Active WordPress plugin · WooCommerce

Advanced Profile Solution

Everything a user does, before and after they log in.

Registration, login by password, one-time code or passkey, mobile and email verification, the profile they edit, the dashboard they land on, and the WooCommerce account pages they buy from. One plugin, one settings panel and one set of templates, so the user journey stops being five plugins arguing with each other.

What is in it Where it started

Built by Pigment Dev, where I am a co-founder and lead developer. The core is free under the GPL; paid plans for teams and agencies are planned on top of it.

Including Ultimate Profile Solutions2021 to today

/my-account · profile dashboard

Signed in with a one-time code Mobile verified

Profile

Mobile numberVerified by one-time code+98 ••• ••• ••••

EmailVerified by one-time code Verified

National IDMatched to the mobile number (KYC) Verified

Your own fieldAdded in the registration builder

Orders

Order 10241CompletedInvoice

Order 10256ProcessingTrack

DownloadsFrom completed ordersOpen

Read through wc_get_orders(), the same with HPOS on or off.

Security

PasskeySign in with this device's screen lock

Remember this deviceFor the number of days the site sets

Recent sign-ins

One-time code, SMSSucceeded

PasswordFailed, counted by the throttle

What is behind that screen

One-time codes by SMS or email, through Kavenegar, SMS.ir, IPPanel, Twilio and more
Passkeys as discoverable credentials, so nobody has to type a username
Mobile, email and national ID verification, usable as gates on content
Every template laid out right to left, with a complete Persian translation

Before

I built a profile plugin on my own, Ultimate Profile Solutions: a private release in 2019, and on WordPress.org since 2021. It came with a support inbox, and the inbox was an education. One-time codes failing on an unreliable SMS route. A store that needed a national ID field on registration, but only for one role. A client who wanted vendors to land somewhere different from customers. A checkout that had to read the same field the profile writes.

Every one of those requests was answered. Most of them by bolting something onto a structure designed in 2019 for a much smaller idea of what the plugin should do. After enough years, the shape of a codebase decides what you are allowed to build next.

The realisation

Years of support tickets were a specification: which flows real stores need, and where the old assumptions hurt.

Changing the internals of a plugin that live sites depend on, under their feet, was not an option. So in June 2026 the work moved to a new plugin at Pigment Dev, with its own name, settings and tables. It migrates the old settings once, and it can run side by side with Ultimate Profile Solutions, which is still maintained for the sites that use it.

Since then it has been reworked release by release: a rebuilt settings panel, international mobile numbers, a template kit, a setup wizard, content restriction, privacy tools, and a test suite that runs in CI.

// sign-in

Every way a person gets in

Turn on the methods your audience actually uses, in any combination, from one screen.

With a password

Username, email or mobile number with a password
Remember me, with the session length in days
Your own login address, with wp-login.php hidden
The login screen styled from the same settings

Without one

One-time code by SMS or email
Passkeys, usernameless, on the device's own screen lock
Google and Telegram sign-in
One code to register and sign in, so a new customer never sees a second form

Before the door opens

Verified mobile, email or national ID as a gate on content
A captcha on the forms you choose
Redirect rules per role for login, registration and logout
International numbers, one country, several or any

Forms where you need them

A popup, an inline form, a block or a shortcode, all from one configuration, so the popup in the header and the form at checkout cannot drift apart.

// profiles

The profile, built the way the site needs it

A dashboard, not a wall of inputs. What a section shows, and who sees it, are settings rather than code.

Sections you arrange

Rename, re-icon or switch off the built-in sections, and add your own. A section can hold shortcodes, so anything on the site can live inside the profile.

Code per section

CSS and JavaScript for each section, kept out of the rest of the page.

Access per section

Show a section by role, or by access to a LearnDash course.

Registration fields

Text, number, email, mobile, select, multiple choice, rich text and WooCommerce fields, and your own through a hook.

A template gallery

Material, Glass, Neo-Brutalism and more, each covering login, registration, reset, one-time code and the whole dashboard, right to left, from 390px up.

A member directory

Searchable, with a role filter. Members opt in or out, and a card never shows an email or phone number.

Content restriction

An access box on posts and pages: signed-in users, roles, or a verified mobile, email or national ID, enforced on the page, the REST API and feeds.

Support tickets

A ticketing module inside the dashboard, so support lives where the customer already is.

Account pages as sections

Orders, downloads and order stats sit in the profile as sections, styled with everything else.

HPOS, declared

Compatible with WooCommerce's order storage. Orders are read through wc_get_orders() with paginated counts, so a customer with fifteen orders sees fifteen.

