A clearer way into WordPress is taking shape.Meet the alpha ↗
TempLogin.

DEVELOPMENT UPDATE · 19 OCTOBER 2026

From product idea
to working foundations.

The first WordPress implementation is a staging-only alpha. This page separates what exists in the code from the broader experience we are building.

No public production release yet. The private source repository and isolated tests are the current evaluation path. Product illustrations and the website demo use example data.
ALPHA IMPLEMENTED

The core access loop.

  • Owner invitations to separate temporary identities
  • Contributor and Author scopes, with limited capabilities
  • One-hour to seven-day access windows
  • 15-minute, single-use confirmation links
  • Pause, resume, revoke, block, extend and end sessions
  • Grant checks on authenticated identity/capability paths
  • Owner login and renewal notifications
  • IP, browser and documented core-content events
  • Owner-only CSV export and fixed 90-day event retention
  • Owner-issued links for verified historical renewal requests
  • Independent MU access guard after normal deactivation
FUTURE IMPLEMENTATION

The wider product.

  • Authenticator MFA, enrolment and recovery
  • Broader roles, permission templates and elevation
  • Self-service recovery for eligible former collaborators
  • Configurable retention and privacy workflows
  • Timed bans, handover notes and third-party activity coverage
  • Business approvals, vendor/project records and maintenance windows
  • Enterprise independent approvals, external evidence and reviews
  • WordPress.com and multisite compatibility verification
  • Licensing, checkout and support operations

WHAT WE ARE VERIFYING

Access boundaries
before broader scope.

Integration checks cover invitation replay/expiry, non-consuming GET requests, restricted capabilities, alternate authentication paths, session termination, grant state transitions, renewal approvals, peer-IP handling, rate limits and retention. A separate process verifies that the MU guard denies access after the core plugin is deactivated.

These checks are development evidence. They are not a security audit or certification. More browser, mail/proxy, database and plugin-compatibility testing is required before a public production release.

The alpha refuses activation on production environments and requires HTTPS and a writable MU-plugin directory. It never silently converts existing permanent WordPress accounts.

Read the security approach and operational limits ↗

Bring us a real handover problem.

The next iteration should solve work you actually need to do.

Talk about the alpha ↗