update their details and change their password
- Paid registration with Stripe, collecting a one-off or recurring payment when someone signs up
- Content restriction by role or logged-in status, on whole pages or on any individual block, plus custom redirects after login, logout and registration
- Blocks and Elementor widgets for every form and page: login, registration, password recovery, account, profile, profile card, user directory, recently registered users, and login and logout links. Shortcodes work everywhere else
Website | Addons | Documentation | Ënnerstëtzung
Features included
- Frontend forms: Allow users to register and login from the front of the site. Customize the registration form with custom fields to collect data
- Stripe integration: Take one-off or recurring payments on the registration form, using Stripe Connect
- Custom email notifications: Customize the emails sent to users when the register, reset their password and more
- Custom avatars: Users can edit their site avatar by uploading an image from the account page
- Elegant user profiles: All users have a public profile page to display their data
- Shortcodes editor: Easily add the plugin shortcodes to pages or posts with the shortcode generator and editor
- Roles editor: Edit roles and their capabilities. Create new roles and duplicate existing ones
- Beautiful user directories: Display users in a directories that can be displayed anywhere on the site
- SEO URLs: All the URLs are SEO friendly
- Content restriction: Restrict content for certain users, by logged in status, or by role
- Passwords management: Allow users to update their password from their account page
- Custom fields editor: Create custom user fields that can be used to collect data on registration
- Custom widgets: Display user data and forms in sidebars using widgets
- Custom redirects: Control where the users are redirected to on login, registration and more
- Powerful tools: Tools to be in control of your site and who registers
- Developers friendly: Customize and integrate with other plugins with a large number of hooks and filters
- Extensive documentation: Full documentation and expert support
- Translation Ready – The plugin and addons are fully localized ready for translation
Read more about our features on wpusermanager.com
Premium Features
For more advanced functionality check out the pricing page.
- Custom Fields: Add custom fields to members profiles and registration forms
- WooCommerce: Integration with WooCommerce. Collect payment at registration, allow members to update their billing and shipping addresses, display product purchases, reviews and more!
- Stripe Pro: Integration with Stripe. Collect payment at registration with Stripe, restrict access to your site, remove the commission fees.
- User Verification: Send a verification link via email upon registration or manually approve users before they can login
- Groups: Give your users the ability to create and join groups
- Security: Add password security features and user login management features
- Registration Forms: Create unlimited registration forms, create multi-step forms, customize forms with HTML, and have full control over form settings
- Frontend Posting: Allow your users to submit posts and other content from the frontend
- Advanced Custom Fields: Collect ACF user data at registration and allow users to see and edit the data on their profile
- Social Login & Registration: Allow your users to quickly login and register with their favorite social network account, Facebook, Twitter, Instagram & LinkedIn
- Private Content: Provide private content for all your users, as well as user specific content so you can tailor for each member
- Mailchimp: Sync users with Mailchimp upon registration & more
- Google reCAPTCHA: Stop spam registrations on your website for free
- Content Restriction Plus: One-click restriction to posts, pages and custom post types
- Likes: Allow your users to like posts, pages and other content
- hCaptcha: Stop more bots. Start protecting user privacy with hCaptcha
- WPML: Translate your custom fields, field groups, registration forms, and emails using WPML
- Personal Data: Allows the user to request an export of personal data and request erasure of personal data from the account page for GDPR compliance
- Delete Account: Allows the user to delete their own profile from the frontend account page
Free Extensions
- Newsletter: Subscribe your members to your Newsletter plugin lists easily during registration
- Username Length: Set minimum and maximum characters length for usernames
Translations
Want to add a new language to WP User Manager? Awesome! You can contribute via translate.wordpress.org. Please read the official translation tutorial for more information.
Ënnerstëtzung
Support is provided only through the support forum. Join the support forum to ask questions and get help regarding WP User Manager. Free support is provided exclusively for bugs and help using the plugin. Please read the support policy https://wpusermanager.com/support-policy/.
