Members: sign-up and profile

Members (since 1.1.0)

Visitors can sign up themselves and get a profile. There are two roles: administrator (admin panel) and member (own profile only).

Public pages

• /register — sign-up: username (3–40 characters), e-mail, password (min. 8 characters), optional display name.
• /login — log in (by username or e-mail). After 5 failed attempts from one IP within 15 minutes, login is temporarily blocked.
• /profile — display name, e-mail, website, "About"; password change; account deletion (members only).
• /logout — POST only (for security).

These addresses occupy the page slugs login, register, profile, logout; rename any existing page that uses one of them.

Settings

Site settings → Members and registration:

• Allow visitors to sign up — when off, no new accounts can be created; existing members can still log in.
• New accounts need administrator approval — a new account gets the "Pending approval" status and cannot log in yet.

Admin → Users

List and search (name, e-mail, display name), status filter, approve / block / activate, edit (profile fields, role, status, new password), delete. Safeguards: you cannot delete, block or change the role of your own account; the last active administrator cannot be deleted, disabled or demoted. A blocked user's open session ends immediately.

Security

Passwords use password_hash(); CSRF token on every form; hidden trap field for bots; sign-up limit of 5 per hour per IP; profile text is never output as HTML; members cannot log in to the admin panel.

Not included

E-mail verification and e-mail password reset (no mail is sent), social login, avatars, public profile pages.

Upgrading from an earlier version

When coming from 1.0.0, replace the files, then press Site settings → Update database (migration 002_members.sql). Your administrator account keeps the "administrator" role. Back up the database first.