Everything about setting up, securing, and troubleshooting Access Glow. For a deeper technical dive into how the security model works, see Security & How it Works.
Access Glow replaces the traditional WordPress username-and-password login with a visual, passwordless flow. A visitor sees an animated encoded pattern on the login page, opens the Access Glow mobile app, and confirms the match with a fingerprint or face scan. No password is ever typed, stored, or transmitted.
Yes — the mobile app is what confirms your identity via biometrics. Without it, you can still use classic username/password login as a fallback (see the Security section below for exactly when that's available).
Your WordPress account still has a password under the hood (WordPress requires one), but you'll never need to type it day-to-day. Classic login stays available as a fallback — see "Is classic login still available?" below.
You can still sign in with your classic WordPress username and password (subject to the same fallback conditions described below), then re-enroll a new device from your site's Connection settings once you have a replacement phone.
Upload the plugin through your WordPress admin's Plugins screen (or the plugin folder via FTP/SFTP), activate it, then follow the Get Started tab to register your site and download the mobile app. See the full setup walkthrough for a step-by-step guide with screenshots.
Yes. Go to the plugin's Settings tab and change the "Login page URL" field to whatever you'd like. Write it down somewhere — if you forget your custom URL later and try the default one instead, you'll get a 404, since a changed slug fully replaces the old one rather than adding an alias.
Yes. The login page is a standalone template independent of your site's active theme, so it works the same way regardless of which theme you're running.
By default, yes — wp-login.php and wp-admin are blocked for logged-out visitors, so your custom Access Glow login page is the only entry point. If you rely on tools or workflows that expect the standard WordPress login URL, there's a "Keep wp-login.php & wp-admin" setting to leave them reachable alongside the Access Glow page.
There are two ways to reach it:
The login page keeps displaying animated bars using a built-in fallback sequence, and a classic login fallback link automatically appears (see above) — visitors are never locked out. This is an automatic, live check, not a saved setting, so protection resumes the moment the service is back with no manual steps needed.
Every login is a fresh, cryptographically unique, short-lived token, confirmed by biometrics on a device that's already enrolled to that specific site. See Security & How it Works for the full technical breakdown, including why this is strongly phishing-resistant.
During normal login, the plugin sends your site's token (a UUID) and a temporary session ID to the Access Glow API — never usernames, passwords, or email addresses. See our Privacy Policy for the full data inventory.
Yes, Access Glow has a free tier suitable for a single site. Paid plans add more sites, more protected users per site, longer login history, and additional features as your needs grow.
Login is never blocked because of plan or payment status — that's a hard rule for us. Plan limits govern things like how many sites you can register or how many protected users a site supports going forward, not whether an already-enrolled user can log in.
Both Android and iOS.
Yes — one app account can be enrolled across as many sites as you have access to, with a single dashboard to see and manage all of them.
Your app has displays the url of your choice after your first login. So, setup a site logout and login using Access Glow app.
It means your site couldn't reach the Access Glow API at that moment — a temporary network or service issue, not something wrong with your WordPress install. The page automatically falls back to classic login in the meantime (see the Security section above), and visual login resumes as soon as the service is reachable again, with nothing for you to do.
General support: [email protected]. Security vulnerabilities specifically: [email protected] — please report privately before any public disclosure.