Customer accounts and login

Give customers your own sign-in, registration and password reset pages, and send wp-login.php visitors to them without locking yourself out.

The account pages TierMint creates

When you activate TierMint, it creates a Sign in page with the Login Form block and a Reset password page with the Password Reset Form block. If WordPress registration is open at that moment (Anyone can register under WordPress's Settings → General), it also creates a Register page with the Registration Form block.

TierMint selects these pages under TierMint → Settings → General, in the Pages group: Sign-in page, Registration page and Password reset page. Pick another published page there to use your own. The storefront pages guide covers all page settings.

Each form is also a shortcode and an Elementor widget. The shortcode reference lists their attributes.

The sign-in page

A visitor who is not signed in sees WordPress's sign-in form, with Remember Me, the Log In button and a Lost your password? link.

Lost your password? opens your password reset page while it is published, and WordPress's own lost-password screen otherwise. This link does not depend on Use the sign-in page instead of wp-login.

A plugin that adds fields to the WordPress sign-in form, such as a captcha, also adds them to this form. TierMint keeps inputs, buttons, labels, images and plain markup, and removes inline event handlers and other elements. A <script> or <style> tag printed inside the form is removed with its code. A script the plugin enqueues with wp_enqueue_script() is not affected. A developer can allow more with the tiermint_kses_allowed_html filter, described in Override a component template.

A signed-in visitor sees "Logged in as" their name, with a Your account link to the account page and a Log out link.

After signing in, the customer goes back to the page that sent them to sign in, such as a download link. Otherwise they go to your account page. To send everyone to one page, set Redirect URL on the Login Form block. After logging out, the visitor stays on the same page, or goes to the Redirect URL when it is set.

When the Create an account link shows

The form shows a Create an account link under the Lost your password? link when the block's Show registration link setting is on (the default) and one of these is true:

• The block's Registration URL is set. The link goes there, even when WordPress registration is closed.
• WordPress registration is open. The link goes to WordPress's registration address. With Use the sign-in page instead of wp-login on and a published registration page, that address is your registration page.

When a sign-in fails

The form sends the sign-in to WordPress. If it fails, WordPress shows its own login screen with the error. With Use the sign-in page instead of wp-login on, the visitor comes back to your sign-in page instead, with the message "Sign-in failed. Check your username and password and try again."

The registration page

The registration form works only while WordPress registration is open. It asks for an Email address and, unless you turn off Show the name field, an optional Name. There is no password field. When the customer clicks Create account, WordPress emails them a link to set their password, and the page says "Thanks for registering. Check your email for a link to set your password." The new account gets the New User Default Role set under WordPress's Settings → General when that role can only read, as Subscriber can. If the default role can do more, such as Author or Administrator, the account gets Subscriber instead.

Its Sign-in URL setting sets where "Already have an account? Sign in" points. Left empty, it points at your sign-in page.

The form has these safeguards:

• While registration is closed, the page shows "Registration is currently closed." and the server refuses any sign-up, even one sent by a script.
• An email address that already has an account gets the same confirmation as a new one, and no second account is made. So the form does not reveal which addresses have accounts.
• A hidden field traps bots that fill in every field. Such a submission gets the normal confirmation and creates nothing.
• One IP address can submit the form 10 times an hour. After that the form says "Too many attempts. Please wait a few minutes and try again." Developers can change the limit with the tiermint_registration_rate_limit filter.
• Captcha and anti-spam plugins that protect the WordPress registration form check this form too. TierMint runs WordPress's own register_form, register_post and registration_errors hooks, so a field such as a captcha shows above Create account. When such a plugin rejects a sign-up, no account is made and the form says "We could not complete your registration. Please check your details and try again." As on the sign-in form, TierMint keeps the plugin's inputs, labels and images and removes any script or style printed in the form, with its code. A script the plugin loads with wp_enqueue_script() is not affected. After you turn on such a plugin, register once as a test: if its field cannot work on this form, every sign-up gets that error.

A signed-in visitor sees "You are already signed in." and a Go to your account link.

If you open registration after TierMint is set up, it does not create the Register page for you. Add the Registration Form block to a page and pick it in Registration page. A developer can also run the tiermint_provision_pages action, which creates any missing TierMint page and leaves existing pages alone.

