Koloshare

Koloshare puts a real intranet inside the WordPress site your business already has. There is no separate hosting to buy, no per-user pricing, and no data leaving your server. Files live in your Media Library, content lives in your database, and staff sign in on your own address.

It was built for a trade supplier with a warehouse, a trade counter and vans, and it shows: everything is designed to work one-handed on a phone in a van as well as on a desk.

What your team gets, free

• A file library that finds things. Nested folders, drag-and-drop uploads, PDF-first thumbnails, live search across titles and tags, grid and list views, full-screen previews for PDFs, images, video, audio, Word documents and spreadsheets, and one-tap sharing.

• A branded sign-in on your own address, with brute-force lockouts, signed download links and a staff role that cannot reach wp-admin. The full list is under Security below.

What the paid plans add

• A news feed (Standard). One place for everything the company announces, with a pinned lead story, bylines, featured images and department targeting so an article only reaches the teams it concerns. Articles can carry an optional AI-content disclosure.

• Urgent banners (Standard). When something cannot wait, a banner scrolls across the top of every screen until the moment you choose, and arrives without anyone reloading anything.

• A team directory (Standard). Staff cards with photos, departments, quick call and email actions, birthday and work-anniversary badges.

• An external contacts book (Standard). Suppliers, couriers and partners, with per-person contacts under each company.

• A What’s new bell (Standard). New files, articles and Spotlight updates collect in a short list that survives a refresh. Open a row and it opens the item.

• Analytics (Standard). Downloads, views, logins and searches, scoped to intranet users only, with charts, CSV export and a manageable event log.

What the person running it gets

The Command Centre is a single-screen admin app built for people who do not enjoy the WordPress dashboard: files and folders, tags, users, trash and every setting in one place, with the paid sections (news, banners, team, contacts, analytics, branding) appearing there when a plan includes them. A guided setup wizard on first activation gets a working intranet up in about ten minutes.

Security

• A custom branded sign-in that never exposes wp-login.php

• Brute-force lockouts with a configurable threshold and duration

• 24-hour temporary passwords that must be replaced on first sign-in

• Signed, time-limited download URLs, so a copied link expires

• A dedicated Koloshare User role that can use the intranet and cannot reach wp-admin

• Self-healing when a cache serves a logged-in visitor a stale login page

Free, and what the paid plans add

The free Starter tier is the private file library with no cap on it, and it is not a trial: folders, tags, document previews, search, share links, the branded sign-in, all of the security, the setup wizard and the Command Centre. The free plugin contains none of the paid code, so there is nothing in it waiting to be unlocked.

Standard adds the news feed and emailing an article to every account, the What’s new bell, urgent banners in your own colours, the team directory, the contacts book, the homepage background photo, multi-select with bulk download and share, download locks by department, and analytics.

Premium adds custom branding (your logo, colours and a choice of 12 fonts), search inside PDFs and Office documents, a read-only Policies tab, per-file passwords, named-user file visibility, the Spotlight story builder, seasonal decorations, advanced analytics and email support from the Command Centre.

Paid plans are sold per site, one price however many staff sign in, through Freemius. A licence installs the premium version over the top of the free one, sharing every file, setting and user. If it lapses nothing is deleted: the workspace drops back to the free tier, keeps every file and setting, and shows the news, team and contacts again when a licence returns.

Hosting

Koloshare stores everything in your existing WordPress site and does not provide its own backup utility. Before making it your team’s single source of truth, check your hosting plan has enough storage for a growing file library, working automatic backups you have actually tested restoring, and upload limits big enough for your largest files.

Third-party services

Koloshare talks to one outside service, and it is listed here in full.

com), the licensing and update service. It handles the checkout for paid plans and delivers plugin updates. Koloshare asks it for updates and licence status, nothing else, and only after you opt in on activation.

You can skip the opt-in and the plugin works the same. com/privacy/

Everything else the workspace loads (the PDF, spreadsheet, document and chart libraries) ships inside the plugin. md for what they are and where each came from.

Bundled libraries

These are shipped inside the plugin rather than loaded from a CDN, so the workspace works on a network that cannot reach one and no executable code is fetched from anywhere else. Each is minified as its author distributes it; the unminified source is at the link given, and all are GPL-compatible.

• PDF.js 3.11.174 ( assets/vendor/pdf.min.js, assets/vendor/pdf.worker.min.js ) — Apache-2.0 — https://github.com/mozilla/pdf.js

• SheetJS Community Edition 0.20.3 ( assets/vendor/xlsx.full.min.js ) — Apache-2.0 — https://git.sheetjs.com/sheetjs/sheetjs

• JSZip 3.10.1 ( assets/vendor/jszip.min.js ) — MIT or GPLv3 — https://github.com/Stuk/jszip

• docx-preview ( assets/vendor/docx-preview.min.js ) — Apache-2.0 — https://github.com/VolodymyrBaydalka/docxjs

Server tools

If your server happens to have Poppler ( pdftotext, pdfinfo, pdftoppm ) or Tesseract installed, Koloshare will use them to pull text out of PDFs for in-document search, and to read scanned pages that hold no text layer.

None of this is required. Koloshare does not install them, does not ask you to, and falls back to a pure-PHP extractor when they are absent. You just get better results out of awkward PDFs when they are there.

Where PHP has shell_exec disabled, as it is on plenty of shared hosting, the whole path is skipped and nothing is attempted. Every filename and password handed to those tools goes through escapeshellarg().