Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'd like to disable the default WP query vars (p, attachment_id, etc...), and make the pages only accessible by URI Permalinks.

I've taken a list of variables from WordPress Query Vars and created a small function to disable them, but it's probably not "the way" since it gives weird results (most of the pages aren't properly routed).

Thank you!

function disable_query_vars($vars)
{
    if (!is_admin())
    {
        $disable = array('m', 'p', 'posts', 'w', 'cat', 'withcomments', 'withoutcomments', 's', 'search', 'exact', 'sentence', 'debug', 'calendar', 'page', 'paged', 'more', 'tb', 'pb', 'author', 'order', 'orderby', 'year', 'monthnum', 'day', 'hour', 'minute', 'second', 'name', 'category_name', 'tag', 'feed', 'author_name', 'static', 'pagename', 'page_id', 'error', 'comments_popup', 'attachment', 'attachment_id', 'subpost', 'subpost_id', 'preview', 'robots', 'taxonomy', 'term', 'cpage', 'post_type');        
        foreach ($disable as $var)
                unset($vars[$var]);
    }

    return $vars;
}

add_filter('request', 'disable_query_vars');
share|improve this question

1 Answer

This is definetly not the way! What you mean by "URI Permalinks"? Almost all permalinks lead to index.php and there, WordPress creates new WP_Query in order to bring you the result. Each time you request a page and unsets variables, you makes it imposible for WordPress to bring you proper results, if any.

share|improve this answer
Thanks, I definitely realized that. I'm trying to have pages accessible only via myhost.com/mypage and not myhost.com/?p=123. Basically anyone can query p=1, p=2, p=3... and guess the system, the posts ID etc... which I want to hide. Would it be possible at least to change them with something different? – gyo Feb 1 at 8:31
Security through obscurity (see en.wikipedia.org/wiki/Security_through_obscurity) is not good way to go. If you don't anyone to access p=1 or p=2, make them private or accessible for logged in users only. Check is_user_logged_in and current_user_can functions in Codex: codex.wordpress.org/Function_Reference/is_user_logged_in codex.wordpress.org/Function_Reference/current_user_can – david.binda Feb 1 at 11:06
We all agree that security through obscurity is not perfect, but it helps. This is why you hide you server's services (Apache/FTP versions etc...) information on "helo". It's not nice that anyone can go to your website, and start playing with 'attachment_id=x' or 'p=x' and get too much info. Thank you – gyo Feb 1 at 11:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.