Koloshare

Koloshare puts a real intranet inside the WordPress site your business already has. There is no separate hosting to buy and no per-user pricing, and your files and content stay on your server. Files uploaded through Koloshare live in a private folder in your uploads, content lives in your database, and staff sign in on your own address.

It was built for a trade supplier with a warehouse, a trade counter and vans, and it shows: everything is designed to work one-handed on a phone in a van as well as on a desk.

What your team gets, free

• A file library that finds things. Nested folders, drag-and-drop uploads, PDF-first thumbnails, live search across titles and tags, grid and list views, full-screen previews for PDFs, images, video, audio, Word documents and spreadsheets, and one-tap sharing.
• A branded sign-in on your own address, with brute-force lockouts, signed download links and a staff role that cannot reach wp-admin. The full list is under Security below.

What the paid plans add

• A news feed (Standard). One place for everything the company announces, with a pinned lead story, bylines, featured images and department targeting so an article only reaches the teams it concerns. Articles can carry an optional AI-content disclosure.
• Urgent banners (Standard). When something cannot wait, a banner scrolls across the top of every screen until the moment you choose, and arrives without anyone reloading anything.
• A team directory (Standard). Staff cards with photos, departments, quick call and email actions, birthday and work-anniversary badges.
• An external contacts book (Standard). Suppliers, couriers and partners, with per-person contacts under each company.
• A What’s new bell (Standard). New files, articles and Spotlight updates collect in a short list that survives a refresh. Open a row and it opens the item.
• Analytics (Standard). Downloads, views, logins and searches, scoped to intranet users only, with charts, CSV export and a manageable event log.

What the person running it gets

The Command Centre is a single-screen admin app built for people who do not enjoy the WordPress dashboard: files and folders, tags, users, trash and every setting in one place, with the paid sections (news, banners, team, contacts, analytics, branding) appearing there when a plan includes them. A guided setup wizard on first activation gets a working intranet up in about ten minutes.

Security

• A custom branded sign-in; staff credentials are refused at wp-login.php and sent to the intranet
• Brute-force lockouts with a configurable threshold and duration
• 24-hour temporary passwords that must be replaced on first sign-in
• Signed, time-limited download URLs, so a copied link expires
• Files uploaded through Koloshare kept in a private folder the web server will not serve (on nginx, once the one-line rule Koloshare shows is added), reached through links signed to one person. Files from before 1.8.4 move there with one click, and files a page or post also uses stay public and are listed
• A dedicated Koloshare User role that can use the intranet and cannot reach wp-admin
• Self-healing when a cache serves a logged-in visitor a stale login page

Free, and what the paid plans add

The free Starter tier is the private file library with no cap on it, and it is not a trial: folders, tags, document previews, search, share links, the branded sign-in, all of the security, the setup wizard and the Command Centre. The free plugin contains none of the paid code, so there is nothing in it waiting to be unlocked.

Standard adds the news feed and emailing an article to every account, the What’s new bell, urgent banners in your own colours, the team directory, the contacts book, the homepage background photo, multi-select with bulk download and share, department locks on files, and analytics.

Premium adds custom branding (your logo, colours and a choice of 12 fonts), search inside PDFs and Office documents, a read-only Policies tab, policy sign-off, a new starter induction checklist, per-file passwords, named-user file visibility, the Spotlight story builder, seasonal decorations, advanced analytics and email support from the Command Centre.

Paid plans are sold per site, one price however many staff sign in, through Freemius. A licence installs the premium version over the top of the free one, sharing every file, setting and user. If it lapses nothing is deleted: the workspace drops back to the free tier, keeps every file and setting, and shows the news, team and contacts again when a licence returns.

Hosting

Koloshare stores everything in your existing WordPress site and does not provide its own backup utility. Before making it your team’s single source of truth, check your hosting plan has enough storage for a growing file library, working automatic backups you have actually tested restoring, and upload limits big enough for your largest files.

Third-party services

The free plugin talks to one outside service. Premium adds a second, and one kind of email to us. All are listed here in full.

Freemius (freemius.com), the licensing and update service. It handles the checkout for paid plans, checks licence status and delivers plugin updates. When you opt in on activation, or activate a licence, it receives what the opt-in screen lists: your WordPress name and email address, the site address, title and language, the WordPress, PHP and Koloshare versions, and whether Koloshare is active. Diagnostic details and your list of plugins and themes are sent only if you leave those boxes ticked. On the free plan you can skip the opt-in and the plugin works the same. Terms: https://freemius.com/terms/ and privacy: https://freemius.com/privacy/

Support email (Premium). If you send a support request from the Command Centre, your site emails it to [email protected] with the site address, your name and email address, and the Koloshare, WordPress, PHP and theme versions. Nothing is sent unless you press Send.

Google Fonts (Premium). Staff browsers load the workspace font from fonts.googleapis.com and fonts.gstatic.com, Comfortaa by default or the one you choose, so Google sees their IP address. The font picker in the Command Centre and the setup wizard load all twelve fonts to preview them. The free plugin makes no font requests. Privacy: https://policies.google.com/privacy

Everything else the workspace loads (the PDF, spreadsheet, document and chart libraries) ships inside the plugin. See assets/vendor/README.md for what they are and where each came from.

Bundled libraries

These are shipped inside the plugin rather than loaded from a CDN, so the workspace works on a network that cannot reach one and no executable code is fetched from anywhere else. Each is minified as its author distributes it; the unminified source is at the link given, and all are GPL-compatible.

• PDF.js 3.11.174 (assets/vendor/pdf.min.js, assets/vendor/pdf.worker.min.js) — Apache-2.0 — https://github.com/mozilla/pdf.js
• SheetJS Community Edition 0.20.3 (assets/vendor/xlsx.full.min.js) — Apache-2.0 — https://git.sheetjs.com/sheetjs/sheetjs
• JSZip 3.10.1 (assets/vendor/jszip.min.js) — MIT or GPLv3 — https://github.com/Stuk/jszip
• docx-preview (assets/vendor/docx-preview.min.js) — Apache-2.0 — https://github.com/VolodymyrBaydalka/docxjs

Server tools

If your server happens to have Poppler’s pdftotext installed, Koloshare uses it to pull text out of PDFs for in-document search. Files uploaded in the Command Centre are also read in the browser with the bundled PDF.js, so most sites never need it. Scanned, image-only pages hold no text, so they can’t be searched; Koloshare does no OCR.

None of this is required. Koloshare does not install it, does not ask you to, and falls back to a pure-PHP extractor when it is absent. You just get better results out of awkward PDFs when it is there. Where PHP has shell_exec disabled, as it is on plenty of shared hosting, the whole path is skipped and nothing is attempted. Every filename and password handed to pdftotext goes through escapeshellarg().