How to Set Up User Registration, Login, and Account Security

10Web's Agentic Website Builder can add visitor accounts to a website, store, or app — so people can sign up, sign in, and manage a profile for bookings, member content, order history, or a client portal. Sign-up, sign-in, and account security are handled by the User Management plugin, which the builder installs automatically on generated websites.

This article covers turning on registration, choosing how visitors sign up and sign in, email verification, password rules, sessions and devices, each account holder's own profile, account emails, and sign-in for a project built as a separate web app. Adding, editing, and removing individual accounts, assigning roles and permissions, and restricting content by role are covered in a separate article, How to Manage Users, Roles, Permissions, and Access. 

Step 1. Add user registration and login with 10Web AI

You can include registration and login functionality when creating a new website or app or add it to an existing project.

Add registration and login during website or app creation

1. Visit 10web.io or my.10web.io if you already have an account.
2. Describe the website or app you want to create in the AI prompt field.
3. Include details about how users should register, sign in, and manage their accounts.
4. Attach any relevant files, such as your logo or brand guidelines.
5. Submit your prompt to start the generation process.

Example prompt:

Create a membership website where visitors can register using their email address and password. Each user should have a personal dashboard where they can update their profile and view members-only information. Include email verification, password recovery, and secure login functionality.

Depending on your requirements, the AI Planner may ask additional questions about registration, user roles, authentication, or the information you want to collect.

Review the generated website plan, make any necessary changes, and click Approve & start generation.

10Web AI creates the required account functionality and associated pages, designed to match your website or app.

Add registration and login to an existing project

If you already have a website or app, you can request registration and login functionality through AI chat.

1. Open your project in the 10Web dashboard.
2. Launch the 10Web AI Editor.
3. Describe the functionality you want to add.
4. Submit your prompt and review the generated changes.

Example prompt:

Add a registration and login system to my website. Allow users to sign up with email and password, verify their email addresses, and access a personal account page. Add Sign Up and Log In buttons to the website header.

You can continue adjusting the registration and login experience by sending additional prompts.

Step 2. Access User Management in WordPress

The User Management plugin provides a centralized interface for configuring user registration, authentication, and account settings.

You can access WordPress admin in two ways:

• From the 10Web dashboard, click the W icon on your website thumbnail.
• From the 10Web Editor, click the W icon next to the Publish/Save button.

Once in WordPress, open User Management → Settings.

The settings are organized into seven tabs:

• Sign-up: Registration, default roles, email verification, usernames, and consent.
• Sign-in & limits: Session duration, login attempts, and security limits.
• Passwords: Password length and complexity requirements.
• Emails: Sender information, email appearance, templates, and notifications.
• Screens & redirects: Account pages and post-login destinations.
• Features: Optional functionality such as social sign-in, custom registration fields, and sign-up approval.
• Advanced: Technical settings, data retention, and plugin removal options.

After changing settings in any tab, click Save Changes.

Step 3. Set up visitors registration

Open User Management > Settings > Sign-up to control how new accounts are created:

• Self-service sign-up: when checked, visitors can create their own account from your website. Uncheck it to stop new sign-ups . Disabling public registration is useful for private websites or internal applications where access is managed by administrators.
• Default role: the role a new account gets automatically, for example Member. Choose from every role on your site, including roles added by other plugins. To learn more about creating roles and managing permissions, see How to Manage Users, Roles, Permissions, and Access.
• Email verification: on by default. When checked, a new account must confirm its email address before it counts as fully active. Until verification is completed, the user has the Unverified role. Unverified users can still sign in, access their account area, update their email address, and request another verification email. However, they cannot access features requiring their assigned role until verification is complete. Administrators can also manually verify accounts from the user management interface.

• Usernames: Choose whether users sign in with their email address only (Off), use a private username for login (Private), or have a public username displayed as their handle on the website (Public). A visitor can change their own username later from their account page; it is kept separate from their display name.
• Terms page: Select a Terms and Conditions page that users must accept during registration.
• Privacy page: Select a Privacy Policy page that users must accept during registration.

Customize the sign-up process

Go to User Management → Settings → Features to enable additional registration options.

• Custom sign-up fields: Add fields to your registration form to collect additional information, such as company name or job title. You can configure each field's label, type, and whether it is required.
• Sign-up approval: Require administrator approval before newly registered users can sign in. Administrators can review and approve or reject pending registrations.