Before opening a support topic please read the faqs and documentation.
Support for premium addons is provided exclusively through the premium support platform. Support for premium addons cannot be provided through WordPress.org due to the rules put in place by the WordPress.org team.
Screenshots
Installation
Please read our detailed documentation here https://docs.wpusermanager.com/category/13-installation
FAQ
-
How do I add a login form to a page?
-
Add the Login Form block (or Elementor widget) to any page, or use the
[wpum_login_form]shortcode. WP User Manager creates a login page for you on activation, and you can redirect wp-login.php to it so users never see the default WordPress login screen. See the login form shortcode guide. -
How do I create a custom registration form?
-
Add the Registration Form block, Elementor widget or
[wpum_register]shortcode to a page, then choose which user fields the form shows under Users Registration Forms. The free plugin includes one registration form. The Registration Forms addon adds unlimited forms and multi-step forms. -
How do I create a member directory?
-
Create a directory under Users Directories, choose which roles to include and whether to show a search form, then add it to a page with the User Directory block, the Elementor widget or its
[wpum_user_directory id="123"]shortcode. -
Can I charge for registration?
-
Yes. The free plugin connects to Stripe so you can take a one-off or recurring payment on the registration form. Stripe Pro uses your own Stripe keys and removes the platform fee. See how to accept recurring payments with Stripe.
-
Does it work with the block editor and Elementor?
-
Yes. Every form and page has a block and a native Elementor widget: login, registration, password recovery, account, profile, profile card, user directory, recently registered users, and login and logout links. In the block editor you can also show or hide any block by logged-in status, user role or specific users.
-
Which shortcodes are available?
-
Login, registration, password recovery, account, profile, profile card, user directory, recently registered users, logout and content restriction shortcodes, for classic themes, widgets and page builders. See the full list of pages and shortcodes.
-
Install instructions
-
Please refer to the official documentation.
-
Does WPUM work with any theme?
-
WP User Manager has been designed and coded to seamlessly integrate with any properly coded WordPress theme. However, each theme is coded differently and the quality of the code can vary. To avoid potential issues and conflicts, WPUM adds very little css and js to your website. If your theme is properly coded, WPUM should adapt itself to your site layout. Although we cannot guarantee that the plugin works with all themes.
-
My emails aren’t delivering
-
Please refer to the official documentation.
-
Where do I report security bugs found in this plugin?
-
Please report security bugs found in the source code of the WP User Manager plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin. For further details, see our security policy.
-
Is WP User Manager GDPR compliant?
-
Please refer to the official documentation for gdpr compliance.
WP User Manager provides add-ons to comply with the right of erasure and the right
Please note that using WPUM and the mentioned add-ons does NOT guarantee compliance to GDPR. WPUM gives you general information and tools, but is NOT meant to serve as complete compliance package. As the owner of your website, it is your responsibility to ensure that your site is compliant with the regulations. Please always contact an attorney for accurate information, we are not responsible for your website GDPR compliance and we can’t be held accountable for any legal issues.
Reviews
Contributors & Developers
“WP User Manager – Registration Form, Login Form, User Profile & Member Directory” is open source software. The following people have contributed to this plugin.
