Common questions, clear answers.

Custom Auth Suite™ is a WordPress authentication layer. It helps organize login, registration, password recovery, email verification, protected paths, guided setup and diagnostic support. It is not a full membership plugin, a shop system or a complete user-management platform.

No. All features available in the Free versions remain available without an expiry date. Advanced and Premium features require the corresponding commercial package and an active license.

Start with Free if you need branded authentication, Auth Pages and CAS Doctor. Choose Advanced for Polylang/i18n, reCAPTCHA Enterprise, Contact Form 7 Math Check, asset customization and settings import/export. Choose Premium when you need WebAuthn / Passkeys, device intelligence and advanced debug/log export tools.

CAS is not positioned as a pure 2FA method pack. Some CAS features touch the same area, such as Passkeys, protected authentication flows and anti-bot protection, but the core purpose is broader: CAS organizes the WordPress authentication experience, including Auth Pages, guided setup, route consistency, diagnostics, support-ready reports and commercial license-aware features.

Plugins focused on 2FA or MFA usually compete on authentication methods, role policies, OTP options, trusted devices, enforcement rules and compliance-oriented access control. CAS should not be evaluated only by the number of 2FA methods it offers. CAS is designed as an authentication experience layer: branded login and registration flows, password recovery consistency, CAS Doctor, support handoff, protected paths, privacy-aware admin guidance, commercial package licensing and, in Premium, passwordless capabilities.

No. CAS does not replace a firewall, malware scanner, server hardening tool or complete security suite. CAS focuses on authentication flows, protected access, user-facing login experience, selected anti-bot protections and diagnostics connected to the CAS setup. You can still use a dedicated security plugin or WAF when your site needs broader protection.

No. CAS is not a membership monetization platform. It does not try to replace systems built for subscriptions, paid content, member directories, course access or complex content restriction. CAS can protect paths and improve authentication, but if your primary need is selling memberships or managing paid content, you may still need a dedicated membership plugin.

Often yes, but avoid overlapping the same responsibility twice. For example, if another plugin already forces 2FA, CAS should not be configured to fight the same login step. Keep one owner for each critical layer: firewall/security, 2FA/MFA, CAS Auth Pages, CAS Doctor, cache exclusions and support diagnostics. Always test login, password recovery and protected paths after enabling multiple security tools.

CAS can create or reconnect the required WordPress pages for login, registration, lost password and reset confirmation. This reduces setup errors because each page needs the correct CAS template and route.

CAS keeps navigation minimal. The Login page can remain visible, while registration and password recovery stay reachable from the authentication flow. This avoids filling the public menu with technical pages.

Yes. You can use custom paths in Routes & Templates. If a page slug changes later and CAS detects a mismatch, use Fix Now to return to CAS defaults or update the path manually to keep your custom slug.

CAS can work with translated Auth Pages. The language switcher must remain visible even when technical Auth Pages are hidden from normal navigation. Advanced and Premium packages allow more evolved language-aware mapping.

No. It is recommended, but not mandatory. If it is empty, CAS can use the homepage as fallback. When the user was trying to access a protected page, CAS still respects that protected destination after login.

CAS Doctor checks the CAS environment, summarizes readiness, highlights route/cache/support context and helps prepare a cleaner diagnostic report. It is focused on CAS-specific setup and support readiness, not generic WordPress optimization.

No. The Doctor reads the current state, shows guidance and can generate reports. It does not silently change your configuration.

The Doctor Report is designed to be redacted. It should not include passwords, full license keys, raw tokens, cookies, nonces, private keys or authorization headers. It is meant to provide useful context without exposing sensitive data.

Safe Mode is a recovery layer. When active, CAS bypasses custom CAS redirects and lets the native WordPress login flow be used for recovery. Protected paths are not exposed: non-logged users are sent to wp-login.php with a redirect_to destination.

Exclude CAS login, registration, password recovery, reset confirmation and protected paths from public page cache. Also be careful with aggressive JS optimization when using reCAPTCHA, Passkeys or CAS popups.

Email verification confirms that the registered address belongs to the user. CAS can manage verification, resend flows and welcome messages according to the configured templates.

CAS prepares the message, but delivery depends on WordPress and the configured SMTP/provider. Check your mail plugin, provider logs, OAuth connection, sender reputation and whether transactional emails are allowed by the hosting environment.

Yes. CAS includes email customization for core messages, with subject/body templates, preview/test tools, variables and language-aware content where configured.

The site owner configures the Google Cloud / reCAPTCHA Enterprise project and keys. CAS can use the configured keys to protect selected flows, but it does not create the Google project, activate billing or issue Google keys.

Use the CAS Math Check tag inside the Contact Form 7 form: [cas_math* cas_math]. If Contact Form 7 is not active, CAS keeps the feature safely inactive.

Protected Paths are URL paths that should only be available after authentication. CAS checks access and redirects non-logged users to the configured login flow without making the protected content public.

No. With WebAuthn / Passkeys, biometric or device-unlock data stays with the operating system, browser, password manager or security key. CAS stores technical credential information needed to verify authentication, not fingerprints or faces.

The passkey lives in the credential manager used during creation, such as Google Password Manager, iCloud Keychain, the browser, the OS or a security key. If a browser cannot find it, sign in with password, disable the passkey for that device only, then enable it again from the same browser.

Passkeys require the Premium package, an effective Premium license, HTTPS and a compatible PHP/runtime environment. RP ID and Origin should match the real domain served by WordPress.

The installed package defines which code is physically present. The license defines the commercial entitlement. The effective runtime plan is the safe intersection between package, license and technical requirements.

Domain coverage depends on the purchased plan and any extra-domain add-ons. A license can record a primary domain and additional covered domains when allowed by policy.

Commercial package delivery and future update checks can communicate with Custom Auth Suite™ services to verify license status, connected domain, package, version and eligibility. Temporary download or update tokens may be used when delivery is available.

Remote Admin Messages are safe JSON content payloads shown inside selected CAS admin areas. They can include compatibility notes, support reminders, tutorials, renewal notices or product guidance. CAS does not execute arbitrary remote JavaScript or arbitrary remote HTML for these cards.

No. Remote admin messages and interaction analytics are separate. Messages can be delivered as useful administrative content, while privacy-safe interaction analytics such as impressions, CTA clicks and dismissals should be opt-in.

The report gives support a cleaner starting point: routes, environment, cache guidance, recent changes and redacted diagnostics. This reduces back-and-forth questions and helps avoid generic “it does not work” tickets.

No. Product access and technical support coverage are related but separate. Technical tickets may require an active support entitlement, a support extension, a one-shot intervention or manual review depending on the case.

When available, CAS operational logs are stored under wp-content/uploads/cas-logs/. They can be exported from the CAS backend for troubleshooting. Logs are separate from the Doctor Report and should not contain secrets.