Login Register Pro: Front-end user system for ProcessWire

Login Register Pro for ProcessWire 3.x provides an all-in-one, self contained module for providing new user registration, secure logins, profile editing, and more. It does this all in a manner that is reliable, efficient, comprehensive and secure.

Get Login Register Pro Now

LoginRegisterPro takes care of giving you a well qualified/authenticated user, and you decide what to do with that user. Whether that is using ProcessWire’s access control system to control what they can see, or using the API to control what they can access or achieve, LoginRegisterPro is built to be a very solid foundation for sites and applications working with front-end users.

Developed and commercially supported by Ryan Cramer, lead developer of ProcessWire CMS, LoginRegisterPro also includes a year of one-on-one support and help for the module in the dedicated VIP support board.

Introduction
- Background
- Built to save you time and expense
Features
Details

Introduction

Background

LoginRegisterPro is a re-imagining of a module called LoginRegister that I built a few years ago for a client with very specific needs. At the client’s suggestion, it was released open source as a starting point or proof-of-concept for those looking to implement login, registration and front-end user profile editing capabilities. Despite being fairly limited in scope and purpose, there was a lot of interest in that module. Since that time, I've received numerous requests to build a Pro version of the module with more enterprise-level features and security, and with commercial support. LoginRegisterPro is the result.

While this module does still share some ideas in common with the original LoginRegister module, it is actually a full rewrite that attempts to cover most of the features that were requested, and with a much stronger foundation. In addition, because this module opens a lot of new possibilities, and everyone has slightly different needs, I wanted to be able to provide the proper level of long-term support that is available with the other Pro modules.

Built to save you time and expense

Even without this module, ProcessWire provides a great foundation for building your own front-end user system. I've built several for client projects over the years (as others have too). But they are always expensive and time consuming to build, and there's never been the budget or time to build an enterprise-level set of features. LoginRegisterPro handles all of that, saving you (and your clients) a lot of time and expense, while delivering a level of features, quality, consistency, ease-of-use and security that is consistent with the ProcessWire core, and doesn't leave you wanting more. With LoginRegisterPro, you no longer have to worry about how to safely register, confirm and authenticate front-end users for your sites or applications.

Features

General features

Front-end secure login form that uses email address as login name.
Front-end secure new registration form with fully configurable fields.
Front-end secure profile edit form with fully configurable fields.
Email confirmation of new user registrations with randomly generated codes.
Users can register on one computer and confirm it on another.
Support for optional front-end “forgot password” reset capability.
Optional ability for users to delete their own accounts.
Optional ability to login user automatically after account confirmation.

Security features

Support for logins with two-factor authentication (TFA).
Support for Google reCAPTCHA on registration form.
Support for blocking emails or IPs in stopforumspam.com database.
Support for throttling of logins to block dictionary attacks.
Login and registration forms are protected by intelligent honeypots.
User must confirm pass to change email, pass, TFA or account deletion.
Ability to set which fields should also require password confirmation.
Support for email whitelist, useful for company intranets and more.
Support for keyword matching blacklists on emails to block registration.
Registrations stored in DB, converted to users after email confirmation.
All forms use CSRF protection (when not disabled in ProcessWire).
Session fingerprinting also remains active when not disabled in ProcessWire.
Configurable expiration of non-confirmed registrations.
Optionally require new user to re-confirm password before account creation.
Many other security improvements relative to original LoginRegister module.

Customization features

Ability to assign custom role(s) to new accounts.
Ability to control what roles can login on the front-end.
Strong, well documented API that keeps you in control of action + output.
Ability to customize markup output by the module.
Ability to specify WireMail module to use for confirmation emails.
Full control over the markup + content of the confirmation emails.
Full control over the randomly generated code type and length.
30+ hookable methods to maximize customizability when you need it.

Support features

Supported one-on-one by Ryan Cramer, lead developer of ProcessWire, in the LoginRegisterPro VIP support board.
1-year of support and upgrades are included. After 1-year you also have the option to renew support/upgrades on a yearly basis.
Consulting and coaching as needed on how to accomplish specific front-end user needs with this module is also part of support.
Also includes support for related ProcessWire core access control configuration.
Also includes support for two-factor (TFA) authentication modules developed by Ryan.

Compared to LoginRegister

If you are familiar with the original LoginRegister module, here’s a few of the differences that you will find in LoginRegisterPro. The module is re-imagining of the LoginRegister module, written from the ground up with improvements in nearly every aspect. Below we’ll refer to LoginRegister as LR and LoginRegisterPro as LRPro:

