Shortcode forms – post, page and custom-post-type submission, registration and profile forms are described by shortcode attributes (fields, labels, required, status, redirect…). Contact, survey and payment forms come from the free FormGlut plugin, shown with [frontglut_form id=""] .
Posting – guest and member submissions, moderation queue with reasons, per-role status, my posts, categories/tags manager, custom post types and taxonomies.
Files – a private drive for every user (with quota), a shared file manager, grid/list views with previews, colour labels, tags, notes and stars, share links with expiry, a restorable trash, and a “My files” Media Library grid (edit title, alt text, caption; “Add Media” in the frontend editor).
System – status report, activity log, tools, REST API.
FrontGlut → Shortcodes in wp-admin lists every shortcode with each attribute, its default, allowed values and examples. Example: [frontglut_post_form type=”page” fields=”title,content,featured_image,category,meta:price:number:Price” required=”title” labels=”title:Headline” status=”pending” guest=”no” editor=”lite” heading=”Submit” button=”Send” redirect=”/thanks/”] Attributes that give more power than a visitor normally has (publishing without review, guest posting, other post types, extra user fields, review stages, webhooks) only work on pages written by an editor or administrator.
FormGlut
Install the free FormGlut plugin to build contact forms, surveys, bookings and payment forms. [frontglut_form id="5"] shows one, and members see their own entries under “My form entries” in the dashboard.
Section shortcodes
Every dashboard section can go on its own page. Put its shortcode on any page and that section appears there with all its options (list, add, edit, filters): [frontglut_section id=”products”], or the short form [frontglut_products] , [frontglut_posts] , [frontglut_orders] , [frontglut_drive] , [frontglut_files] , [frontglut_shares] , [frontglut_cpt_<type>] and so on. Settings → Dashboard menu lists the shortcode for every section. Optional attributes: title="Heading" , nav="yes" (link back to the dashboard). Capability and role rules are the same as in the dashboard; guests see a login form. Links and post-save redirects stay on the page. Turn the short forms off with the frontglut_section_aliases filter.
External services
FrontGlut works fully without any external service. The services below are off by default and are only contacted after a site administrator turns them on and enters their own API keys under FrontGlut → Settings. Only one captcha provider can be active at a time.
Google reCAPTCHA (v2 or v3) – spam protection
Used to protect the login, registration, lost-password, post submission and product enquiry forms that the administrator selects under Spam protection. * When a protected form is shown, the visitor’s browser loads the reCAPTCHA script from https://www.google.com/recaptcha/api.js. Google receives the data its script collects (such as the visitor’s IP address, browser information and interaction with the page). * When a protected form is submitted, the site sends the captcha response token and the site’s secret key to https://www.google.com/recaptcha/api/siteverify to check it. * Provided by Google LLC: Terms of Service , Privacy Policy .
hCaptcha – spam protection
Used in the same way and on the same forms as above, when hCaptcha is the selected provider. * The visitor’s browser loads https://js.hcaptcha.com/1/api.js when a protected form is shown; hCaptcha receives the data its script collects. * On submit, the response token and secret key are sent to https://hcaptcha.com/siteverify. * Provided by Intuition Machines, Inc.: Terms of Service , Privacy Policy .
Cloudflare Turnstile – spam protection
Used in the same way and on the same forms as above, when Turnstile is the selected provider. * The visitor’s browser loads https://challenges.cloudflare.com/turnstile/v0/api.js when a protected form is shown; Cloudflare receives the data its script collects. * On submit, the response token and secret key are sent to https://challenges.cloudflare.com/turnstile/v0/siteverify. * Provided by Cloudflare, Inc.: Terms of Service , Privacy Policy , Turnstile Privacy Addendum .
Google Sign-In – social login
Lets visitors log in or register with their Google account, only when the administrator enables it and enters a Google OAuth client ID and secret. * When a visitor clicks “Continue with Google”, they are sent to https://accounts.google.com/o/oauth2/v2/auth to sign in and approve access. * After they approve, the site exchanges the returned code (with the client ID and secret) at https://oauth2.googleapis.com/token and reads the visitor’s name and email address from https://openidconnect.googleapis.com/v1/userinfo to find or create their account. * Provided by Google LLC: Terms of Service , Privacy Policy .
Facebook Login – social login
Lets visitors log in or register with their Facebook account, only when the administrator enables it and enters a Facebook app ID and secret. * When a visitor clicks “Continue with Facebook”, they are sent to https://www.facebook.com/v19.0/dialog/oauth to sign in and approve access. * After they approve, the site exchanges the returned code at https://graph.facebook.com/v19.0/oauth/access_token and reads the visitor’s ID, name and email address from https://graph.facebook.com/me to find or create their account. * Provided by Meta Platforms, Inc.: Terms of Service , Privacy Policy .
Privacy
FrontGlut does not track visitors and sends no data anywhere unless you enable one of the external services listed above.
The activity log (logins, failed logins, settings changes and similar admin events) stores IP addresses anonymised (last part removed) by default. Full addresses are stored only if the administrator turns on “Store full IP addresses in the activity log”. Entries are deleted automatically after the retention period (90 days by default).
Guest post submissions store the submitter’s anonymised IP address (same setting) to help moderators fight spam.
Share links are public to anyone who has the link (unless an add-on restricts them); every link can be revoked at any time under My shares, and can be set to expire. Share pages are marked noindex.
Guests who use the uploader get a functional cookie ( frontglut_gt , 24 hours) so they can remove their own temporary uploads.
Social login (when enabled) sets a functional cookie ( frontglut_oauth , 10 minutes) that ties the sign-in to the visitor’s browser; it is removed when sign-in completes.
Frontend registration and vendor applications are off until the administrator enables them.
Personal data stored by the plugin is covered by WordPress’ export and erase personal data tools.
02 / Source details
Gettingstarted.
01Upload the plugin and activate it. Pages are created automatically.
02Visit FrontGlut → Setup and follow the checklist.
03Optional modules (Marketplace) are enabled under FrontGlut → Modules.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