Contributors
“WP User Manager – Registration Form, Login Form, User Profile & Member Directory” has been translated into 11 locales. Thank you to the translators for their contributions.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.9.20 (19th September 2026)
- Security: Stripe registration only accepts the plans configured on the registration form (thanks to Patchstack for the follow-up review)
- Security: Stripe Connect callback is now tied to the administrator who started the connection
- Security: One-time Stripe plans are only marked as paid once Stripe confirms the payment
- Security: Hardened addon version check, license requests, file field output and bundled Carbon Fields AJAX actions
- Fix: One-time Stripe payments not being marked as paid
- Fix: Fatal error when downloading Stripe invoices
- Fix: Customers who abandoned a one-time Stripe checkout had no way to pay
- Fix: Addon licenses entered since 2.9.14 not activating
- Tweak: Removed unused Carbon Fields source files from the plugin package
2.9.19 (18th September 2026)
- Security: Enforced server-side Stripe plan validation on registration (thanks to Ananda Dhakal via Patchstack for responsible disclosure)
- Security: Added authorization check to Stripe Connect callback (thanks to Wordfence PRISM for responsible disclosure)
- Enhancement: Added “Fetch Stripe Products” button to Stripe settings
- Enhancement: Stripe product webhook handlers to auto-sync product cache
- Enhancement: Filter Stripe API queries to active products and prices only
- Enhancement: Generic login error messages setting to prevent username enumeration
- Fix: PHP 8 fatal in avatar cache key when $id_or_email is an object
2.9.18 (30th May 2026)
- Security: Hardened profile tab input validation (thanks to Yat via Wordfence for responsible disclosure)
- Fix: Custom avatar not shown when a default avatar is also configured
- Fix: Multiple roles not saving on the admin edit user page
- Fix: Email content editor for ‘Delete Inactive Accounts’ not working with block themes
2.9.17 (11th May 2026)
- Security: Hardened file field input validation during registration (thanks to endy via Patchstack for responsible disclosure)
2.9.16 (11th Apr 2026)
- Fix: PHP 8.2+ dynamic property deprecation warnings in WPUM_Field
- Fix: Account update no longer fails when avatar or cover image file is missing from disk
- Fix: Password recovery now works when the username is an email address different from the stored email
- Fix: Multicheckbox and multiselect fields no longer cause errors when the stored value is not an array
2.9.15 (26th Feb 2026)
- Fix: User role multiselect was disabled on the admin user profile after Carbon Fields upgrade
2.9.14 (24th Feb 2026)
- Improvement: Updated Brain\Cortex routing library for PHP 8.3 compatibility
- Improvement: Upgraded Carbon Fields to a version compatible with PHP 8.1-8.3
- Fix: Translation loading now uses the correct hook for WordPress 6.7+ compatibility
- Improvement: Minimum PHP version raised from 7.2 to 7.4
2.9.13 (16th Dec 2025)
- Security: Fixed authenticated arbitrary file deletion vulnerability in custom avatar and cover image handling (Thanks to YC_Infosec via Wordfence)
- Security: Fixed a PHP Object Injection vulnerability in the user nickname profile field (Thanks to Nguyen Ngoc Quang Bach (maysbachs) via Patchstack)
2.9.12 (21st Nov 2024)
- Security: Missing authorization to authenticated check for the unique usermeta key check when editing a field (Thanks to Tieu Pham Trong Nhan)
- Security: Carbon Field sidebar AJAX action handlers removed which are not used but posed a CSRF security risk (Thanks to BrokenAC)
2.9.11 (7th Sept 2024)
- Security: Nonce check added to the admin action of fixing old plugin data
2.9.10 (2nd April 2024)
- Improvement: + and other characters no longer accepted in username at registration
- Fix: Required checkboxes field hidden with conditional logic incorrectly requires all boxes to be checked
- Fix: Registration form duplicate id attribute HTML issues
- Tested with WordPress 6.5
2.9.9 (11th March 2024)
- Fix: Stripe subscriptions not connecting to user correctly
- Fix: Password field not allowing special characters
2.9.8 (19th November 2023)
- Fix: Unable to add new WPUM Blocks or edit existing ones
- Fix: PHP 8.1 and 8.2 notices