LRPro is able to store new user registration data in the database, ensuring the user can complete their registration even if they are on a different computer, or if their original session is no longer active. The older LR module was only able to store registration data in the session. LRPro also lets you control how long unconfirmed registrations exist in the database before they are expired and deleted.
LRPro supports 2-factor authentication by way of ProcessWire TFA modules. This is something that LR does not support. Ryan’s open source TFA modules are also supported alongside LoginRegisterPro in the support board.
LRPro is able to use Google reCAPTCHA on the registration form as an extra point of confirmation (in addition to confirmation email).
LRPro supports login and registration honeypots, as well as new registration validation of email and IP address with stopforumspam.com.
LRPro comes with much more detailed documentation and a far stronger API. Nearly everything in LRPro is hookable and customizable, so LRPro is able to accommodate a diversity of front-end user needs.
LRPro also goes much further in terms of security to cover much broader use cases than the original LoginRegister module (see security features above).
LRPro lets you customize the properties of fields in register and profile forms independently of their usage on the user template (field context).
LRPro optionally lets you enable an option for users to delete their own account.
LRPro requires that the user enter their existing password for changes to email, password or two-factor authentication, plus it includes the ability to let you configure what other fields should require a password confirmation.
LRPro gives you control over the subject, content and markup of confirmation email.
LRPro gives you control over the confirmation code type and length used for account registration confirmation.
LRPro lets you maintain email whitelists and blacklists for new registrations.
LRPro gives you the option to require password confirmation before creating a new account. This ensures that the user that requested the account is always the user that confirms (and creates) it, even if someone else somehow saw their confirmation email.
LRPro lets you decide whether a new account confirmation should log the user in automatically or ask them to login.
LRPro provides more control over the confirmation email, including the ability to specify what WireMail module should be used for LRPro transactional/confirmation email.
LRPro requires the user to enter their existing password before making changes to some fields in their Profile, such as email or password. In addition, you can specify any other fields that should require them to enter their password before changes are allowed.
The original LoginRegister module was built for a specific use case and released largely as a proof-of-concept. No major new development for that module is planned, while LoginRegisterPro is a long-term development and support commitment, like the other ProcessWire Pro modules and of course the ProcessWire core.
LRPro comes with full support from me, so I'll be here to help you one-on-one with this module.

Screenshots

An example of the Register screen is shown below (actual appearance depends on how you style it and what fields you add to it). In this case, we have only added a "First and last name" field to our registration form, as the Email and Password fields are always required for registration:

The configuration screen is shown below. As you can see, there are a lot of options here for when you need them. Not to worry, it comes pre-configured with the most common defaults, so you only need to identify things you want to change, and you can generally leave the rest as-is:

Details

Requirements

ProcessWire core version 3.0.123 or newer is required, though newer versions are preferred.
This module depends on reliable email delivery in order to confirm new account registrations. If your website does not have reliable email, it is recommended that you install a WireMail module and connect your ProcessWire with a reliable external email provider.
jQuery is required in the template file used for LoginRegisterPro output. If you are not using jQuery, LoginRegisterPro will automatically load the ProcessWire core version of jQuery, when it needs it in the output. If you already have jQuery present in your site, then LoginRegisterPro will use your version instead.
If you want to use Google reCAPTCHA with your account registration form, you will want to obtain reCAPTCHA API keys from Google (only takes a few seconds).
Your server must be able to make outbound HTTP/HTTPS requests in order to use reCAPTCHA, stopforumspam.com email/IP validations and one-time product key validation. This is generally not an issue unless there is some firewall blocking such outbound connections.
If you need to use file or image fields on your Profile forms, you'll want to install the “FrontendFile” module, available for download in the LoginRegisterPro support board.

How it works

LoginRegisterPro operates off of a single Page in your website to render and process forms for Login, Registration and Profile editing. You only have to tell the module where to place its output in a template file, and it does the rest:

<?= $modules->get('LoginRegisterPro')->execute() ?>

Guests may register to create a new account. User accounts are not actually created until validated by an email sent to the user. They receive a link containing a confirmation code. When clicked on (or pasted in manually after registration) the user account is then created. (Additional confirmation steps can also be optionally enabled). At this point, the user is now confirmed and can login (or be logged-in automatically).

Once users are logged-in, they are allowed to edit their Profile, which is where they can do things like change their password or email address, enable two-factor authentication, or modify any fields you’ve configured. Outside of that, LoginRegisterPro exists to support your front-end user account needs and it’s up to your configuration of ProcessWire’s access control—or your own logic—to determine what the users can access and do in your site/application.

Users that have accounts created through LoginRegisterPro automatically receive a role named “login-register” or other(s) that you configure. This enables you to assign this role (or roles) for “view” permission on one or more templates, so that certain pages in your website are only visible to users in that role.

Alternatively (or in addition) you might use your own logic in template files. For instance, if you wanted to only display a field named “member_notes” to users that are logged-in, you could do so like this:

if($user->isLoggedIn()) echo $page->member_notes;

LoginRegisterPro takes care of all of the difficult parts of validating, creating and authenticating users on your website, and making sure those users can manage their own account. But it doesn't place any limitations upon what you can do with those logged-in users your own. Whether that is building a website with a subscribers or members section, maintaining users in an online store, managing users for submitting or modifying content in your own forms, or anything else you can imagine — my hope is that LoginRegisterPro provides the foundation you need to accomplish your front-end user needs.

What’s included

Instant download of LoginRegisterPro (ZIP file) and your own product key.
Usage of the LoginRegisterPro software/service for as long as you'd like.
1-year of support and upgrades via the ProcessWire VIP LoginRegisterPro support forum.*
Support provided directly by Ryan Cramer, lead developer of ProcessWire.
Support for ProcessWire’s core access control system when used with LoginRegisterPro.
Comprehensive documentation accompanies LoginRegisterPro.
The Personal edition is licensed for usage on 1 website, plus staging and/or development servers.
The Developer edition is licensed for usage on any websites/apps that you (an individual web developer) personally develop for clients or yourself.
The Agency edition is licensed for usage on any websites/apps that your firm/agency (a multi-person company) develops for clients or themselves.
Terms and conditions

*The support/upgrades can optionally be renewed on a yearly basis.