Aslansheed Login

Aslansheed Login lets visitors sign in or register with a phone number or email and a one-time code. Everything is free: there are no locked features and no license checks.

Sign-in and registration

• One smart form: the visitor types a phone number, email or username. The form offers a code or a password, and new users finish registration after verifying their code.

• Configurable registration fields: first and last name, username, email, password with confirmation and strength meter, national ID, postal code and birth date. Each is hidden, optional or required. Birth date can use the Gregorian or the Jalali (Persian) calendar, or let the user switch. National IDs are checked with the Iranian checksum, kept unique and stored encrypted.

• Optional email verification at registration: a code is sent to the address a new user gives, and the account is created only after it is entered.

• Multi-country sites: an optional country list next to phone numbers, limited to the countries you allow.

• Optional Google sign-in (Google Identity Services, no client secret needed).

• Optional Facebook sign-in. Only the public profile and email permissions are requested. A new user can be asked for the required registration fields Facebook did not share, or the account can be created at once with whatever Facebook gave. Linking to an existing account by email, and treating the Facebook email as verified, are separate options, both off by default. Password fields have a show/hide eye button.

• Custom registration fields: text, number, date, dropdown, checkboxes and more.

• Account page for signed-in users ( [aslansheed_account], also on the WooCommerce My Account dashboard): link or unlink Google and Facebook, set up an authenticator app, change the password and, if you allow it, change the verified phone number with a code sent to the new one.

• Sign-out shortcodes: [aslansheed_logout] (link or button) and [aslansheed_logout_url] (only the address, for a page builder button). The sign-out address stays on your home page and never shows wp-login.php or a renamed admin address. An optional setting applies it to sign-out links from themes and menus too.

• Works wherever you build pages: shortcode [aslansheed_login], a block, and an optional Elementor widget for the form.

• Optional replacement of the WordPress login page. It is off by default and needs a secret emergency address that always shows the classic form, so you can never lock yourself out.

Delivery channels with automatic fallback

• Email, SMS, WhatsApp Cloud API, Telegram Gateway and your own Telegram bot (send a code, or an Approve button).

• SMS providers: Twilio, Vonage, Plivo, Telnyx, Sinch, Infobip, Africa’s Talking, Melipayamak, Kavenegar, SMS.ir and a custom HTTP gateway. If one fails, the next one is tried.

• A “Send test” button for every channel and provider, and a masked message log.

Security and privacy

• 2FA with Google Authenticator, Microsoft Authenticator, Authy and other apps. Set it to off, optional or required, for everyone, chosen roles or chosen people. Users get recovery codes, and it also protects the classic wp-login.php form.

• Codes are random, single use, expire quickly and are stored only as keyed hashes.

• Gateway keys and secrets are encrypted at rest (libsodium, derived from your WordPress salts).

• Rate limits per recipient and per IP, wrong-attempt limits and lockouts against SMS pumping and brute force.

• Optional captcha: Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2, or a built-in check that works without any outside service.

• Block lists for emails, phone numbers and IP addresses, and a country allow list for phone numbers.

• Optional sign-in notification emails for users and for administrator sign-ins.

• Audit log with configurable retention.

• WordPress personal data export and erase tools, and suggested privacy policy text.

WooCommerce

• Optional sign-in form on My Account.

• Optional phone verification at the classic checkout.

• Billing phone, name, email, postal code and country sync from the registration form, and postal code kept in step with the billing address.

• Billing phone sync and High-Performance Order Storage (HPOS) compatibility.

• The block-based checkout is not covered yet.

Bookly

• Works with Bookly Lite and Bookly Pro.

• When someone signs in, an existing Bookly customer with the same verified phone number or verified email, and no linked user yet, is linked to their account. Phone numbers are compared by their last ten digits, so spaces, dashes and Persian or Arabic digits do not matter.

• When someone registers, or signs in and has no Bookly customer yet, they are added to Bookly with their name, email, phone number, birth date and postal code, so the booking form opens already filled in. A customer is created only when nobody in Bookly has the same phone number or email.

• Only empty fields are filled. Existing details are never replaced, administrators are never linked, and when more than one customer matches, nothing is linked or created and the skip is recorded in the audit log. Linking and creating are separate options.

Tools

• Import phone numbers stored by other login plugins or in any user meta key, with a preview.

• Export and import the general settings as JSON. Secrets are never exported.

About the author

ir). ir. This plugin is free and has no paid version.

ir/Donate

External services

The plugin contacts a third-party service only when a site administrator turns on the matching feature. Nothing is sent to any of these services by default. Each service below is described with what it is used for, what is sent and when, and links to its terms and privacy policy.

Feedback form (About tab)

Not a third-party service. ir. Nothing is sent automatically.

SMS providers

Used to deliver one-time codes by text message. You choose one provider in Settings. When a visitor asks for a code, the provider receives the recipient phone number, the message text (which contains the code), the sender name or number you configured and your API credentials.

Nothing is sent otherwise.

• Twilio: terms, privacy policy

• Vonage: terms, privacy policy

• Plivo: terms, privacy policy

• Telnyx: terms, privacy policy

• Sinch: terms, privacy policy

• Infobip: terms, privacy policy

• Africa’s Talking: terms, privacy policy

• Melipayamak (https://www.melipayamak.com): terms. The website does not publish a separate privacy policy page.

• SMS.ir (https://sms.ir): terms. The website does not publish a separate privacy policy page.

• Kavenegar (https://kavenegar.com): the website does not publish a separate terms of service or privacy policy page. Its FAQ describes the service.

• Custom gateway: a web address that you enter yourself. The same data is sent to that address, and its terms are those of the service you chose.

WhatsApp Cloud API (Meta)

Used to deliver one-time codes by WhatsApp. com together with your access token. Business terms, privacy policy.

Telegram Gateway and Telegram Bot API

Used to deliver one-time codes by Telegram. org) receives the phone number and the code when a code is requested. org) receives the chat ID, the message text and the bot token when a code is requested or when you connect a bot.

Terms, privacy policy.

Google sign-in (Google Identity Services)

Used to let visitors sign in with their Google account. com to verify it. Terms, privacy policy.

Facebook sign-in (Meta Platforms)

Used to let visitors sign in with their Facebook account. net and shows Facebook’s own login dialog. com to check the token and read the visitor’s Facebook ID, name and, if they agree, email address.

Nothing else is requested. Terms, privacy policy.

Captcha providers (optional)

Used to block automated sign-in attempts. The built-in check contacts no one. Only if you enable one of the providers below, the visitor’s browser loads the provider’s script, and when a form is submitted the server sends the captcha token and the visitor’s IP address to the provider to check it.

• Cloudflare Turnstile: terms, privacy policy

• hCaptcha: terms, privacy policy

• Google reCAPTCHA: terms, privacy policy

Third-party code

js inside a small wrapper that exposes it to the plugin. com/kazuhikoarase/qrcode-generator

Privacy

The plugin stores phone numbers and email addresses used for sign-in, a security audit log and a message log in which recipients are masked. Codes are never stored in clear text. You can set retention periods, use the WordPress personal data export and erase tools, and enable full data removal on uninstall.

The plugin adds suggested text to the privacy policy guide.