PortalPilot – Client Portal, File Sharing and Client Management

PortalPilot turns your WordPress site into a client portal. Clients sign in on your own front end, open their files, write notes back to you and keep their profile up to date — without ever seeing the WordPress admin.

You work from a portal page inside the admin: one screen per client with their files, their notes, their profile and their permissions.

Managing clients

• Mark any WordPress user as a client from their profile screen, or while creating them

• A Clients view in the admin, filtered to just your clients

• A dashboard showing client, file, folder and note counts, plus recent registrations, file activity and notes from clients

• One portal page per client with Overview, Profile, Files, Notes and Permissions tabs

• Block a client’s portal access without touching their WordPress account

• Optional welcome email when you create a new client

File manager

• Upload files and build folders for each client, or let clients do it themselves

• Rename, move, trash, restore and permanently delete

• A trash view with restore and empty-trash

• Folder nesting up to five levels deep, or turn folders off entirely

• Mark any file or folder admin-only so the client never sees it

• Uploads up to 2 MB, capped by whatever your server allows

• Choose which file types are accepted: documents, images, spreadsheets, presentations, archives, audio

• Downloads are streamed by PHP, so real file paths are never exposed

• Optional email to the client when you add a file, asked each time or set once

Notes

• Write notes for yourself, or share them with the client

• Clients reply from their portal; their notes arrive on the client’s Notes tab

• Star notes you want to keep at hand, and filter by admin-only, shared, received, starred or trashed

• Trash and restore, with a per-client option to let clients delete their own notes

Client profiles and custom fields

• Clients edit their name, email, password and avatar themselves

• Built-in address fields with country and state or province lists

• Add your own fields: text, textarea, checkbox, checkboxes, radio, email and phone

• Phone fields include international formatting and country selection

• Decide per field whether it appears on registration, on the profile, or admin-only

• Mark fields required, and drag to reorder them

Permissions

• Global defaults for what clients may do: upload, create folders, rename files, rename folders, move files, move folders, trash files, trash folders, view trash, restore from trash, delete their own notes

• Override any of them for an individual client on their portal page

Sign-in, registration and passwords

• Front-end login, registration and password reset pages, built from your own pages

• Self-registration can be switched off, leaving account creation to you

• Custom messages for the portal welcome, access denied and registration disabled screens

• Choose where clients land after logging out

Email notifications

• Eight notifications, each one switchable: new client registered, file uploaded, client note received, client profile updated, welcome, admin added a file, admin shared a note, password reset

• Edit every subject and body in a visual editor

• Merge tags for {{first_name}}, {{last_name}}, {{email}}, {{site_name}}, {{portal_url}}, {{login_url}}, {{file_name}}, {{file_count}} and {{reset_url}}

• Set the From name and address, and send admin notices to more than one recipient

• Sent with WordPress’s own wp_mail(), so any SMTP plugin works alongside it

Security

• Nonce checks and capability checks on every form and AJAX endpoint

• Ownership checks so one client’s files and notes can never be reached by another

• Prepared statements for every database query

• Uploads validated three ways: an allowed-types list, a blocked list of executable types, and magic-byte inspection of the file itself

• Double-extension uploads rejected

• Files stored flat under UUID names in a protected directory, served only through PHP with no-store headers

For developers

• Actions and filters throughout for extending the plugin

• Custom tables rather than post types, and no REST API dependency

• Scripts and styles load only on PortalPilot screens

• Fully translatable through the portalpilot text domain