About this plugin
FrontGlut gives every kind of user a fast, responsive dashboard on your site.
- Dashboard – app shell, role-aware menu, widgets, dark mode, brand colours, canvas / full-width / contained layouts, Gutenberg block.
- Accounts – login, registration, lost password, profile, avatar, email verification, admin approval, captcha (reCAPTCHA, hCaptcha, Turnstile), social login (Google, Facebook), lockout, wp-admin restriction, custom roles, GDPR export/erase.
- Shortcode forms – post, page and custom-post-type submission, registration and profile forms are described by shortcode attributes (fields, labels, required, status, redirect…). Contact, survey and payment forms come from the free FormGlut plugin, shown with [frontglut_form id=""].
- Posting – guest and member submissions, moderation queue with reasons, per-role status, my posts, categories/tags manager, custom post types and taxonomies.
- WooCommerce – products (simple, variable, grouped, external, downloadable), variations, CSV import/export, quick edit, storefront flyout editor, orders, coupons, reports, customers, reviews.
- Marketplace (optional) – vendor applications, storefronts, per-vendor shipping, sub-orders, commissions, withdrawals.
- Communication – notifications, messages, tickets, product enquiries, announcements, knowledge base, followers.
- Files – a private drive for every user (with quota), a shared file manager, grid/list views with previews, colour labels, tags, notes and stars, share links with expiry, a restorable trash, and a “My files” Media Library grid (edit title, alt text, caption; “Add Media” in the frontend editor).
- System – status report, activity log, tools, REST API.
Shortcodes
[frontglut_dashboard], [frontglut_login], [frontglut_register], [frontglut_lost_password], [frontglut_profile], [frontglut_post_form type="" fields="" status="" …], [frontglut_post_list], [frontglut_form id=""] (FormGlut), [frontglut_stores], [frontglut_vendor_register], [frontglut_uploader], [frontglut_file_explorer folder="" scope="shared|private" view="list|grid"], [frontglut_my_shares], [frontglut_kb], [frontglut_follow id="" type="author|store"], [frontglut_enquiry], [frontglut_member id=""].
Shortcode reference
FrontGlut → Shortcodes in wp-admin lists every shortcode with each attribute, its default, allowed values and examples. Example:
[frontglut_post_form type=”page” fields=”title,content,featured_image,category,meta:price:number:Price” required=”title” labels=”title:Headline” status=”pending” guest=”no” editor=”lite” heading=”Submit” button=”Send” redirect=”/thanks/”]
Attributes that give more power than a visitor normally has (publishing without review, guest posting, other post types, extra user fields, review stages, webhooks) only work on pages written by an editor or administrator.
FormGlut
Install the free FormGlut plugin to build contact forms, surveys, bookings and payment forms. [frontglut_form id="5"] shows one, and members see their own entries under “My form entries” in the dashboard.
Section shortcodes
Every dashboard section can go on its own page. Put its shortcode on any page and that section appears there with all its options (list, add, edit, filters):
[frontglut_section id=”products”], or the short form [frontglut_products], [frontglut_posts], [frontglut_orders], [frontglut_drive], [frontglut_files], [frontglut_shares], [frontglut_cpt_<type>] and so on. Settings → Dashboard menu lists the shortcode for every section. Optional attributes: title="Heading", nav="yes" (link back to the dashboard).
Capability and role rules are the same as in the dashboard; guests see a login form. Links and post-save redirects stay on the page. Turn the short forms off with the frontglut_section_aliases filter.
External services
FrontGlut works fully without any external service. The services below are off by default and are only contacted after a site administrator turns them on and enters their own API keys under FrontGlut → Settings. Only one captcha provider can be active at a time.
Google reCAPTCHA (v2 or v3) – spam protection
Used to protect the login, registration, lost-password, post submission and product enquiry forms that the administrator selects under Spam protection.
js. Google receives the data its script collects (such as the visitor’s IP address, browser information and interaction with the page).
com/recaptcha/api/siteverify to check it.
* Provided by Google LLC: Terms of Service, Privacy Policy.
hCaptcha – spam protection
Used in the same way and on the same forms as above, when hCaptcha is the selected provider.
js when a protected form is shown; hCaptcha receives the data its script collects.
com/siteverify.
: Terms of Service, Privacy Policy.
Cloudflare Turnstile – spam protection
Used in the same way and on the same forms as above, when Turnstile is the selected provider.
js when a protected form is shown; Cloudflare receives the data its script collects.
com/turnstile/v0/siteverify.
: Terms of Service, Privacy Policy, Turnstile Privacy Addendum.
Google Sign-In – social login
Lets visitors log in or register with their Google account, only when the administrator enables it and enters a Google OAuth client ID and secret.
com/o/oauth2/v2/auth to sign in and approve access.
com/v1/userinfo to find or create their account.
* Provided by Google LLC: Terms of Service, Privacy Policy.
Facebook Login – social login
Lets visitors log in or register with their Facebook account, only when the administrator enables it and enters a Facebook app ID and secret.
0/dialog/oauth to sign in and approve access.
com/me to find or create their account.
: Terms of Service, Privacy Policy.
Privacy
- FrontGlut does not track visitors and sends no data anywhere unless you enable one of the external services listed above.
- The activity log (logins, failed logins, settings changes and similar admin events) stores IP addresses anonymised (last part removed) by default. Full addresses are stored only if the administrator turns on “Store full IP addresses in the activity log”. Entries are deleted automatically after the retention period (90 days by default).
- Guest post submissions store the submitter’s anonymised IP address (same setting) to help moderators fight spam.
- Share links are public to anyone who has the link (unless an add-on restricts them); every link can be revoked at any time under My shares, and can be set to expire. Share pages are marked noindex.
- Guests who use the uploader get a functional cookie ( frontglut_gt, 24 hours) so they can remove their own temporary uploads.
- Social login (when enabled) sets a functional cookie ( frontglut_oauth, 10 minutes) that ties the sign-in to the visitor’s browser; it is removed when sign-in completes.
- Frontend registration and vendor applications are off until the administrator enables them.
- Personal data stored by the plugin is covered by WordPress’ export and erase personal data tools.