Documentation

Installing it

1. Copy the koloab folder into wp-content/plugins/, or upload the zip through Plugins, Add New, Upload Plugin.
2. Activate Koloab. You land straight in the setup wizard.
3. Work through the wizard, or skip it. Everything it sets stays editable afterwards in Command Centre, Settings.

Activation creates a Koloab User role and a starter set of folders. It does not touch your theme, your existing pages or any other plugin.

Before you start, check your hosting

Large files need headroom in upload_max_filesize and post_max_size. If uploads fail on big PDFs that is usually why, and your host can raise them.

Setting up the page by hand

If you skipped the wizard: create a page, add the [koloab_intranet] shortcode, then set Page Attributes, Template to Koloab (no header) so the workspace renders full width without your theme's header and footer.

Adding a captcha to the login

Koloab does not ship a captcha. That is deliberate: bundling one would tie every customer to a provider they did not pick, and would send their staff to a third party they never agreed to. Instead the sign-in form accepts whichever one you install.

Any captcha plugin that protects the standard WordPress login will appear on the Koloab sign-in form by itself. Koloab fires the same hooks WordPress does and loads the plugin's scripts on the sign-in page, which is the step most custom login forms miss. Verification runs through WordPress's own authentication chain, so a failed captcha blocks the sign-in exactly as a wrong password would.

Options that work

Setting one up

1. Create an account with whichever provider you picked and register your domain. You get a site key and a secret key.
2. Install that provider's WordPress plugin from Plugins, Add New.
3. Paste both keys into the plugin's settings.
4. Check its "protect the login form" option is on. Most enable it by default.
5. Open your intranet page in a private window. The widget should be sitting on the sign-in form.

If the widget never appears, check the plugin is set to protect the WordPress login rather than only comment forms or WooCommerce checkout. If it appears but sign-in always fails, the secret key is usually wrong, or the domain does not match the one registered with the provider.

Nothing about Koloab requires a captcha, and the workspace behaves the same without one. If you decide the risk is acceptable for your team that is a fair call to make. We would just rather you made it on purpose than by not knowing.

Adding your team

1. Go to Command Centre, Users, New and enter a name and email address.
2. They get a branded welcome email with a temporary password.
3. On first sign-in they are made to set their own.

Temporary passwords expire after 24 hours. If one lapses, or somebody loses a phone, the key icon next to a user issues a fresh one and kills the old immediately.

Koloab User accounts cannot reach the WordPress dashboard at all and never see the admin bar. WordPress administrators and editors get workspace access plus the Command Centre automatically.

Controlling who sees what

There are four separate controls and they stack.

• Department targeting aims a notice at particular teams, so the warehouse is not reading the sales rota.
• Download locks let everyone preview a file but restrict who can download or share it, by department. Set it on a file, or on a folder to cascade through everything inside.
• Named-user visibility is stronger. Anyone not on the list does not see the file anywhere, search included, so they never learn it exists.
• File passwords add a second lock. The file still shows, so people know to ask, but nothing opens or downloads until the password is entered. Password-protected files are also kept out of the in-document search index, so their contents cannot leak through a search result.

Every one of these is enforced on the server. None of it is hidden with CSS or disabled buttons, so none of it can be stepped around by opening developer tools or calling the endpoint directly.

Read-only Policies

Pick one library folder in Settings, Policies and it becomes a separate read-only tab. Those documents stream through a signed, time-limited endpoint into a reader built into the page. There is no download button, no print button and no file URL anywhere in the markup, and the ordinary download endpoint refuses anything in that folder. Useful for handbooks and procedures people need to read but should not be circulating.

When something is wrong

Sign-in keeps returning to the form

Almost always a caching plugin serving a stale logged-out page. Purge the cache once. Koloab sends aggressive no-cache signals for the intranet page and self-heals in most cases, but a first purge after install sorts the stubborn ones.

The welcome email never arrived

Account creation and the email are separate steps, so the account exists either way. Check spam, then use the key icon to send a fresh password once your site's email is working. Most WordPress sites need an SMTP plugin before they can send anything reliably.

Search is not finding text inside documents

In-document search is a Premium feature and indexes in the background rather than on upload, so give it time after adding files. Scanned documents that are pictures of text cannot be indexed, because there is no text in them to find. Encrypted PDFs need their password adding in settings first.

The admin menu vanished after an update

Visit /wp-admin/?koloab_setup=1 as an administrator to restore the capabilities and the menu.