How to enforce authentication for all resources?

Question

I want to host a personal journal with wordpress. I don't want to share it with 3rd parties but I want to be able to access it from anywhere with my admin credentials. There are several plugins around which all do nothing but protect access to sites/posts - but everything else (/wp-content/ first and foremost) is still accessible without permissions.

So what I basically want is a check like for /wp-admin is required for each resource on my blog.

${SITE_URL}/.*

I know that I could just add some .htaccess basic authentication. But I want to avoid that.

Answer 1

You should define which resources you want to protect. I think you have such choices:

1) Protect whole site

2) Protect only posts (without resources)

3) Protect posts & all resources (but only uploads, not wp-content! otherwise you will break your themes/plugins)

So, as you say you need 3rd way. In such case, you should use htaccess cookie-based redirection:

• Create htaccess in wp-content/uploads which restricts access to all urls there for users who doesn't have a cookie "cookie_name" set to value i.e. 'xyz':

  RewriteEngine On RewriteCond %{HTTP_COOKIE} !cookie_name=xyz; [NC] RewriteRule ^ https://your_site.com/authorization-page [NC,L]

• Create authorization-page where should be a form to insert a password (set whatever you want) and if user correctly enters password, then set cookie cookie_name to xyz.

p.s. just replace xyz and cookie_name with very random characters.