SignInForge

SignInForge is a login experience builder for WordPress. Design the pages your users see when they log in, register or reset their password with the tools you already know, the block editor or Elementor, and keep everything WordPress does behind them: the same address, the same authentication functions, the same hooks.

Your login screens become part of your brand instead of a WordPress page with a logo swapped in. And because SignInForge only changes how the screens look, the plugins that secure or extend your logins (two-factor authentication, captchas, membership and shop plugins) keep working.

How it works

1. Create an experience, a design for your login screens, from one of the bundled templates or from a blank page.
2. Place the Authentication Form block (or the SignInForge Auth Form widget in Elementor) where the form should appear, around your logo, text, images and columns.
3. Publish it and choose it for the login screens in SignInForge > Settings.

SignInForge serves it at the usual wp-login.php address. The form adapts to the screen being shown: log in, lost password, password reset or registration. You can use one design for every screen or a different one for each.

Features

• Block editor designs: build the page with core blocks and the Authentication Form block, with its own settings (which form to show, “Remember Me”, navigation links).
• Elementor designs: when Elementor is active, edit an experience with Elementor and style the SignInForge Auth Form widget from its Style tab.
• Six templates: Classic, Clean, Corporate, Dark, Minimal and Split Screen, ready to customize. Export your own designs as template files (one experience or several at once, block editor and Elementor designs) and import them on another site.
• Every login screen: log in, lost password, password reset and registration (when registration is open), with the WordPress messages and notices.
• Design every screen: preview the lost password, password reset and registration forms and each message (logged out, reset link sent, expired link…) in the block editor, in Elementor, in the template previews and from SignInForge > Settings.
• Redirects: send users to a page of your choice after logging in and after logging out.
• Rate limiting, on by default: failed logins are limited per IP address and account, on every login form of the site and on XML-RPC.
• Cloudflare Turnstile, off by default: a privacy-friendly challenge on the login, lost password and registration forms.
• Generic login errors, on by default: the forms never tell whether the username or the password was wrong.
• Always a way in: if a design cannot be displayed, the native WordPress screen is shown instead, and a secret safe mode URL shows the native screens on demand.
• Accessible forms: every field has a label, errors are announced and linked to the fields.
• Lightweight: no front-end JavaScript of its own (only Cloudflare’s script when Turnstile is on), and the form stylesheet only loads where a form is shown.
• Guided tour: on first use, a short interactive tour shows the experience list, the templates, the settings and the editor tools. Skip it with Esc or “Skip tour”, and start it again any time with the “Guided tour” button (or from the Options menu of the block editor).
• For developers: documented actions and filters for the redirects, the forms, the templates, the client IP address and custom builders.

Built on WordPress authentication

SignInForge does not reimplement logins. Its forms call the WordPress functions (wp_signon(), retrieve_password(), reset_password(), register_new_user()) and use the same field names as wp-login.php. They fire the core form hooks (login_form, lostpassword_form, resetpass_form, register_form, login_enqueue_scripts), the message and redirect filters (wp_login_errors, login_errors, login_redirect, lostpassword_redirect, registration_redirect, logout_redirect) and, through the core functions, the authentication hooks (authenticate, wp_login, wp_login_failed, lostpassword_post, validate_password_reset, registration_errors…). So most code that adds fields to the login forms or hooks into authentication works on SignInForge screens too.

The screen hooks tied to the markup of wp-login.php are not fired, because SignInForge replaces that markup: login_head, login_footer, login_message, login_form_{action} and lost_password. See “Hooks for developers” below for the SignInForge hooks.

Rate limiting details: after 5 failed logins in 10 minutes for the same IP address and account, or 20 for the same IP address, logging in is refused for 15 minutes, even with the right password. All three values can be changed. It covers the login forms (wp-login.php, SignInForge forms and the forms of other plugins that use the WordPress login functions) and XML-RPC; REST API requests authenticated with application passwords are not counted.

Hooks for developers

Actions: signinforge/loaded, signinforge/experience/before_render, signinforge/experience/after_render, signinforge/form/before, signinforge/form/after.

Filters: signinforge/builders (custom page builder adapters), signinforge/preview/use_shell, signinforge/redirect/after_login, signinforge/redirect/after_logout, signinforge/templates (add templates), signinforge/security/client_ip (visitor IP behind a trusted proxy).

To add a field that must be submitted with a form, use the core form hooks listed above (login_form…), which fire inside the <form> element.

Privacy

SignInForge sends no data to its authors and contains no tracking. Rate limiting stores keyed hashes of the IP address and of the login of failed attempts, never the IP address or login themselves, and deletes them daily once expired. Cloudflare Turnstile is only used after you enable it (see External services). SignInForge adds a suggested text to the privacy policy guide in Settings > Privacy, following your settings.

External services

SignInForge can use Cloudflare Turnstile, a service provided by Cloudflare, Inc., to tell humans from bots on the login, lost password and registration forms. It is off by default and only used after you enable it and enter your own site key and secret key in SignInForge > Settings.

When it is enabled:

• Browsers that display one of those forms (on wp-login.php or through a SignInForge form) load the Turnstile script from https://challenges.cloudflare.com/turnstile/v0/api.js. The script runs in the visitor’s browser and exchanges data with Cloudflare to issue a challenge token.
• When such a form is submitted, your site sends the token, your secret key and the visitor’s IP address to https://challenges.cloudflare.com/turnstile/v0/siteverify to check the token. Nothing is sent for XML-RPC, REST API or application password logins, or while safe mode is on.

Cloudflare website terms: https://www.cloudflare.com/website-terms/
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/