When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have purchased a membership can view it).. but today while messing around with searching, i discovered that post_types querystring. Is there a way to prevent this private custom type from showing up? are there other similar "magic" querystring in wordpress?


register_post_type() has quite a few related arguments, of which publicly_queryable controls precisely what you are describing.

However note that it will completely kill the CPT on front end — individual posts, archives, even post previews.

If you want to do this conditionally you'll have to manage this with code from scratch, which might get very involved to do comprehensively.

| improve this answer | |
  • Is ?post_types=mycpt available by default on wp? I turned out that it's the plugin "Search & Filter" that enables this? I am not sure – yeahman Apr 27 '14 at 20:01
  • @yeahman default CPT registration sets public (which includes this, unless specified otherwise) to false. If plugin provides CPT that completely depends on arguments plugin registers it with. – Rarst Apr 27 '14 at 20:11
  • so the query_var ?post_types exists by default on wp? when i disable the "Search and filter" plugin, it displays the homepage when i add the ?post_types querystring – yeahman Apr 27 '14 at 20:29
  • @yeahman hm, actually native query var is post_type (singular). This is probably indeed implemented by plugin and completely up to it. – Rarst Apr 27 '14 at 20:50
  • yup but there's still the issue with ?post_type= lol... are there any other query like this that may reveal "private" posts? (taxonomy maybe?) – yeahman Apr 27 '14 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.