XeroWP
FrontGlut – Manage Posts, Products, Files, Vendor and Much more from Frontend
FrontGlut – Manage Posts, Products, Files, Vendor and Much more from Frontend

FrontGlut – Manage Posts, Products, Files, Vendor and Much more from Frontend

0/5 (0 ratings) — active installs Updated Nov 2, 2026
file managerfrontend postingfrontend-dashboardmultivendorwoocommerce
Download v1.1.0

FrontGlut gives every kind of user a fast, responsive dashboard on your site.

  • Dashboard – app shell, role-aware menu, widgets, dark mode, brand colours, canvas / full-width / contained layouts, Gutenberg block.
  • Accounts – login, registration, lost password, profile, avatar, email verification, admin approval, captcha (reCAPTCHA, hCaptcha, Turnstile), social login (Google, Facebook), lockout, wp-admin restriction, custom roles, GDPR export/erase.
  • Shortcode forms – post, page and custom-post-type submission, registration and profile forms are described by shortcode attributes (fields, labels, required, status, redirect…). Contact, survey and payment forms come from the free FormGlut plugin, shown with [frontglut_form id=""].
  • Posting – guest and member submissions, moderation queue with reasons, per-role status, my posts, categories/tags manager, custom post types and taxonomies.
  • WooCommerce – products (simple, variable, grouped, external, downloadable), variations, CSV import/export, quick edit, storefront flyout editor, orders, coupons, reports, customers, reviews.
  • Marketplace (optional) – vendor applications, storefronts, per-vendor shipping, sub-orders, commissions, withdrawals.
  • Communication – notifications, messages, tickets, product enquiries, announcements, knowledge base, followers.
  • Files – a private drive for every user (with quota), a shared file manager, grid/list views with previews, colour labels, tags, notes and stars, share links with expiry, a restorable trash, and a “My files” Media Library grid (edit title, alt text, caption; “Add Media” in the frontend editor).
  • System – status report, activity log, tools, REST API.

Shortcodes

[frontglut_dashboard], [frontglut_login], [frontglut_register], [frontglut_lost_password], [frontglut_profile], [frontglut_post_form type="" fields="" status="" …], [frontglut_post_list], [frontglut_form id=""] (FormGlut), [frontglut_stores], [frontglut_vendor_register], [frontglut_uploader], [frontglut_file_explorer folder="" scope="shared|private" view="list|grid"], [frontglut_my_shares], [frontglut_kb], [frontglut_follow id="" type="author|store"], [frontglut_enquiry], [frontglut_member id=""].

Shortcode reference

FrontGlut Shortcodes in wp-admin lists every shortcode with each attribute, its default, allowed values and examples. Example:
[frontglut_post_form type=”page” fields=”title,content,featured_image,category,meta:price:number:Price” required=”title” labels=”title:Headline” status=”pending” guest=”no” editor=”lite” heading=”Submit” button=”Send” redirect=”/thanks/”]
Attributes that give more power than a visitor normally has (publishing without review, guest posting, other post types, extra user fields, review stages, webhooks) only work on pages written by an editor or administrator.

FormGlut

Install the free FormGlut plugin to build contact forms, surveys, bookings and payment forms. [frontglut_form id="5"] shows one, and members see their own entries under “My form entries” in the dashboard.

Section shortcodes

Every dashboard section can go on its own page. Put its shortcode on any page and that section appears there with all its options (list, add, edit, filters):
[frontglut_section id=”products”], or the short form [frontglut_products], [frontglut_posts], [frontglut_orders], [frontglut_drive], [frontglut_files], [frontglut_shares], [frontglut_cpt_<type>] and so on. Settings Dashboard menu lists the shortcode for every section. Optional attributes: title="Heading", nav="yes" (link back to the dashboard). Capability and role rules are the same as in the dashboard; guests see a login form. Links and post-save redirects stay on the page. Turn the short forms off with the frontglut_section_aliases filter.

External services

FrontGlut works fully without any external service. The services below are off by default and are only contacted after a site administrator turns them on and enters their own API keys under FrontGlut Settings. Only one captcha provider can be active at a time.

Google reCAPTCHA (v2 or v3) – spam protection

Used to protect the login, registration, lost-password, post submission and product enquiry forms that the administrator selects under Spam protection.
* When a protected form is shown, the visitor’s browser loads the reCAPTCHA script from https://www.google.com/recaptcha/api.js. Google receives the data its script collects (such as the visitor’s IP address, browser information and interaction with the page).
* When a protected form is submitted, the site sends the captcha response token and the site’s secret key to https://www.google.com/recaptcha/api/siteverify to check it.
* Provided by Google LLC: Terms of Service, Privacy Policy.

hCaptcha – spam protection

Used in the same way and on the same forms as above, when hCaptcha is the selected provider.
* The visitor’s browser loads https://js.hcaptcha.com/1/api.js when a protected form is shown; hCaptcha receives the data its script collects.
* On submit, the response token and secret key are sent to https://hcaptcha.com/siteverify.
* Provided by Intuition Machines, Inc.: Terms of Service, Privacy Policy.

Cloudflare Turnstile – spam protection

Used in the same way and on the same forms as above, when Turnstile is the selected provider.
* The visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js when a protected form is shown; Cloudflare receives the data its script collects.
* On submit, the response token and secret key are sent to https://challenges.cloudflare.com/turnstile/v0/siteverify.
* Provided by Cloudflare, Inc.: Terms of Service, Privacy Policy, Turnstile Privacy Addendum.

Google Sign-In – social login

Lets visitors log in or register with their Google account, only when the administrator enables it and enters a Google OAuth client ID and secret.
* When a visitor clicks “Continue with Google”, they are sent to https://accounts.google.com/o/oauth2/v2/auth to sign in and approve access.
* After they approve, the site exchanges the returned code (with the client ID and secret) at https://oauth2.googleapis.com/token and reads the visitor’s name and email address from https://openidconnect.googleapis.com/v1/userinfo to find or create their account.
* Provided by Google LLC: Terms of Service, Privacy Policy.

Facebook Login – social login

Lets visitors log in or register with their Facebook account, only when the administrator enables it and enters a Facebook app ID and secret.
* When a visitor clicks “Continue with Facebook”, they are sent to https://www.facebook.com/v19.0/dialog/oauth to sign in and approve access.
* After they approve, the site exchanges the returned code at https://graph.facebook.com/v19.0/oauth/access_token and reads the visitor’s ID, name and email address from https://graph.facebook.com/me to find or create their account.
* Provided by Meta Platforms, Inc.: Terms of Service, Privacy Policy.

Privacy

  • FrontGlut does not track visitors and sends no data anywhere unless you enable one of the external services listed above.
  • The activity log (logins, failed logins, settings changes and similar admin events) stores IP addresses anonymised (last part removed) by default. Full addresses are stored only if the administrator turns on “Store full IP addresses in the activity log”. Entries are deleted automatically after the retention period (90 days by default).
  • Guest post submissions store the submitter’s anonymised IP address (same setting) to help moderators fight spam.
  • Share links are public to anyone who has the link (unless an add-on restricts them); every link can be revoked at any time under My shares, and can be set to expire. Share pages are marked noindex.
  • Guests who use the uploader get a functional cookie (frontglut_gt, 24 hours) so they can remove their own temporary uploads.
  • Social login (when enabled) sets a functional cookie (frontglut_oauth, 10 minutes) that ties the sign-in to the visitor’s browser; it is removed when sign-in completes.
  • Frontend registration and vendor applications are off until the administrator enables them.
  • Personal data stored by the plugin is covered by WordPress’ export and erase personal data tools.