Gemeindetresor – geschützte Ablage für FeG-Gemeinden

Gemeindetresor (“church vault”) is a small, privacy-first plugin for the internal area of a church website. It was made for FeG churches (Free Evangelical Churches) in Germany, but every church can use it for free. It replaces large membership plugins when you only need registration, login, protected pages and a document library.

• Registration [feg_intern_registrierung] with double opt-in. The request reaches the admins only after the e-mail address is confirmed. The password is set later via the WordPress password link.
• Local bot protection: honeypot, signed time stamp, rate limit (salted IP hash only, temporary), arithmetic task or your own security question, disposable address list, optional DNS/MX check. Cloudflare Turnstile is optional and off by default.
• Approval screen (Users → FeG Intern approvals): approve with a role, reject or delete. Decisions are logged without IP addresses. Pending accounts cannot log in.
• Login [feg_intern_login] and logout link [feg_intern_logout]. Member roles can be kept out of the dashboard.
• My account [feg_intern_konto]: members change their name, e-mail address and password and log out without the dashboard. Optional automatic “Log in” / “Log out” menu entry.
• Access per page/post by role. Protected content is hidden from search, feeds, REST API, sitemaps and menus and sent with noindex / no-cache headers.
• Protected document library [feg_intern_ablage]: folder cards, search, drag & drop upload, versions, per-folder permissions, “strict” folders that even administrators cannot open, download only after login and role check, security self-test, audit log, one server backup ZIP, import from the media library.
• Quiet mode (on after installation): no e-mails to users until you switch it off.
• Import of page restrictions from Ultimate Member (read only, with preview).
• Translation ready (translations via translate.wordpress.org).

The plugin is free. If it helps your church, a donation is welcome (link on the settings page).

Not official: This plugin is not affiliated with or endorsed by the Bund Freier evangelischer Gemeinden in Deutschland KdöR. “FeG” only describes who the plugin was made for.

Privacy

Stored: registration data (name, e-mail, message, time of consent), the decision log and the library log (no IP addresses). Unconfirmed requests expire (default 48 hours). For the rate limit only a salted, daily changing IP hash is kept for a short time. Personal data exporter and eraser are included. Nothing is sent to the plugin author.

External services

By default the plugin uses no external service.

Cloudflare Turnstile (optional, off by default). Only if you tick “Use Cloudflare Turnstile on the registration form” and enter your keys, the registration page loads https://challenges.cloudflare.com/turnstile/v0/api.js in the visitor’s browser (Cloudflare then receives the visitor’s IP address and browser data), and on submit the plugin sends the Turnstile answer and your secret key to https://challenges.cloudflare.com/turnstile/v0/siteverify to check that the visitor is human. Cloudflare terms: https://www.cloudflare.com/website-terms/ – Privacy policy: https://www.cloudflare.com/privacypolicy/

The security self-test only requests a test file on your own website. The optional DNS/MX check uses your server’s DNS resolver.

Daily use

• New request: a person fills in the registration form and confirms the e-mail address. Then the admins get a notice.
• Approve: Users → FeG Intern approvals. Choose a role and click approve; the person gets an e-mail to set the password. Or reject, or delete the account. Every decision is logged.
• Log in: members use the login page. With “My account” they change name, e-mail address and password and log out without the dashboard.
• Protect a page: in the editor tick the allowed roles in the box “FeG Intern: Access”.
• Find files: members open the document library, click a folder card or use the search. Downloads work only after login and with the right role.
• Upload: people with upload rights click “Upload files” and drag the files in. A file with the same name in the same folder becomes a new version; older versions stay available.
• Manage the library (menu “Document library”): Files (move, delete, versions), Folders & permissions (new folders, roles per folder, “strict”), Import from media library, Backup (one ZIP), Log, Settings (file types, size, self-test).
• Quiet mode: as long as it is on, users get no e-mails. Switch it off under Settings → FeG Intern when everything works.

Support

Questions or problems? Write to [email protected]. Please include your WordPress version and what you did before the problem appeared.

Deutsche Anleitung

Gemeindetresor ist ein interner Bereich für Gemeinde-Webseiten: Registrierung, Freigabe, geschützte Seiten und eine geschützte Ablage. Kostenlos. Kein offizielles Plugin des Bundes FeG.

Installation

1. Plugins → Installieren, „Gemeindetresor“ suchen (oder ZIP hochladen) und aktivieren.

Einrichtung

1. Drei Seiten anlegen: „Anmelden“ mit [feg_intern_login], „Zugang beantragen“ mit [feg_intern_registrierung] und eine Startseite für den internen Bereich.
2. Unter Einstellungen → FeG Intern diese Seiten auswählen, Rollen und E-Mail-Adressen für Benachrichtigungen eintragen.
3. Auf der Startseite [feg_intern_ablage] einfügen und in der Box „FeG Intern: Zugriff“ die erlaubten Rollen ankreuzen.
4. Unter Ablage → Einstellungen prüfen, ob der Selbsttest „Bestanden“ zeigt.
5. Zum Schluss den Stillmodus ausschalten, damit E-Mails an Benutzer verschickt werden.

Benutzung

1. Neue Anfragen erscheinen unter Benutzer → FeG Intern Freigaben. Rolle wählen und „Freigeben“ klicken. Die Person bekommt eine E-Mail zum Setzen des Passworts.
2. Mitglieder melden sich auf der Seite „Anmelden“ an und sehen die Ablage.
3. Wer Upload-Rechte hat, lädt Dateien mit „Dateien hochladen“ hoch.

FAQ

Werden Daten an fremde Server geschickt? Nein. Nur wenn Sie Cloudflare Turnstile selbst einschalten.

Sind Dateien in der Mediathek geschützt? Nein. Vertrauliche Dateien gehören in die Ablage.

Wo bekomme ich Hilfe? Schreiben Sie eine E-Mail an [email protected].

Was passiert beim Löschen des Plugins? Standardmäßig wird nichts gelöscht. Benutzerkonten werden nie gelöscht.