Skip to content

Registration and login

Loveshack uses passwordless authentication. Subscribers never choose or manage a password; they receive a sign-in link by email.

Why passwordless

For a publication, passwords are pure friction. They generate support requests, they get reused across sites, and they add a credential you have to protect. Emailed sign-in links move the security boundary to the subscriber's mailbox, which they already protect.

The trade-off is a hard dependency on email delivery: if mail is broken, nobody can sign in. Configure a real transport before launch — see Email delivery.

The sign-up flow

  1. A visitor enters their email address on /subscribe/ or through the floating subscription panel.
  2. Loveshack creates the subscriber record and sends a confirmation email.
  3. Following the link confirms the address and signs them in.
  4. They land on /settings/, where they can set their notification frequency and tier.

Only confirmed subscribers are counted in the header subscriber pill and included in digest processing.

The sign-in flow

An existing subscriber entering their address receives a fresh sign-in link rather than a duplicate account. The link authenticates them and returns them to the site.

Paying first

A visitor can also start with a paid tier. Stripe Checkout takes the email, and the account is created from the completed payment, confirmed, and signed in on return. See Tiers and Stripe.

Configuring the forms

The copy shown on the subscribe and login forms is editable under LoveShack → Subscribers, along with the sender name and address these emails come from. Use a sender address on the site's own domain — sign-in mail from a mismatched domain is the most common reason these messages land in spam.

Spam protection

The subscribe form ships with two built-in bot defenses: a hidden honeypot field and a minimum-fill-time check. Submissions that trip either one receive a decoy success response instead of creating an account.

For stronger protection, install and activate the ALTCHA: Spam Protection plugin. Loveshack detects it automatically — no configuration is needed on the theme side:

  • The ALTCHA widget is rendered inside the subscribe form in its invisible display mode: it solves its proof-of-work challenge in the background as soon as a visitor focuses the form, and no "I'm not a robot" box is shown.
  • The widget stays invisible only while everything works. If the challenge is still unsolved when the visitor submits, the form reveals the widget, shows a "Completing the spam check" notice, and submits automatically once the challenge solves. If a submission fails — spam check or otherwise — the widget is revealed and reset so the retry solves a fresh challenge.
  • The AJAX submission is verified server-side against the ALTCHA plugin, and submissions without a valid ALTCHA payload are rejected.
  • Verified and failed attempts appear in the ALTCHA analytics dashboard under the lss_subscribe action.

Deactivating the plugin returns the form to the built-in defenses; nothing breaks.

Two filters adjust the integration:

  • lss_altcha_enabled — return false to keep the form on the built-in defenses even while the plugin is active.

  • lss_altcha_widget_attrs — change the widget attributes, for example to show a visible checkbox instead of the invisible default:

    add_filter( 'lss_altcha_widget_attrs', function ( $attrs ) {
    unset( $attrs['display'], $attrs['auto'] );
    return $attrs;
} );

Invisible mode and failed challenges

Because the widget is revealed automatically whenever the challenge is unsolved at submit time or a submission fails, visitors are never blocked without a visible explanation. The always-visible checkbox remains available through the filter above for sites that prefer it.

The passwordless form on wp-login.php is not covered by this integration; use the ALTCHA plugin's own Protect login setting for that screen.

The admin bar

Loveshack adjusts the WordPress admin bar for subscribers so a signed-in reader gets a useful affordance rather than the full editorial toolbar.

Existing users

Sites migrating from an earlier setup will have users who predate the subscriber schema. Loveshack includes handling for these legacy users so they are recognized by the subscriber system rather than being stranded.