About this plugin
ESM Membership & Auth provides a complete front-end membership and authentication workflow for WordPress.
The plugin works independently on a standard WordPress installation. ESM Platform is not required for its primary membership and authentication features.
Standalone features include:
- Front-end user registration.
- Required and optional terms and consent handling.
- Email OTP verification using the WordPress mail system.
- WordPress user creation after successful registration.
- Login and logout.
- Username recovery by email.
- WordPress-native password reset keys.
- Profile access and editing.
- Versioned consent evidence.
- WordPress personal-data export and erasure integration.
- Administrator-managed setup, settings, diagnostics, and shortcodes.
When ESM Platform Core is present, the plugin can operate through an optional compatibility/provider contract. Shadow mode leaves the existing Core authentication owner in place. External Provider mode can be enabled only after the required cutover gates pass.
The plugin does not silently replace Core-owned authentication routes, the Participant ledger, My Page, Wallet, Rewards, Evaluation, or the site presentation shell.
Passive activation
Activation is intentionally passive. Installing, uploading, updating, or activating the plugin does not create membership pages or workflow tables, write operational defaults, schedule cleanup, change rewrite rules, connect to a remote service, or take ownership of an existing authentication page.
On a standalone WordPress site, site-changing setup occurs only after an administrator explicitly chooses Membership setup > Apply membership setup. Existing pages with compatible slugs are reused without overwriting their content; only missing plugin-owned membership pages are created.
Internationalization
English is the source language. The plugin uses the esm-membership-auth text domain and follows the WordPress site/user locale. org language packs after publication.
Privacy
When standalone membership features are enabled, the plugin can process account registration data, email-verification state, mobile phone data entered for membership, and versioned consent evidence. Completed accounts are stored as normal WordPress users.
Temporary registration and verification records are cleaned on a bounded schedule after explicit setup. The plugin integrates with the WordPress personal-data exporter and eraser. Consent evidence may be retained in anonymized form so the site can preserve a record that a decision occurred without retaining direct account identifiers.
Site owners should update their privacy policy to describe the membership fields and retention rules they actually enable.
External services
The primary standalone registration and authentication workflow does not make direct outbound HTTP requests from this plugin.
Email is sent through WordPress wp_mail(). The transport used by wp_mail() depends on the site owner’s WordPress/mail configuration.
Optional ESM Connected mode delegates identity, Participant, and canonical mail ownership to the active ESM Platform Core contract. ESM Platform is not required for standalone operation, and this plugin does not silently enable that integration.
Source code
The distributed plugin contains human-readable PHP, JavaScript, and CSS source. First-party JavaScript and CSS are not minified, and no build step is required to inspect or modify the distributed source.