Documentation

Installing it

1. Download Koloshare

   It is free and there is no card. The download page asks for an email, and the mailing list is a separate choice on it — decline that and you still get the file. Once the plugin is installed it offers to keep itself updated; you can say yes or skip it, and it works either way.

2. In WordPress, go to Plugins, Add New, Upload Plugin and upload the zip.
3. Activate Koloshare. You land straight in the setup wizard.
4. Work through the wizard, or skip it. Everything it sets stays editable afterwards in Command Centre, Settings.

Activation creates a Koloshare User role and a starter set of folders. It does not touch your theme, your existing pages or any other plugin.

If you have bought Standard or Premium

Install the free plugin the same way, then activate the licence from the link in your purchase email or from Koloshare, Account in the WordPress menu. Activating offers to install the premium version, which carries the paid features, and swaps it in for the free one. Your files, settings and users are shared between the two, so nothing has to be set up twice and there is nothing to type into the plugin itself.

A licence covers one site. To move it, open your account from any Koloshare email and release it from the old site first. If a subscription lapses nothing is deleted: the workspace falls back to the free Starter tier and keeps every file and setting. News, team and contacts stay in the database but are not shown until a licence returns, when the paid features come back with them.

Before you start, check your hosting

Large files need headroom in upload_max_filesize and post_max_size. If uploads fail on big PDFs that is usually why, and your host can raise them.

Setting up the page by hand

If you skipped the wizard: create a page, add the [koloshare_intranet] shortcode, then set Page Attributes, Template to Koloshare (no header) so the workspace renders full width without your theme's header and footer.

Adding a captcha to the login

Koloshare does not ship a captcha. That is deliberate: bundling one would tie every customer to a provider they did not pick, and would send their staff to a third party they never agreed to. Instead the sign-in form accepts whichever one you install.

Any captcha plugin that protects the standard WordPress login will appear on the Koloshare sign-in form by itself. Koloshare fires the same hooks WordPress does and loads the plugin's scripts on the sign-in page, which is the step most custom login forms miss. Verification runs through WordPress's own authentication chain, so a failed captcha blocks the sign-in exactly as a wrong password would.

Options that work

Setting one up

1. Create an account with whichever provider you picked and register your domain. You get a site key and a secret key.
2. Install that provider's WordPress plugin from Plugins, Add New.
3. Paste both keys into the plugin's settings.
4. Check its "protect the login form" option is on. Most enable it by default.
5. Open your intranet page in a private window. The widget should be sitting on the sign-in form.

If the widget never appears, check the plugin is set to protect the WordPress login rather than only comment forms or WooCommerce checkout. If it appears but sign-in always fails, the secret key is usually wrong, or the domain does not match the one registered with the provider.

Nothing about Koloshare requires a captcha, and the workspace behaves the same without one. If you decide the risk is acceptable for your team that is a fair call to make. We would just rather you made it on purpose than by not knowing.

Adding your team

1. Go to Command Centre, Users, New and enter a name and email address.
2. They get a branded welcome email with a temporary password.
3. On first sign-in they are made to set their own.

Temporary passwords expire after 24 hours. If one lapses, or somebody loses a phone, the key icon next to a user issues a fresh one and kills the old immediately.

Koloshare User accounts cannot reach the WordPress dashboard at all and never see the admin bar. WordPress administrators and editors get workspace access plus the Command Centre automatically.

Controlling who sees what

There are four separate controls and they stack.

• Department targeting aims an article or a banner at particular teams, so the warehouse is not reading the sales rota.
• Download locks let everyone preview a file but restrict who can download or share it, by department. Set it on a file, or on a folder to cascade through everything inside.
• Named-user visibility is stronger. Anyone not on the list does not see the file anywhere, search included, so they never learn it exists.
• File passwords add a second lock. The file still shows, so people know to ask, but nothing opens or downloads until the password is entered. Password-protected files are also kept out of the in-document search index, so their contents cannot leak through a search result.

Every one of these is enforced on the server. None of it is hidden with CSS or disabled buttons, so none of it can be stepped around by opening developer tools or calling the endpoint directly.

Read-only Policies

Pick one library folder in Settings, Policies and it becomes a separate read-only tab. Those documents stream through a signed, time-limited endpoint into a reader built into the page. There is no download button, no print button and no file URL anywhere in the markup, and the ordinary download endpoint refuses anything in that folder. Useful for handbooks and procedures people need to read but should not be circulating.

When something is wrong

Sign-in keeps returning to the form

Almost always a caching plugin serving a stale logged-out page. Purge the cache once. Koloshare sends aggressive no-cache signals for the intranet page and self-heals in most cases, but a first purge after install sorts the stubborn ones.

The welcome email never arrived

Account creation and the email are separate steps, so the account exists either way. Check spam, then use the key icon to send a fresh password once your site's email is working. Most WordPress sites need an SMTP plugin before they can send anything reliably.

Search is not finding text inside documents

In-document search is a Premium feature and indexes in the background rather than on upload, so give it time after adding files. Scanned documents that are pictures of text cannot be indexed, because there is no text in them to find. Encrypted PDFs need their password adding in settings first.

The admin menu vanished after an update

Visit /wp-admin/?koloshare_setup=1 as an administrator to restore the capabilities and the menu.