- Fix: Redirect loop when preventing access to the site unless logged in for sites installed in a subdirectory
- Fix: Unable to submit WPUM forms as Elementor widgets
- Fix: Displayed Stripe product prices incorrectly rounded to whole numbers
- Fix: REST API endpoints not accessible when preventing access to the site unless logged in
- Fix: Unable to remove all “Allowed Roles” in the custom field permissions tab
- Fix: Unable to add blocks for the Likes, Private Content, and Social Login addons
- Fix: Unable to delete custom role
2.9.7 (23rd March 2023)
- Fix: WP User Manager custom blocks and block restriction settings now appear in the block editor
2.9.6 (22nd March 2023)
- Improvement: Plugin now requires PHP 7.2+
- Fix: PHP Fatal error: Cannot declare because the name is already in use in
- Fix: Date picker on the account page now uses the correct display format
2.9.5 (17th March 2023)
- Fix: PHP Fatal error: Uncaught Error: Class ‘WPUM\Walker_Nav_Menu_Edit’ not found
- Fix: Date picker not saving in correct format
- Fix: Repeater fields not loading correctly
2.9.4 (17th March 2023)
- Fix: Fatal error: Cannot declare because the name is already in use in errors
2.9.3 (16th March 2023)
- Fix: Fatal errors on sites using Divi
2.9.2 (16th March 2023)
- Fix: PHP 8 Fatal error: Uncaught TypeError: spl_autoload_unregister(): Argument #1 ($callback) must be a valid callback
2.9.1 (16th March 2023)
- Fix: PHP Fatal error failed opening required /includes/functions-scoped.php
2.9 (16th March 2023)
- New: Collect payment for site access with credit cards using our Stripe integration
- New: Use native Elementor widgets instead of WP User Manager shortcodes
- New: Choose an image as the default avatar for users who haven’t uploaded one
- New: Compatibility with the Stripe Pro addon
- Improvement: Registration success notice now shows on after registration redirect pages
- Improvement: Third-party dependency code is now prefixed to avoid clashes with other plugins
- Improvement: Storage date format for the Date picker field updated to ‘Y-m-d’ for standardization
- Improvement: Date format for the Date picker field can be altered with the ‘wpum_field_datepicker_date_format’ filter
- Fix: PHP notice on form submit with Repeater field with conditional logic
2.8.19 (3rd February 2023)
- Improvement: Pagination for comments on the profile, with comments per page setting
- Fix: Email customizer now works with the OceanWP theme
- Fix: Conditional logic support for Repeater subfields
2.8.18 (23rd January 2023)
- Fix: Code fixes using PHPStan (props szepeviktor)
- Fix: Renaming a registration form now works correctly
- Fix: Abort loading plugin early if plugin doesn’t meet PHP or WP requirements
- Fix: Newsletter email form on welcome page updated
- Fix: Formatting on the welcome page
- Fix: Updated documentation URLs
2.8.17 (18th January 2023)
- New: Setting to partially obfuscate email addresses used as the user display name
- Improvement: ‘wpum_authentication_method_admin_override’ filter to enforce admin logins with the correct username/email method
- Fix: Headers for field groups with only hidden fields now don’t render on the profile
- Fix: Searching in a directory for users with apostrophes in their names now returns result
- Fix: Redirecting to a URL with query parameters now retains the parameters after login
2.8.16 (2nd January 2023)
- New: Compatibility with Likes addon
- New: Blocks for Social Login Buttons and Private Content
- Improvement: Profile permission settings now in a different tab in the admin
- Fix: User role editor now saving grant and deny capabilities correctly
- Fix: Profile Card block settings now working correctly
- Fix: Undefined offset: 0 in wp-user-manager/includes/actions.php on line 117
- Fix: Error log messages now not showing if a profile is accessed for a user that does not exist
2.8.15 (21st December 2022)
- New: Compatibility with hCaptcha addon
- Fix: Warning: Undefined array key “action” now not showing
- Fix: Undefined offset: 0 when excluding roles from showing the admin bar
2.8.14 (6th December 2022)
- Improvement: Saving a custom field with same unique key is now not allowed
- Improvement: ‘wpum_prevent_entire_site_access_allowed_urls’ filter for allowing URLs when site access is prevented
