Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Is there a way to protect all RSS feeds from my WPMU install without blocking access to the individual posts or pages? Essentially I want anyone to have access to individual pages, but the aggregate list should require an auth code.

Anyone have advice or a direction to point me in?

share|improve this question
    
Just wonder, why to do such a thing at all? –  Mark Kaplun Jan 31 '13 at 7:25
    
We want to grant public access via our website and iPad app to the content, but the sourcing of feeds we want to restrict as a pay for service. –  Jake Lisby Jan 31 '13 at 12:17
    
And how will the paying costumers be able to access the RSS, a free tool like google reader or a special application? –  Mark Kaplun Jan 31 '13 at 13:04
    
They would need to have a key of some sort that accessed the feeds. These would be sourcing providers like ESPNU and Huffington Post. –  Jake Lisby Jan 31 '13 at 13:39
add comment

1 Answer

up vote 1 down vote accepted

Based on the comments you can have several options. The easier one is to check for a special parameter at the URL, this assume you provide them the URL, and they configure it manually in whatever software the use to fetch the feed. For the example you give them the URL as mysite.com/feed?pass=123456 where pass is the secret parameter and 123456 is the correct value

add_action('init','wase_83868_init',1);
function wase_83868_init() {
  if (is_feed()) { // if access to RSS feed
    if (!isset($_GET['pass']) || ($_GET['pass'] != '123456'))
      wp_die('Only paying costumers can read the RSS feed',403); // failed check, reject
  }
}

You will probably also will want to remove the links to your RSS from your feed like suggested here

The problem with this option is that the secret is not much of a secret and you have to trust the people to whom you give it to not leak it. so another option can be to filter by IP address. instead of URL parameters.

add_action('init','wase_83868_init',1);
function wase_83868_init() {
  if (is_feed()) { // if access to RSS feed
    if ($_SERVER['REMOTE_ADDR'] != '192.132.14.12'))
      wp_die('Only paying costumers can read the RSS feed',403); // failed check, reject
  }
}

The ultimate option is to create a user and serve the RSS only to logged in users.

add_action('init','wase_83868_init',1);
function wase_83868_init() {
  if (is_feed()) { // if access to RSS feed
    if (!user logged in and have permission)
      wp_die('Only paying costumers can read the RSS feed',403); // failed check, reject
  }
}

The problem with this approach is that your costumer's software will have to perform login before fetching the RSS to get the authentication cookies.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.