Stop losing client work in email threads and shared drive links. Share files, track project milestones, message back and forth, and get deliverables signed off — from your own WordPress site. Your clients never need a WordPress account.
Every client gets their own branded URL — or embed the portal in your theme with one shortcode:
yoursite.com/client-portal/acme-corp/
A complete client workspace that lives inside your WordPress admin.
Each client gets their own URL at /client-portal/{slug}/, branded with your logo and colour. It bypasses your theme entirely and shows no WordPress admin bar — your client sees a clean, professional workspace, not a WordPress site.
Clients sign in with an email and password you set — stored hashed, in a session completely separate from WordPress login. They never touch wp-admin and never appear in your Users list. Sign-in is rate limited, and changing a password signs them out everywhere.
Break work into milestones and drag to reorder them. Progress calculates itself as each one moves from Not started to In progress, In review, and Completed — so clients can see exactly where things stand without asking.
Files are stored with randomised names outside the publicly served path, protected by server rules that block direct access. Every download runs through an authenticated handler. Uploads are checked by real content type, so a script renamed to .pdf is rejected.
Mark a file "requires approval" and your client gets Approve and Request Revision buttons. Revision requests require a written note, so you never get a vague "can you tweak it?" again. Every decision is timestamped in the activity log.
Async, comment-style messaging attached to the project it belongs to — no live chat to keep up with. Unread counts appear in your WordPress admin menu, and both sides get an email when a new message lands.
Every upload, download, message, milestone change, and approval is recorded with who did it and when. You see everything across all clients; each client sees only their own history in their portal.
Plus: eight configurable email notifications, CSV export, a full REST API, theme-overridable templates, and a [mkcp_portal] shortcode for embedding the portal in your own theme. The plugin makes no external requests — nothing leaves your server.
Install, add a client, send the link. That's it.
Download free from WordPress.org or upload the zip. Activate it — six database tables and a protected upload directory are created automatically. Set your logo and brand colour in Settings.
Enter their company and contact details. A portal URL and a secure password are generated for you. Tick the welcome-email box and they receive their link and credentials the moment you save.
Create a project, add milestones, and upload deliverables. Your client signs in, follows progress, uploads their own files, and approves work — and you get notified at each step.
If you send files and chase sign-off, this replaces the mess.
Look like an established studio from day one. Send one portal link instead of a trail of WeTransfer links, and get written approval on every deliverable so scope creep has a paper trail.
Run every client in one place with milestone progress they can check themselves. Fewer "any update?" emails, and a complete activity log when a client asks what happened and when.
Collect sensitive documents without email attachments. Files sit in your own database and server, behind an authenticated download handler — not in a third-party cloud you do not control.
Share cuts, mixes, and proofs for review. The revision workflow forces a written note, so feedback arrives specific and in one place instead of scattered across a thread.
No client caps, no locked features, no upsell prompts in your way.
GPL licensed · no account required · no data leaves your server
Everything in Free, plus add-ons for teams running client work at scale. None of these hold back the free plugin — they are genuinely additional:
No spam — one email when Pro launches
Questions about a specific workflow? Get in touch →
Everything you need to know about Client Portal.
No. Clients sign in with an email address and a password you set, stored in the plugin's own table and hashed with WordPress's own password hashing. The session is a signed, httponly cookie completely separate from WordPress login — clients never touch wp-admin and never appear in your Users list. If you do want to link a client to an existing WordPress user, there is an optional field for that.
No. There are no client caps, no locked features, and no upsell prompts blocking your work. Unlimited clients, projects, milestones, files, and messages are all included in the free plugin on WordPress.org.
Files are stored in wp-content/uploads/mkcp/ with randomised filenames, protected by .htaccess and web.config rules that deny direct web access. Every download runs through a PHP handler that verifies a nonce and the client's portal session before streaming the file. Uploads are validated server-side by real content type, not just the extension, so a PHP file renamed to .pdf is rejected.
Upload a deliverable and tick "Requires client approval". The client sees it in their portal with Approve and Request Revision buttons. Approving marks it off and notifies you; requesting a revision requires them to write a note explaining what to change, so you always know exactly what is needed. Every step is recorded in the activity log.
Yes. By default each client gets a standalone branded page at /client-portal/{slug}/ that bypasses your theme entirely, with no WordPress admin bar. If you would rather it lived inside your existing site design, drop the [mkcp_portal] shortcode on any page and it inherits your theme. Both work at the same time — use whichever suits each client.
All data lives in your own WordPress database across six custom tables — clients, projects, milestones, files, messages, and an activity log. The plugin makes no external requests at all — no third-party service is involved, and nothing is sent anywhere.
Nothing is removed unless you ask for it. Under Settings → Advanced there are two separate opt-ins: one to delete database records and one to delete uploaded files. Both are off by default, so deleting the plugin leaves your clients, projects, and files intact for a reinstall.
Install Client Portal free from WordPress.org and have your first client signed in within five minutes.