- Fix: Multiple checkboxes field now saving correctly
- Fix: Existing file fields data in a repeater field are now preserved correctly on save
- Fix: Menu item user role restriction now works as expected
- Fix: Switching back to a user with the User Switching plugin now works as expected
- Fix: Plugin admin scripts now not loading on every admin page
- Fix: Hypens now allowed in unique meta key for custom fields
2.8.13 (19th October 2022)
- Fix: User, User Role, and User Taxonomy fields now saving multiple values correctly
2.8.12 (16th September 2022)
- Fix: Forms in widgets now render correctly
- Fix: Multi select fields now rendered correctly when hidden with conditional logic
2.8.11 (15th September 2022)
- Improvement: Links on the Already Logged In template can be filtered using the ‘wpum_already_logged_in_links’ filter
- Fix: Password reset success message now renders HTML correctly
- Fix: File field now correctly saving uploads
- Fix: Sub pages for the account and profile page now loading when using an Elementor template
2.8.10 (14th September 2022)
- Fix: Conditional logic settings now correctly saving when editing a field
- Fix: Custom field unique meta keys now converted to lowercase to stop fatal errors
2.8.9 (12th September 2022)
- Improvement: Options for dropdown, multiselect, checkbox and radio buttons fields can be pasted in
- Improvement: Plugin coding standards improved
- Fix: Account and profile subpages now correctly styled like the parent page when using page builder plugins
- Fix: PHP notices now not thrown when using conditional logic with empty multiselect fields
2.8.8 (16th August 2022)
- Security: File uploads now checked for matching file extension and file type before attempting to upload
- Fix: HTML in form error messages now showing correctly
- Fix: ‘Edit account’ string on the profile page now localized for translation
2.8.7 (8th August 2022)
- Fix: PHP Notice: Undefined index preventing form submission on some installs
2.8.6 (7th August 2022)
- Improvement: Conditional logic for fields now supported for both the Custom Fields and ACF addons
- Fix: Change Password account form now loading correctly after save
- Fix: Account and profile sub pages now inheriting the parent page template which was broken in WordPress 6.0
- Fix: Saving Divi pages now not throwing fatal errors on some installs
- Fix: Registration form error messages now using the general-error.php template
2.8.5 (25th May 2022)
- Fix: Account and profile sub pages now working with WordPress 6.0
2.8.4 (22nd May 2022)
- Tested with WordPress 6.0
- Fix: Plugin now compatible with sites with object caching enabled
2.8.3 (12th May 2022)
- Fix: Field names with apostrophes now don’t have slashes added
- Fix: Prevent site access now compatible with Social Login addon
2.8.2 (1st May 2022)
- Improvement: Redirect URL after login can now be filtered with ‘wpum_login_redirect_to_url’ filter when restricting content
- Fix: Password reset page now accessible when preventing access to the whole site
- Fix: Email settings tab now only showing for File fields
- Fix: File field help hint now includes jpeg in the example file extensions for clarity
- Fix: WP User Manager addons now showing as tested up to the minor WordPress versions correctly
2.8.1 (25th February 2022)
- Fix: User password now not regenerated when other plugins create users when using a ‘password’ field
- Fix: WP CLI commands now working when the site is locked
2.8 (24th February 2022)
- New: Sites can now be completely locked from access unless users are logged in
- New: Email sent to the site administrator when a new user registers can now be customized like other emails from the email screen
- New: File fields can now be attached to new user registration emails with the Custom Fields addon
- New: Emails can now be disabled from the email screen
- New: Directory sorting option is now filterable with ‘wpum_directory_sort_options’ to allow setting custom sort field
- Improvement: User is now alerted if they have unsaved field settings and try to change settings tabs
- Fix: ‘Username or email’ string now used to match WordPress and leverage existing string translations
Earlier versions
For the full changelog with earlier versions, please refer to the changelog on wpusermanager.com.