WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to hide my WordPress site (or any website) from the world and only allow certain users to enter. What's the best way of doing this without setting up user accounts and passwords? Or perhaps more precise, what's the maximum protection I can get without using accounts?

Of course, I've chosen to block search engines under settings->privacy already. But I've thought about blocking people from linking directly to images and files, how can that be done? Is it by putting all the uploads (files/images) in a hidden folder somewhere outside of the WP structure? How do I do that?


share|improve this question
You can restrict IP's to access, will that do? – Bainternet Jul 21 '11 at 11:30
Not really, I don't know the IP's in advance. I was thinking maybe I could use sessions or check http referrer to force people to enter via the start page or stuff like that. But I think I'll go for feeela's suggestion and authorize via the htaccess file instead just to minimize the amount of time programming. – Richard B Jul 21 '11 at 18:13
up vote 2 down vote accepted

How to restrict access to uploaded files ?

There's an answer there to help you restrict access to images and other downloadable files.

share|improve this answer

To protect a whole site against access from anywhere (but allowing access for multiple users) you need some kind of password protection. The preferred/most-common method is to use authorization via a .htaccess-file. If you don't want to sharing out passwords, one other option is to use certificates for logging in.

share|improve this answer
Maybe I should have marked your anwser instead, don't know :) Thanks for your effort! – Richard B Jul 21 '11 at 18:16
But wait a minute, how do I authorize using .htaccess on a WP multisite website? It seems like the htaccess file must be in the directory it's supposed to protect, and I don't think I can have a folder with the same name as the site, for example www.example.com/mywebsite. What to do? – Richard B Jul 21 '11 at 20:52
Ok, don't think I can. I'll use a wp account instead... – Richard B Jul 21 '11 at 21:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.