Disable all other page except index,register,login till user login

Question

I need to block access to all other content except Index,wp-login.php, register.php till the user login. how to accomplish it.

i created everthing but, when i try mysite.com/members it shows the page how to disable it..

Answer 1

Functional code written using PHP 5.3+ Closures. Read the comments throughout to understand concept and flow.

// Hook right before Themes kick in
add_action('wp', function(){
    // Allow viewing of home/front_page
    if(is_home() or is_front_page()) return;
    // Maybe allow access to archives (non singulars) to?
    // (when you hide important content after <!--more-->)
    // if(is_archive()) return; // Uncomment to allow access to archives
    // Allow access to BuddyPress registration/login page (experimental)
    if(is_callable('bb_get_location')){
        if(preg_match('~^(login|registration)-page$~i', bb_get_location())){
            return; // Allow access
        }
    }
    // Skip BuddyPress registration page directly (slightly experimental)
    if(is_page() and is_array($bp_pages = get_option('bp-pages'))){
        $current_page = get_queried_object_id();
        // Allow direct access to registration page
        if(!empty($bp_pages['register']) and ($bp_pages['register'] == $current_page)){
            return; // Bail on registration page
        }
        // If you also want access to other special BuddyPress pages do this:
        if(in_array($current_page, $bp_pages)){
            // return; // Uncomment me to allows access to them
        }
    }
    // Allow access to BBPress registration/login page (experimental)
    if(is_callable('bbp_get_query_name')){
        if(preg_match('~^bbp_(login|register)$~i', bbp_get_query_name())){
            return; // Allow access
        }
    }
    // If user is logged it let it be
    if(is_user_logged_in()) return;
    // Block Robots using X-Robots-Tag: header
    // (no point in allowing Robots to index this)
    if(!headers_sent()){ // Be defensive
        header('X-Robots-Tag', 'noindex, nofollow, noarchive');
    }
    // Redirect to Login URL here
    wp_redirect(wp_login_url($_SERVER['REQUEST_URI']), 302);
    die; // Bail here
});
// And add some Memberhsip info on wp-login.php
add_action('login_footer', function(){
    // Print some information here about Membership and site
    echo '<p style="text-align: center;">', 'Awesome Memberhsip stuff.', '</p>';
});
// Block indexing of login page
add_action('login_init', function(){
    // Block Robots using X-Robots-Tag: header
    if(!headers_sent()){ // Be defensive
        header('X-Robots-Tag', 'noindex, nofollow, noarchive');
    }
});

Regards.

Answer 2

/members shows because it's rewritten to index.php?pagename=members or index.php?category=members when the WordPress Rewrite engine kicks in.

Depending on what 'members' actually is, and what other pages are you'll be able to restrict access to certain areas by using the is_user_logged_in() function and use it to conditionally redirect when certain criteria are met when user is not logged in.

As the simplest example (this goes in your template file):

if ( !is_user_logged_in() ) exit( 'Access is restricted' );

You can also write you plugin to hook into the query and let it block the page or redirect in case certain criteria are met, like so:

function wpse31700_restrict_access() {
    global $wp_query;
    $query_vars = $wp_query->query_vars;

    // Allow by returning
    $allowed_pages = array( '', 'contact' );
     if ( in_array($query_vars['pagename'], $allowed_pages )
        return;

    // Or restrict by redirecting
    $restricted_pages = array( 'members', 'pricelist', 'etc' );
    if ( !is_user_logged_in() and in_array($query_vars['pagename'], $restricted_pages )
        wp_redirect( ... );
}
add_action( 'wp', 'wpse31700_restrict_access' );

The above code is simply there to illustrate the concept, it will not work out of the box. You can check pagenames, postnames, author_name, or even meta values of a post/page by ID to see if they contain a 'restricted' value for example.

Answer 3

So you're looking to "lock-down" everything but the front page (or does it have to be index.php?) and the admin side of pages for register and login, correct?

Unfortunately there is no template conditional tag to tell us when we're on the registration or login pages, but I found a blurb here that gives us that conditional tag: http://stackoverflow.com/questions/5266945/wordpress-how-detect-if-current-page-is-the-login-page

From there it's a matter of writing the functions. I hooked it into the wp action hook because it's late enough that the template has been selected (we know if it's the home page). Anyway, try this script out.

function is_login_page() {
    return in_array($GLOBALS['pagenow'], array('wp-login.php', 'wp-register.php'));
}

function access_control(){
    if ( !is_front_page() && !is_user_logged_in() && !is_login_page() ){
        wp_die('Sorry, you must be logged into access this content', 'Access Denied', array( 
        'response' => 401,
        'back_link' => true
        ));
    }
}

add_action( 'wp', 'access_control' );

Answer 4

I wrote the exact code you're looking for in a project a while back. The below code presumes you are using a child theme and that a 403.php file exists in your child directory. (I copied 404.php and made minor changes to it.)

Note that Login/Register pages are available with this code, even though there is nothing in the code that might suggest that.

function wpse31700_403_error( $template ){
    if( !is_user_logged_in() && !is_front_page() ){
        header('HTTP/1.1 403 Forbidden');
        return get_stylesheet_directory().'/403.php';
    }
    return $template;
}
add_filter('template_include', 'wpse31700_403_error', 1, 1);

Additionally, if you want to modify your main menu to not include other links when the user is not logged in, you can utilize the wp_nav_menu_items filter. A good guide on playing with that filter is located here.