Client portal: client sign-in, invitations and the Clients screen Pro

The client portal is the part of FileDeck your clients see. Each client signs in on your own site, sees only the documents in their client areas, sends you files, and manages their own account, without needing the WordPress dashboard. You run it all from one screen: Documents → Clients.

FileDeck Pro — the client portal is included in all Pro plans. See pricing

Add your first client

1. Go to Documents → Clients and click Add client.
2. Enter the client’s email address. Their name, company and phone number are optional.
3. Under Client areas, leave Create a new private area named ticked. FileDeck fills in the company name (or the person’s name) for you. You can tick existing areas instead, or as well.
4. Leave Email them an invitation ticked and click Add client.

That one form does four things. It creates the client’s WordPress account, makes the private area, names the client on it, and emails them an invitation. The first time you add a client, FileDeck also creates the portal page, Client Portal, at an address like /client-portal/. If you already have a page with the portal shortcode, FileDeck uses that one instead. It is marked "Client Portal" in your Pages list and kept out of search engines and your sitemap.

If someone already has an account with that email address, FileDeck gives that account client access rather than creating a second one. An account that already existed is sent a password-reset link instead of an invitation, so its owner’s password and any two-factor sign-in stay in charge. (You can only add an existing account you are allowed to edit.)

FileDeck never emails a password. The invitation contains a link the client uses to choose their own. The link works once and expires after 14 days.

What your client sees

1. The invitation. An email from your site, with your site’s name or logo, a short explanation and a Set up my account button.
2. Choosing a password. The link opens your portal page with a "Welcome" form. The client chooses a password (at least 8 characters, confirmed as they type) and is signed straight in.
3. Their documents. A greeting with their name and company, then each of their client areas as a section with its own search box. When something arrived since their last visit, a line at the top says how many.
4. Sending you files. Each area has a Send us a document form. What they send waits in your submissions queue and is published only when you approve it.
5. Their account. The Account tab lets them update their name, email address, company and phone, change their password, switch off new-document emails, and sign out of every other device. Changing the email address or the password asks for the current password first, and a new email address is only used once the client opens the confirmation link sent to it.
6. What they’ve downloaded. When the activity log is on, the Documents tab lists their recent downloads.

Next time, they sign in on the same page with their email address and password. Forgot your password? sends a reset link that opens in the portal too, and expires after 24 hours by default.

Clients you add here are kept out of the WordPress dashboard: if they open /wp-admin/ they are taken to the portal, and the admin bar is hidden from them. Anyone with client access who signs in at the standard WordPress login is taken to the portal too. You can switch this off in the portal settings. It never applies to anyone who can edit posts.

The Clients screen

The list shows the people you added here and everyone named on a client area. People who reach an area only through a group, an email domain or a membership plan are not listed one by one.

Column	What it shows
Client	Name, email address and company. Hover for Edit, Preview portal, Send invitation (or Send password reset once they are active) and Remove access.
Client areas	The areas they can open. An area shown faded is one they reach through a group, an email domain or a membership plan rather than by name.
Documents	How many documents they can open, and how many they have not seen — published since their last visit, or all of them if they have not visited yet.
Last visit	When they last opened the portal.
Status	Not invited yet, Invited (hover for when the link expires), Invitation expired, Not visited yet (an account that existed before you gave it access), or Active.

Use the views above the list to see only clients with a particular status, for example everyone whose invitation has expired. Search covers names, email addresses and company names. Tick several clients to send invitations or remove access in one go.

Click a client’s name to edit their details or areas. The panel on the right shows their status, last visit, how many documents they can open and how many are new to them, whether they turned new-document emails off, and — when the activity log is on — what they downloaded recently.

Remove access takes the client off every area they are named on and cancels any open invitation. Their WordPress account is kept; delete it under Users if you want it gone. Documents shared with them by name (Specific people only) stay shared until you untick them on each document, and access through a group, email domain or membership plan is managed on that rule.

If the client is the only person an area names, and the area has no group, email domain or membership plan either, they stay on that area and the screen tells you so. Taking them off would lift the area’s client-only rule and open its documents to everyone. Name someone else on the area first, or change its access under Documents → Categories. The same applies when you untick an area on Edit client.

People you named on a client area before the Clients screen existed appear in the list too. They are not kept out of the dashboard, because you did not add them here — editing their details on this screen does not change that — but when they sign in at the standard WordPress login they land on the portal.

Preview a client’s portal

Click Preview portal on a client, or open the portal page while signed in as an administrator and choose a client under See it as. You see the areas and documents that client sees, under a banner saying whose portal it is. A preview does not count as their visit and does not show the upload form. Links and downloads use your own account, so if you manage clients without being an administrator, a document you could not open yourself is shown locked. You can preview the clients you are allowed to edit.

