XeroWP
Custom Auth Suite™ – Custom Authentication & User Access
Custom Auth Suite™ – Custom Authentication & User Access

Custom Auth Suite™ – Custom Authentication & User Access

5/5 (1 ratings) — active installs Updated Nov 2, 2026
authenticationcustom loginemail verificationpage restrictionUser Registration
Download v0.9.3
Live WordPress Customizer — Real-time Auth preview.

Live WordPress Customizer — Real-time Auth preview.

More than a custom login page

Custom Auth Suite™ (CAS) combines login, registration, email verification, recovery and protected content using native WordPress users—not a membership or payment system.

Who Is Custom Auth Suite For?

  • Business sites and agencies needing WordPress authentication, protected pages and email verification.
  • Freelancers who manage client websites.

Design, protect and manage — included in Free

  • Custom Login, Registration, Password Recovery and Reset Confirmation pages.
  • Native WordPress Customizer with live previews of the actual Auth pages.
  • Separate Media Library backgrounds for each Auth page, with display modes, nine palette colors and opacity.
  • Small, Medium and Big form sizing, typography, animation and box shadow controls.
  • Email verification and customizable authentication email templates.
  • Protected WordPress pages, directory rules and redirects.
  • Configurable CAS Registration password checks and live strength feedback.
  • Setup wizard, Installation Doctor and Health Check with local diagnostics.

Single-site, Multisite and languages

CAS supports single sites and native subdirectory/subdomain Multisite, with per-site Auth settings and WordPress network users/memberships. Free uses WordPress Site Language and WordPress.org language packs, without Polylang.

Optional commercial editions

Advanced and Premium are separately distributed packages, not features bundled in this Free download.

  • Advanced: Polylang-aware multilingual Auth routing and language-specific content; reCAPTCHA Enterprise for supported authentication and Contact Form 7 flows; local CF7 Math Check; and CAS Settings Export/Import for supported configuration.
  • Premium: Polylang-aware multilingual Auth routing and language-specific content; reCAPTCHA Enterprise for supported Auth and Contact Form 7 flows; CF7 Math Check; CAS Settings Export/Import; WebAuthn/Passkeys for passwordless login and credential management; and configurable Debug with error/warn/info levels written to log files and feature channels for login, registration, password recovery, email, redirects, reCAPTCHA and Passkeys/WebAuthn. Browser-console diagnostics also help verify reCAPTCHA Enterprise and Math Check operation. Passkeys require HTTPS and a compatible runtime.

Commercial release notes 0.9.3 (EN / IT):
Advanced: https://customauthsuite.com/custom-auth-suite-advanced/?release=0.9.3#cas-release-0-9-3 | https://customauthsuite.com/it/licenza-advanced-custom-auth-suite/?release=0.9.3#cas-release-0-9-3
Premium: https://customauthsuite.com/custom-auth-suite-premium/?release=0.9.3#cas-release-0-9-3 | https://customauthsuite.com/it/licenza-premium-custom-auth-suite/?release=0.9.3#cas-release-0-9-3

Setup and diagnostic support

Configure Auth pages, design, verification and Protected Paths, then test each flow. Doctor reports and Remote Support Diagnostics require opt-in; remote access is never automatic.

External Services

Optional remote services are separately controlled; CAS remains local-first.

Remote Admin Messages: Enable this optional service to receive important CAS security and compatibility updates, tutorials, support guidance and links to useful resources, including Privacy & Cookie Policy templates at https://customauthsuite.com/privacy-cookie-notes/. Visit that website directly to review and manually access available templates; CAS does not generate or select a policy for your site. Adapt templates and seek legal review. Off by default; once enabled, CAS requests notices from https://customauthsuite.com/wp-json/cas-remote-messages/v1/messages. Requests may include plugin version/edition, locale, message placement, support/compatibility context and a privacy-preserving site hash. Free receives operational notices, not commercial upgrade cards. CAS executes no remote code or arbitrary HTML; disabling messages stops requests.

Remote Message Interaction Analytics: Off by default; separate opt-in. Selected notice/resource clicks may reach https://customauthsuite.com/wp-json/cas-remote-messages/v1/events with event/CTA IDs, edition/version, optional license context, site hash, timestamp and delivery status; local preferences and commercial-preview clicks are excluded.

Assisted Doctor Support: Off by default. With administrator opt-in and a manual support-request click, CAS creates a redacted Doctor report with a random token valid for about 30 minutes (maximum one hour). Disabling the service revokes access. Reports exclude passwords, cookies, nonces, authorization headers, full license keys, API secrets, private keys and diagnostic tokens.

Remote Support Diagnostics: Support tickets require explicit consent, a temporary signed token and manual administrator activation; links alone cannot enable diagnostics. Revocation checks may contact https://customauthsuite.com/wp-json/cas-support-desk/v1/support-diagnostics/revocation using hashed IDs and timestamps, not credentials or full tokens. Diagnostics can stop offline; no users are created or reports auto-uploaded.

Website: https://customauthsuite.com/ | Terms: https://customauthsuite.com/terms-of-use/ | Privacy: https://customauthsuite.com/privacy-cookie-policy/

Free does not contact commercial licensing, updater or package-download services.

Privacy and Local Data

CAS stores settings, verification data, Protected Paths and enabled logs. Doctor reports stay local unless deliberately shared; “unclassified” does not mean unsafe. Uninstall retention follows site settings, and remote services have separate controls.