Fields that carry over

WooCommerce billing fields can be part of registration, so what a customer enters once is there at checkout.

LearnDash and Bookly

Courses in the dashboard and sections gated by course access, and a Bookly integration for sites that take bookings.

// codes

Codes that arrive

A one-time code is only as good as the route it takes. Each gateway is its own class, and the ones Iranian stores use ship with the plugin, alongside Twilio.

Gateways included

KavenegarSMS.irIPPanelFarazSMSParsGreenAPI.irTwilioWP SMSEmail

Numbers from anywhere

One country, a list of countries, or any. Iranian numbers keep their stored form, the rest are stored in E.164, and numbers outside Iran can go through a second gateway.

Rate limits

Per-flow limits on sending codes, so a sign-up form cannot be turned into someone else's SMS bill.

Failures that say so

When a gateway rejects a message, the user is told and the failure is logged, rather than a code being reported as sent.

Test from the settings

Send a test SMS or a test email from the verification screen before any customer has to.

// security

Security is the feature

This plugin owns the login form, the password reset and the session. That is the part of a site attackers go for first.

Throttled at the door: Failed sign-ins are limited per IP address, on top of the limits on one-time codes.
A captcha of your choice: reCAPTCHA v2 or v3, hCaptcha or Cloudflare Turnstile, on the forms you choose.
A login address of your own: wp-login.php hidden behind a slug you choose.
A sign-in audit: The last 200 sign-ins, successful and failed, in the admin.
Every session, at once: One control signs every user out, and remember-me lasts as long as you set.
Capability checks: Admin actions check what the user may do, not only that the request came from the form.
Privacy tools: WordPress's exporter and eraser cover profile data, verification, tickets and the audit, and users can request their own.
Regression tests: Specs for authentication, authorisation and cross-site scripting run in CI.
Every licence known: Each bundled third-party asset is catalogued with its version, licence and source.

Hooks at every seam

More than 160 actions and filters. Register a captcha provider, alter the registration fields, change how codes are made, or add a profile template.

REST and WP-CLI

REST routes for the signed-in user and their notifications. WP-CLI commands to export and import the configuration, and to re-run the migration from the old plugin.

Tested

PHPUnit, Playwright end-to-end specs and security regression specs, run in CI on PHP 7.4 to 8.4, including a test that both plugins can be active at once.

An accessible admin

Checked against WCAG 2.2 AA: axe reports no violations on any settings screen or setup wizard step.

A template kit

A new template is a manifest, two HTML views and one stylesheet, with an authoring guide that explains the contract.

Translation

The Persian translation covers every string, English ships as its own file, and text an admin types is registered with WPML and Polylang.

hooks.php + wp-cliA selection of the plugin's hooks and WP-CLI commands

// Sign-in and registration
pigment_aps_reglogin_get_register_fields
pigment_aps_reglogin_make_otp
pigment_aps_reglogin_mobile_is_valid

// Captcha, verification and templates
pigment_aps_captcha_providers
pigment_aps_captcha_verify
pigment_aps_kyc_verify
pigment_aps_profile_templates

// WP-CLI
wp pigment-aps export <file>
wp pigment-aps import <file>
wp pigment-aps migrate

PHPWordPressWooCommerceHPOSWebAuthnPHPUnitPlaywrightWCAG 2.2

Is this related to Ultimate Profile Solutions?

Yes. It grew out of it. I wrote Ultimate Profile Solutions, and the years of support behind it became the brief for this plugin. Since June 2026 it has been its own plugin at Pigment Dev, with its own settings and tables and a one-time migration from the old ones.

Can both run on the same site?

Yes, and a coexistence test checks it. Day to day, one sign-in flow per site is simpler, so the usual path is to migrate and then switch the old plugin off.

Is it compatible with HPOS?

Yes. It declares compatibility with WooCommerce's order storage and reads orders through wc_get_orders(), so it behaves the same with HPOS on or off.

Which gateways can send the codes?

Kavenegar, SMS.ir, IPPanel, FarazSMS, ParsGreen, API.ir, Twilio and WP SMS ship with it, plus email. Numbers outside Iran can go through a second gateway, such as Twilio.

How good is the right to left support?

Every template covers login, registration and the full dashboard in right to left, the Persian translation covers all of the plugin's strings, and English ships as its own file.

What happens to my data if I remove it?

Nothing is deleted unless you turn on the setting that removes data on uninstall, which sits in its own Danger Zone under Developer and Tools.