Bang! Invites – Invite People to Register by Email

Changelog

1.0.38

• Naming and structure tidied for the plugin directory. The admin screen’s page identifier now carries the plugin’s own prefix, so it cannot collide with another plugin’s menu. The old unprefixed registration shortcode has been removed – if you were using it, replace it on your registration page with [banginvites_form], which has always been the documented shortcode and behaves identically. The plugin’s functions are no longer wrapped in existence checks, so a name collision surfaces as a clear error rather than quietly disabling part of the plugin.
• Invitations are now restricted to low-privilege, subscriber-like roles. No role that can edit or publish content (Contributor, Author, Editor) or manage the site (options, users, plugins, themes) can be assigned by an invitation link; membership and client-area roles built on read-level access are unaffected. The role is re-checked at the moment the account is created, so a tampered record or a role that later gained capabilities falls back safely to your default role. To give someone a higher role, invite them and promote their account under Users after they register.
• Registration is processed before the page renders rather than while the registration page is being output. On sites where the theme or a page builder (Elementor’s image-loading module is one) sends output early, the post-registration login and redirect could previously fail with “headers already sent” warnings and the person would not be logged in or moved on. Handling it earlier removes that class of conflict.
• An accepted invitation can no longer be flipped back to Pending by generating a new link for it (previously possible from a stale Tracking tab). Send a fresh invitation instead.
• Every settings screen with more than one section now has an “On this page” index down the side that tracks where you are as you scroll and jumps to any section when clicked. Fields and help text fill the full width of the panel; below a narrow width the index becomes a row of pills above the content.

1.0.35

• Stronger cache prevention on invitation links, covering every class of cache: no-cache headers for standards-respecting caches and CDNs, the DONOTCACHEPAGE constant for WordPress caching plugins, a dedicated header for LiteSpeed servers, and a session cookie for platform caches that override the site’s own headers (20i’s StackCache among them) – the same layered approach WooCommerce uses to keep checkouts out of caches. A hint under the registration page selector and an FAQ entry cover the rare host cache that ignores all of these, where the page should be added to the host’s cache exclusion list.

1.0.34

• Invitation links are never cached. Page caches were able to serve a stale copy of the registration page from before an invitation was accepted, so a used single-use link could keep showing the registration form to logged-out visitors. Requests carrying invite parameters, and the registration page itself, now send no-cache headers and set the DONOTCACHEPAGE constant that the major cache plugins respect.
• Re-inviting an address now clears its old accepted record too (previously only pending ones), so Tracking no longer shows a stale Accepted row beside the fresh Pending invitation.
• Deleting a WordPress user now clears their accepted invitation record, so Tracking never shows Accepted for an address with no account behind it. Pending invitations for that address are left live, so the person can use their link again.

1.0.33

• Housekeeping for the plugin directory. All admin and front-end CSS and JavaScript now goes out through WordPress’s own enqueue system against a registered handle, instead of being printed as raw style and script tags. The admin’s Inter font is served as four ordinary font files rather than being base64-encoded into the stylesheet on every page load, which is both lighter and no longer looks like obfuscated code to a scanner. Author details updated to Bang! Plugins.

1.0.32

• New admin logo: the “bang! invites free” artwork now heads the plugin screens.

1.0.31

• Settings tab tidy-up. The shortcode now appears exactly once, as a click-to-copy chip right under the registration page selector (it used to be mentioned three times, with copying possible only at the bottom); the Invite tab’s setup reminder uses the same chip. Cards are reordered to follow the setup flow: Registration method, then the form’s styling directly beneath it (so in external mode everything greyed out sits together), then invitation behaviour, then Pages – which now also holds the invitation-only protection toggle, since that protects the page, with the redirect and login destinations. In external mode the page hint now says to place your registration plugin’s form there instead of the shortcode.

1.0.30

• Works alongside other registration plugins. A new “Registration method” choice at the top of Settings lets you say “I’m using another registration plugin”: place that plugin’s form on your registration page instead of the shortcode, and everything else keeps working. Invite links, expiry and tracking are unchanged; the moment the other plugin (or an admin) creates the account, the invitation is marked accepted, the invited role is applied, and the welcome and notification emails send. In this mode the page itself validates every invite link on load – a valid pending link shows the page, a used link shows “you have already signed up” with a Log in button, and an invalid or expired link shows a notice – so single-use enforcement no longer depends on the built-in form. Acceptance matches by the invited email address. Settings that belong to the built-in form (post-registration destination, auto-login, form styling) are greyed out, not hidden, while this mode is on.

1.0.29

• Review fixes. Silencing WordPress’s own account emails no longer triggers PHP warnings from core on PHP 8 (the filter now returns a properly-shaped value). A custom post-registration destination on another domain now actually redirects there instead of silently falling back to the dashboard. Tracking no longer offers “Copy link” on an expired invitation, since that link is dead – use New link or Resend, which issue a fresh one.

1.0.28

• Clear “already signed up” handling on the registration page. Someone who revisits a used invite link now sees “You have already signed up – this invitation has been used” with a Log in button pointing at your chosen login page, instead of the generic invalid-or-expired notice. The same applies when an account already exists for the invited email even though the invite is still pending (e.g. registered another way). A logged-in visitor now gets a “Go to your client area” button pointing at your post-registration destination. All of these notices share one branded style, tinted from your registration-button colour.

Earlier versions: the complete history back to 1.0.0 ships in this plugin’s changelog.txt.