Everything after sign‑in, module by module
WordPress gives you a login form and an admin panel. HUBU gives you the screens between them — four modules free, three more in Pro, and every one of them a switch that loads nothing when it is off.
First impressions shouldn’t be wp-login.php
Login, registration and recovery on your own page, with your logo, your background and your words — and the limits that keep an open form from becoming an attack tool.
Screens on your own page
Sign in, sign up, forgot password and check-your-email, each with its own title and subtitle, a background image and a logo. Nobody is sent to wp-login.php.
A form builder on every field
Label, placeholder, required or optional, minimum and maximum length, a custom meta key and a CSS class — per field, on both the login and the registration form.
An international phone field
Country detected from your server or from the visitor’s browser, an allow-list or block-list of countries, flags, national mode, and format-as-you-type.
Rate limits on three actions
Login, registration and password reset each get their own attempt count, time window and lockout. Set one to zero to switch it off.
Redirects that make sense
Dedicated destinations after login, after registration and after a reset, each with its own switch — and a single class validates every one, so your login link cannot become an open redirect.
One-time codes, or no password at all
Codes by email or SMS across login, registration and reset, each flow with its own switch and channel. Turn password login off entirely and the site goes fully passwordless.
A dashboard shaped like your site
Members sign in and stay in your site. You decide what sections exist, who may see them, and which cards greet them.
Panel sections you define
Name, slug and icon — a default glyph or one you upload — with per-section access for everyone or for named roles. Group them, and drop external links in among them.
Sections that don’t 404
Links are built correctly on Pretty, Numeric and Plain permalinks, and a rewrite rule that goes missing is rebuilt on the next load rather than left broken.
Six dashboard cards, each a switch
Welcome, account overview, profile progress, security, recent activity and quick links. Every one has its own on-off setting.
The account form, your fields
Nine field types — text, email, password, phone, select, radio, checkbox, textarea, date and time — with length validation and a custom meta key each. Profile, password and avatar are separate.
Fourteen-plus cards, arranged
Four groups — account, store, modules, content — with a shortcuts grid in place of the plain link list, each card carrying its own settings, and the layout ordered how you want it.
Avatars, done properly
Uploads limited to named roles, cached Gravatar, locally drawn initials that need no external request, size and weight limits, and WebP storage — with uploads re-encoded rather than only MIME-checked.
Your store’s account area, finally on-brand
My Account becomes native panel sections — and WooCommerce’s own hooks keep firing, so the extensions you already run keep working.
My Account, as panel sections
Orders, downloads, addresses, account details, payment methods and logout, with matching icons and styling. The module only appears when WooCommerce is active.
Nothing else has to change
HUBU adds endpoints; it does not replace them. Extensions that hook into My Account keep working, and the Overview page names any slug both plugins have claimed.
Store cards on the dashboard
Recent orders with status and total, an order-status breakdown, the current cart with a checkout button, and the downloads a purchase unlocked.
Cross-sells where they already trust you
Recommendations drawn from past purchases, falling back to featured products and then to the newest — shown to a customer who is already signed in.
Panel styles for Woo’s own markup
The HUBU design system extends to WooCommerce’s tables and forms inside the panel, so the parts we did not draw stop looking like the parts we did.
Send the message — and know who read it
Email tells you nothing. An announcement in the panel tells you exactly who opened it, and reaches one role or everyone who bought one product.
Announcements, targeted
Audience of everyone, named roles, or buyers of a specific WooCommerce product. Pin what matters, schedule a publish time, and see how many people it reaches before you send.
Per-user read tracking
You know who saw it — something email will never tell you. Unread items are emphasised in the panel, on the dashboard card and on the header badge.
Private messages with attachments
One-to-one messages to named users, roles or product buyers, with limits on file count, per-file size and total size — and personalisation variables in the body.
The body never leaves the panel
Ticking a channel sends a notice and a link, not the message. A compromised inbox does not expose what you wrote, and the admin says so where you tick it.
One SMS gateway for everything
IPPanel and Twilio ship ready, with pattern-based sending, a parameter map, a health table and a tester so you find out before a real user does. Add your carrier by implementing one interface.
Queued, never inline
Delivery runs on Action Scheduler, so publishing to 10,000 members takes as long as publishing to 10 — and a stalled delivery is detected and can be re-run.
Made to be changed
The theme-proofing, the health checks and the extension points — the three things that decide whether this is still maintainable in six months.
Asset Cleanup
“Works with any theme” is not a claim here, it is a switch: theme and child-theme CSS and JS are stripped from panel and login pages, with a dependency guard so a removal does not break what depended on it.
An Overview page that diagnoses
Six checks with precise messages and fix buttons: unassigned pages, permalinks set to Plain, sections with no rewrite rule, slugs claimed twice, and theme assets still loading on the panel.
hubu/ filters throughout
Dashboard cards, panel menus, endpoint providers, notification templates and email views are all filterable, and a new panel section is one interface. Extend it without forking it.
REST API and translations
A panel REST controller for front-end operations, and every string translatable on the hubu text domain — put your files in wp-content/languages/plugins/ so they survive updates.
Scan the page, then strip it
A switch per installed plugin, a scanner that reports what actually loaded on the panel or the auth page, and advanced rules by handle or URL fragment for styles, scripts or both.
Theming without a child theme
A primary colour, light, dark or follow-the-visitor’s-system, a skin, menu and navbar layout, independent typography for the panel and the login screens, and separate custom CSS for each.
The stack you already run
No theme requirement, no page builder requirement, and no “supported themes” list to fall off.
- WordPress 6.5+
- PHP 8.0+
- WooCommerce
- GPLv3
- Fully translatable
- RTL layouts
- REST API
- hubu/ filters
The defaults you would have set anyway
The limits that stop credential stuffing, account enumeration, and abuse of your mail and SMS budget. On before you touch a setting.
- Independent caps on login, registration and password reset — attempts, window, lockout
- A site-wide password policy: length plus uppercase, lowercase, number and symbol
- Visitors identified from REMOTE_ADDR only, so a spoofed X-Forwarded-For cannot walk past a limit
- Trusting your proxy’s real header takes one explicit opt-in, which is the point
- Redirect targets validated at every step, so your login link cannot become an open redirect
- Avatar uploads are re-encoded, which is what neutralises a malicious image file
The demo is the real interface
Drawn in code from the plugin’s design system — not a video, not screenshots. Click through it, then install the free version and switch on one module.