FrontGlut

FrontGlut gives every kind of user a fast, responsive dashboard on your site.

• Dashboard – app shell, role-aware menu, widgets, dark mode, brand colours, canvas / full-width / contained layouts, Gutenberg block.
• Accounts – login, registration, lost password, profile, avatar, email verification, admin approval, captcha (reCAPTCHA, hCaptcha, Turnstile), social login (Google, Facebook), lockout, wp-admin restriction, custom roles, GDPR export/erase.
• Forms – drag & drop builder, 20+ field types, conditional logic, templates, import/export.
• Posting – guest and member submissions, moderation queue with reasons, per-role status, my posts, categories/tags manager, custom post types and taxonomies.
• WooCommerce – products (simple, variable, grouped, external, downloadable), variations, CSV import/export, quick edit, storefront flyout editor, orders, coupons, reports, customers, reviews.
• Marketplace (optional) – vendor applications, storefronts, per-vendor shipping, sub-orders, commissions, withdrawals.
• Communication – notifications, messages, tickets, product enquiries, announcements, knowledge base, followers.
• Files – standalone uploader and an Explorer-style file manager shortcode.
• System – status report, activity log, tools, REST API.

Shortcodes

[frontglut_dashboard], [frontglut_login], [frontglut_register], [frontglut_lost_password], [frontglut_profile], [frontglut_post_form id=""], [frontglut_post_list], [frontglut_form id=""], [frontglut_stores], [frontglut_vendor_register], [frontglut_uploader], [frontglut_file_explorer folder=""], [frontglut_kb], [frontglut_follow id="" type="author|store"], [frontglut_enquiry], [frontglut_member id=""].

External services

FrontGlut works fully without any external service. The services below are off by default and are only contacted after a site administrator turns them on and enters their own API keys under FrontGlut → Settings. Only one captcha provider can be active at a time.

Google reCAPTCHA (v2 or v3) – spam protection

Used to protect the login, registration, lost-password, post submission and product enquiry forms that the administrator selects under Spam protection.
* When a protected form is shown, the visitor’s browser loads the reCAPTCHA script from https://www.google.com/recaptcha/api.js. Google receives the data its script collects (such as the visitor’s IP address, browser information and interaction with the page).
* When a protected form is submitted, the site sends the captcha response token and the site’s secret key to https://www.google.com/recaptcha/api/siteverify to check it.
* Provided by Google LLC: Terms of Service, Privacy Policy.

hCaptcha – spam protection

Used in the same way and on the same forms as above, when hCaptcha is the selected provider.
* The visitor’s browser loads https://js.hcaptcha.com/1/api.js when a protected form is shown; hCaptcha receives the data its script collects.
* On submit, the response token and secret key are sent to https://hcaptcha.com/siteverify.
* Provided by Intuition Machines, Inc.: Terms of Service, Privacy Policy.

Cloudflare Turnstile – spam protection

Used in the same way and on the same forms as above, when Turnstile is the selected provider.
* The visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js when a protected form is shown; Cloudflare receives the data its script collects.
* On submit, the response token and secret key are sent to https://challenges.cloudflare.com/turnstile/v0/siteverify.
* Provided by Cloudflare, Inc.: Terms of Service, Privacy Policy, Turnstile Privacy Addendum.

Google Sign-In – social login

Lets visitors log in or register with their Google account, only when the administrator enables it and enters a Google OAuth client ID and secret.
* When a visitor clicks “Continue with Google”, they are sent to https://accounts.google.com/o/oauth2/v2/auth to sign in and approve access.
* After they approve, the site exchanges the returned code (with the client ID and secret) at https://oauth2.googleapis.com/token and reads the visitor’s name and email address from https://openidconnect.googleapis.com/v1/userinfo to find or create their account.
* Provided by Google LLC: Terms of Service, Privacy Policy.

Facebook Login – social login

Lets visitors log in or register with their Facebook account, only when the administrator enables it and enters a Facebook app ID and secret.
* When a visitor clicks “Continue with Facebook”, they are sent to https://www.facebook.com/v19.0/dialog/oauth to sign in and approve access.
* After they approve, the site exchanges the returned code at https://graph.facebook.com/v19.0/oauth/access_token and reads the visitor’s ID, name and email address from https://graph.facebook.com/me to find or create their account.
* Provided by Meta Platforms, Inc.: Terms of Service, Privacy Policy.

Privacy

• FrontGlut does not track visitors and sends no data anywhere unless you enable one of the external services listed above.
• The activity log (logins, failed logins, settings changes and similar admin events) stores IP addresses anonymised (last part removed) by default. Full addresses are stored only if the administrator turns on “Store full IP addresses in the activity log”. Entries are deleted automatically after the retention period (90 days by default).
• Guest post submissions store the submitter’s anonymised IP address (same setting) to help moderators fight spam.
• Guests who use the uploader get a functional cookie (frontglut_gt, 24 hours) so they can remove their own temporary uploads.
• Social login (when enabled) sets a functional cookie (frontglut_oauth, 10 minutes) that ties the sign-in to the visitor’s browser; it is removed when sign-in completes.
• Frontend registration and vendor applications are off until the administrator enables them.
• Personal data stored by the plugin is covered by WordPress’ export and erase personal data tools.