The password reset page

The Password Reset Form handles the whole lost-password process on your own page.

1. The customer opens the page, for example from Lost your password? on the sign-in page.
2. They enter their Email address or username and click Send reset link.
3. The page says "If an account exists for that address, we have emailed a link to reset your password. The link expires in 24 hours." It shows the same message whether or not the account exists.
4. They open the emailed link, which comes back to your reset page, and enter a New password twice. The two entries must match.
5. They click Save password. The page says "Your password has been reset." with a Sign in link. TierMint does not sign them in for them.

A used or wrong link shows a message asking the customer to request a new one, and so does a link older than 24 hours.

A new password needs at least eight characters. Developers can change that number with the tiermint_password_reset_min_length filter. Password rules from other plugins that check WordPress's validate_password_reset hook apply here too. Repeated requests are rate-limited, and the tiermint_password_reset_rate_limits filter changes the limits.

Which password emails link to your reset page

While the reset page is published, the emails TierMint sends always link to it:

• The reset email from your password reset page.
• The set-password email for an account made by your registration form.
• The set-password email for an account made at checkout, when Create an account for guests is on.

The other WordPress password emails link to your reset page only while Use the sign-in page instead of wp-login is on. These include the email from WordPress's own lost-password screen, the Send password reset action in the WordPress user list, the set-password email for a user an administrator adds, and the email from WordPress's own registration screen. With the setting off, they keep WordPress's wp-login.php link.

If your reset page ever breaks, for example because its block was removed, you can still reach the WordPress reset form from an emailed link:

1. Copy the key and login values from the emailed reset link.
2. Open your site's wp-login.php with them, plus action=rp and tiermint_wp_login=1, for example https://example.com/wp-login.php?action=rp&key=KEY&login=LOGIN&tiermint_wp_login=1.

You can also set a password with WP-CLI:

wp user update <user> --user_pass=<new-password>

With Use the sign-in page instead of wp-login on, WordPress's own Lost your password? links point to your reset page too. If you unset or unpublish the page, WordPress builds its own wp-login.php links again.

Send wp-login.php visitors to your pages

By default, customers can still open wp-login.php. To send them to your pages instead, turn on Use the sign-in page instead of wp-login under TierMint → Settings → General, in the Front end group, and click Save changes. It is off by default, and it needs a published sign-in page.

With it on:

• Opening the WordPress login screen takes the visitor to your sign-in page. A redirect_to address comes along, so after signing in they return to the page they wanted.
• WordPress login links across the site point to your sign-in page, and logging out with no other destination lands there too.
• The WordPress lost-password screen, and a reset link opened at wp-login.php, go to your reset page.
• WordPress's Lost your password? links, and the reset link in every WordPress password email, point to your reset page while it is published.
• A failed sign-in comes back to your sign-in page with an error message.
• The WordPress registration link points to your registration page while registration is open and the page is published.

Some requests always stay on wp-login.php: form submissions, logging out, a reset already open in the WordPress form, the account email and privacy confirmations, and the sign-in WordPress asks for when you open wp-admin while signed out or your session expires there. So administrators still sign in to wp-admin on the WordPress screen.

You cannot lock yourself out

Two safety nets keep an administrator able to sign in:

• wp-login.php?tiermint_wp_login=1 always shows the real WordPress login screen, whatever the setting says. Bookmark it. Adding &tiermint_wp_login=1 to a reset link opened at wp-login.php works the same way.
• If your sign-in or reset page is deleted, unpublished or trashed, the redirects for it stop, and wp-login.php works as normal again. A redirect only runs while its page is published.

What these pages do not do

TierMint does not add a change-password panel to the account dashboard, a password field to the registration form or a password strength meter. If you use a plugin that renames or hides wp-login.php, leave Use the sign-in page instead of wp-login off and let that plugin own the login address.

Common questions

Why does my sign-in page have no Create an account link?

WordPress registration is closed and the block has no Registration URL. Turn on Anyone can register under WordPress's Settings → General, or set Registration URL on the Login Form block. When the Create an account link shows lists the rules.

Can a customer sign in with their email address?

Yes. The form is WordPress's own sign-in form, which takes a username or an email address.