Import a list of clients

Documents → Clients → Import takes up to 200 clients at a time. Paste rows from a spreadsheet or upload a CSV file. Excel exports work as they are, including semicolon-separated files.

A header row is optional. Recognised headers are email, first_name, last_name, name (split into first and last), company, phone and area. Without a header, columns are read as email, first name, last name, company, area.

• Area names the client area to put the client in. If no category has that name, a new private area is created. Separate several areas with |.
• An area name that belongs to an existing public category is never turned into a client area. That row’s client is still added, and the result says why the area was skipped.
• Also give everyone access to adds one existing area to every row.
• New clients can be invited as they are imported. Existing accounts are given access but not sent an invitation.

After the import, a table shows what happened to each row: created, existing account given access, or skipped, with the reason.

If you type an email address into a category’s Client area — assigned users field and no account uses it, FileDeck says so after you save, with a link that opens Add client (one address) or Import (several) already filled in.

Portal settings

Documents → Clients → Portal settings:

• Portal page — the page clients sign in on. It needs the [filedeck_client_portal] shortcode or the FileDeck Client Portal block. Invitation and reset links point here, and clients who sign in at the standard WordPress login are sent here.
• Sign-in heading — the heading on the sign-in card.
• Client uploads — show the Send us a document form in each area.
• WordPress admin — keep clients you added here out of the dashboard and hide the admin bar from them.
• Invitation message — an optional note added to every invitation, such as who to contact with questions.

The portal uses the colours, dark mode and Match my theme style you chose for your libraries under Documents → Settings.

Building the page yourself? Add the FileDeck Client Portal block (or the [filedeck_client_portal] shortcode) to any page, then choose that page under Portal page. The block can set its own sign-in heading and show or hide the upload form.

Signing in safely

The portal signs people in through WordPress itself, so the security plugins you already use apply to it: login limits, two-factor authentication, and CAPTCHA plugins that support front-end login forms. When one of them stops a sign-in, the portal shows that plugin’s own message. Test your two-factor plugin with the portal before you rely on it. When CAPTCHA keys are saved for FileDeck’s bot protection, the CAPTCHA appears on the portal’s sign-in and password-reset forms too.

A failed sign-in shows the same message whether the email address belongs to an account or not, so the form cannot be used to find out who your clients are.

For developers

The portal is one shortcode, [filedeck_client_portal]. It accepts uploads="1" or uploads="0" to override the setting, and heading="…". [filedeck_my_documents] keeps working and now shows the same sign-in card, password reset and invitation forms to signed-out visitors; it has no Account tab.

Already using [filedeck_my_documents] on a page? Change that page’s shortcode to [filedeck_client_portal] (or swap in the block) before you add your first client, and FileDeck will use it as your portal. Otherwise FileDeck creates a new Client Portal page, and invitations, password resets and new-document emails point there.

Filters:

• filedeck_clients_capability — the capability that manages clients (default list_users). Creating accounts also needs create_users, and editing someone needs permission to edit that user.
• filedeck_portal_client_role — the role new client accounts get (default subscriber).
• filedeck_portal_invite_ttl — how long an invitation link lasts, in seconds (default 14 days).
• filedeck_portal_min_password_length — the shortest password the portal accepts (default 8).
• filedeck_portal_keep_out — whether a given user is kept out of the dashboard.
• filedeck_portal_email — change or skip an invitation or password-reset email before it is sent.

Actions: filedeck_portal_client_added and filedeck_portal_client_removed.

FAQ

Do I still need to create WordPress users myself?

No. Add client creates the account. Clients are ordinary WordPress users with the Subscriber role, so anything that works with WordPress accounts (single sign-on, two-factor, membership plugins) works with them.

Can I add a client without emailing them?

Yes. Untick Email them an invitation. Send it later with Send invitation on the Clients screen.

Why did an existing user get a password reset instead of an invitation?

An invitation sets a first password and signs the person straight in, which is right only for an account FileDeck has just created. Someone who already had an account may have a password and a second sign-in step of their own, so they are sent an ordinary password reset instead. It does not sign them in.

A client’s invitation expired. What now?

Click Resend invitation. Only the newest link works, so an old email cannot be used after you resend.

Will clients get two emails when I publish a document?

No. A client is emailed once per document. The email links through the portal, so a client who is signed out signs in and lands on the document. Clients can switch these emails off on their Account tab; the Clients screen shows who has.

What happens if my Pro licence lapses?

Client areas keep being enforced, so client documents do not become public. The portal page, invitations and the Clients screen stop working until you renew.