About this plugin
Sarala Login Page lets your visitors create an account or log in with one click using the accounts they already have:
- Apple (Sign in with Apple)
- Microsoft (personal, work and school accounts)
Works with WordPress and WooCommerce
- Buttons on the WordPress login and registration pages.
- Buttons on the WooCommerce My Account login and registration forms.
- Buttons at the top of the WooCommerce checkout, so guests can sign up or log in and come straight back to checkout with their cart kept.
- WooCommerce’s own “create an account during checkout” option keeps working.
- A [sarala_login_page] shortcode to place the buttons anywhere.
The right role for every new account
- If WooCommerce is active, every new sign-up becomes a Customer.
- If not, new sign-ups get the “New User Default Role” from Settings > General (Subscriber by default).
- Admins can change any user’s role at any time from Users, as usual.
Existing users log straight in
If someone already has an account with the same email address, logging in with Google, Facebook or another provider takes them straight into that account and connects it automatically. For safety this only happens when the provider has verified the email address. Users can also connect and disconnect accounts from their profile (or from My Account > Account details with WooCommerce), and admins see which accounts each user has connected in a “Social login” column on the Users screen.
Bot protection with a simple math question
”. The answer is checked on the server, so bots that skip the form cannot get past it. The REST API, XML-RPC and application passwords are not affected.
Built to be safe
- Standard OAuth 2.0 / OpenID Connect with a one-time state value tied to the visitor’s browser.
- Secrets are never shown again after saving.
- No tracking and no data sent anywhere except to the login provider the visitor chooses.
Made by Laghavi Digital (Laghavi FZE LLC). site/sarala-login-page.
External services
This plugin connects to the login provider a visitor picks, only when they click its button. The site owner must create an app with each provider they enable and agree to that provider’s terms.
When a visitor clicks a button, their browser is sent to the provider’s login page. After they agree, the provider sends back a one-time code, and the site exchanges it (server to server) for the visitor’s basic profile: their account ID, name and email address. Nothing else is sent or requested.
- Google – accounts.google.com, oauth2.googleapis.com, openidconnect.googleapis.com. Terms, Privacy
- Facebook (Meta) – www.facebook.com, graph.facebook.com. Terms, Privacy
- Apple – appleid.apple.com. Terms, Privacy
- Microsoft – login.microsoftonline.com, graph.microsoft.com. Terms, Privacy
- LinkedIn – www.linkedin.com, api.linkedin.com. Terms, Privacy
The plugin stores the visitor’s provider account ID and email on their WordPress user so they can log in again. This data is deleted when the plugin is deleted.
io) – optional, off by default. io, when an administrator opens the Failed logins screen, to show the approximate city, region and country. Each result is kept for a week, so an address is looked up at most once a week.
Terms, Privacy