Example AI prompt:

Add Company Name and Job Title fields to the registration form. Make Company Name required and require administrator approval for all new accounts.

Step 4. Configure visitor sign-In options  and request limits

Go to User Management → Settings → Sign-in & limits to control session duration, lockout behavior, and request limits for sign-in and account-related actions.

• Stay signed in for (days): Sets how long users remain signed in when they choose the Stay signed in option. If they do not choose it, the session ends when the browser closes.
• Failed attempts before a lockout: Sets how many incorrect sign-in attempts are allowed before the account is temporarily locked.
• Lockout length (minutes): Defines how long the first temporary lockout lasts.
• Repeat lockout length (minutes): Defines how long the second and later lockouts last.
• Sign-in attempts per minute, per address: Limits how many sign-in attempts can be made from the same address within one minute.
• Sign-ups per minute, per address: Limits how many new registration attempts can be submitted from the same address within one minute.
• Email-sending requests per minute, per address: Limits how often email-based actions can be triggered from the same address, such as password reset, verification resend, and email change requests.
• Email-sending requests per hour, per account: Limits how many email-based requests a single account can trigger within one hour.

These settings help protect your website from repeated failed sign-ins, excessive sign-up attempts, and abuse of account-related email actions.

Customize the sign-in process

You can also enable additional authentication methods from User Management → Settings → Features.

Social sign-in

After enabling Social sign-in under User Management → Settings → Features, open User Management → Social sign-in to configure the providers you want to offer.

The plugin supports 10 providers: Google, Facebook, Microsoft, Amazon, Discord, GitHub, LinkedIn, X, TikTok, and Apple.

Each provider requires its own application credentials. To configure a provider:

1. Choose the provider you want to enable.
2. Expand How to get these for instructions on creating an application with that provider.
3. Register your application on the provider's platform.
4. Copy the Callback URL displayed in 10Web and add it to your provider's application settings exactly as shown.
5. Copy the application's Client ID and Client secret (or equivalent credentials) into the corresponding fields in 10Web.
6. Click Save keys, then switch the provider On to make it available to visitors.

Repeat these steps for any additional providers you want to offer.

Once configured, visitors can use the enabled providers to register and sign in. The authentication screen displays only the providers you have made available.

Example AI prompt:

Add Google and Apple sign-in options to my website's registration and login pages alongside email and password authentication.

Whichever methods are on, a sign-in attempt that fails never says whether the account exists or the password was wrong — the message is the same either way, and repeated failures lock the account temporarily.

Step 5. Set password requirements

Accounts created with a social provider don't have a password; everyone else signs up and resets their password under the rules set here.

1. Go to User Management > Settings > Passwords.
2. Set Minimum length, the fewest characters a password may have. The default is 8.Turn on Require mixed characters if every password must include upper and lower case letters and a number. This is off by default.

Changes here apply immediately to new sign-ups and the next password change; they are not applied retroactively to existing passwords. Visitors see the requirements before they submit the form, not only after a failed attempt, and a strength indicator as they type.

Step 6. Configure account pages and redirects

Go to User Management → Settings → Screens & redirects to manage the pages used for account-related actions and control where users are directed after signing in.

Configure account pages

10Web automatically configures these pages during website or app generation. If you move or rename them, update the corresponding paths in this section.

• Sign-in page: The page where visitors sign in to their accounts.
• Account page: The page where signed-in users manage their account information.
• Verify-email page: The page users are directed to when verifying their email addresses.
• Reset-password page: The page used to reset forgotten passwords.
• Confirm-new-email page: The page where users confirm changes to their email addresses.
• Set-password page: The page where users create a password for their accounts.

Configure allowed sign-in redirects

The Other hosts sign-in may redirect to field allows you to specify additional hosts that users can be redirected to after signing in.

Enter one host per line. Your current website is always allowed, while redirects to other hosts are blocked unless you add them to this list.

Set role-based redirects after sign-in

Under Where each role lands after sign-in, you can specify the destination page for each user role, including Owner, Admin, Editor, Author, Contributor, Member, Subscriber, Customer, and Shop manager.

For example, you can redirect:

• Members to /my-dashboard
• Customers to /my-account
• Admins to /admin-dashboard

These redirects apply when users sign in without trying to access a specific page. If they were already trying to reach another page, they are returned there after signing in.

Leave a role's field empty to direct users to the account page.

Let account holders manage their own profile, password and sessions

A signed-in visitor manages their own account from the front end of your website, not from WordPress admin, on a single account page (its address varies by site, for example /my-account/). Before signing in, the same page shows sign-in and account-creation forms instead of the account menu described below.

Once signed in, an account holder sees a summary card with their name, email, verification status and number of active sessions, and a Sign out button, followed by:

• Profile Details: view or update the display name, an optional profile photo, and the email address. Changing the email address needs confirming the new address before it takes effect; the old address keeps working until then.
• Change Password: enter the current password and set a new one. This signs the account out of every other device.
• Signed-in Devices: a list of active sessions with their last-active time, and a button to sign out of every device at once.

Step 7. Configure account emails and notifications

Go to User Management → Settings → Emails to customize the appearance, sender information, and content of emails sent to users during registration and account management.

Customize email appearance and sender information

• Sender name: Set the name displayed as the email sender. Leave empty to use your website's name.
• Sender address: Specify the email address used to send notifications. Leave empty to use the platform's default sender. Sending from your own domain requires email configuration for that domain.
• Colour: Choose the color used in account emails.
• Footer text: Add optional text displayed at the bottom of every account email.

Manage email notifications

Enable or disable the following notifications:

• Welcome email: Sent once a user's account becomes active.
• New sign-in email: Sent when a user signs in from a device they have not used before.
• Tell me when someone signs up: Sends a notification to the website administrator whenever someone registers.

Customize email templates

Under Wording, expand any email template to customize its content.

Available templates include email verification, password setup and reset, email address changes, welcome messages, new sign-in notifications, existing-account notifications, and new registration alerts.

You can personalize the wording using:

• {site_name} for the website name.
• {name} for the user's name.
• {email} for the user's email address.

Required account emails, such as verification and password reset messages, are always enabled. The plugin preserves the necessary links when you customize their wording.

Leave a template field empty to use its default text.

Example prompt:

Turn on the welcome email and the new sign-in notification for my account emails, and add "Thanks for booking with us" as the footer text.

Step 7. Review sign-in and account security activity

Go to User Management → Activity to monitor account-related events, including registrations, sign-ins, failed login attempts, account lockouts, and changes to users, roles, and settings.

The activity log displays the following information:

• When: The date and time the event occurred.
• Event: The type of activity, such as sign-up, email verification, or settings changes.
• Account: The user account associated with the event.
• Done by: The user or system that performed the action.
• From: The IP address associated with the activity.
• Source: Where the action originated, such as the website, WordPress admin, or AI generation.
• Details: Additional information about the event.

You can use Filter to narrow down the activity records, Search details or address to find specific events, and Export to download the activity log.

By default, activity records are retained for 12 months. You can change this period under User Management → Settings → Advanced → Keep activity for (months).

Step 8. Set data retention and extra protections

Go to User Management → Settings → Advanced to manage technical settings, data retention, and plugin removal options.

• Client address header: Specify the header used to identify visitors' IP addresses when your website operates behind a proxy. Leave empty to use the connecting address.
• Narrow the core users API: Restrict users without the list-users permission to viewing only their own information through the WordPress users API.
• WordPress toolbar: Choose which user roles can see the WordPress toolbar on the front end of your website. This does not affect the toolbar inside WordPress admin.
• Keep activity for (months): Set how long account activity records are stored. The default is 12 months.
• Keep the email log for (days): Set how long email logs are retained. The default is 90 days.
• Delete never-verified accounts after (days): Automatically delete accounts that have never verified their email addresses and have never signed in. The default is 90 days.

Manage data when uninstalling the plugin

Under Danger zone, the Delete all user management data on uninstall option controls what happens to the plugin's data if it is removed.

When enabled, uninstalling the plugin deletes account records, tokens, activity history, and email logs. WordPress user accounts themselves are preserved.

Next steps

Once you've configured registration, login, account pages, and authentication settings, you can manage registered users, assign roles, and control which parts of your website or app they can access.

See How to Manage Users, Roles, Permissions, and Access to learn how to:

• View, create, edit, and manage user accounts.
• Create custom roles and configure permissions.
• Manage user groups and account status.
• Control access to restricted content.
• Review activity and manage personal data requests.