What I want to achieve is:

For every request , if the user is not logged he / she will be redirected to the log in page. If the user is logged in then he / she can access the site.

class Auth{

    protected static $instance = null;

    public function checkAuth(){

    public static function getInstance() {

        if (null == self::$instance) {
            self::$instance = new self;

        return self::$instance;


Having this draft class what is the best action hook for this check? wp, init, template_redirect ?

Example of usage:

add_action('wp', array(Auth::getInstance(), 'checkAuth'));


I played a bit around with the hooks and I noticed that:

When I hook it to 'wp' or on 'template_redirect' then I get the log in page but every time I logged in it prompt me to log in again, and again and again.

When I hook it to 'init' I get a

Request-URI Too Long

The requested URL's length exceeds the capacity limit for this server.

The problem seems to be with auth_redirect() wordpress function.

I change my checkAuth function inside of Auth class with

if(!is_user_logged_in()) wp_safe_redirect(site_url('/wp-login.php'));

I test again the three hooks and now wp and template_redirect works fine but the init hook cause a redirect loop error.

Any ideas why is this happening ? (Refrence: Using `auth_redirect` : keeps asking me to login even when I'm logged in)

  • I wrote a similar plugin for our WP multisite system. I hooked it in at 'init' since that occurs early on and avoids additional loading. It can definitely be done at all three hooks.
    – user42826
    Commented Oct 24, 2014 at 9:00
  • Thanks for your answer. I made an update if you want to take a look.
    – Laxmana
    Commented Oct 24, 2014 at 11:50
  • I added parts of my plugin as an answer. Though you will need to modify it to fit your exact need. This was for a multisite instance so the way it works is slightly different.
    – user42826
    Commented Oct 24, 2014 at 13:46

1 Answer 1


Here is part of a multisite plugin I wrote that forces a user to log in. It required a user to be registered for the site; not just be a network user. It could be modified to check if user has a higher role. I did modify it to fit the OP requirements.

add_action( 'init', 'registration_check',5);

function registration_check() {
    if ( is_user_logged_in() ) { return; }
    // if ( current_user_can('read') ) { return; }  // orig for multisite

    // This is a base array of pages that will be EXCLUDED from being blocked
    $exclusions = array(
            'wp-cron.php', // Just incase
    // If the current script name is in the exclusion list, abort
    if ( in_array( basename($_SERVER['PHP_SELF']), $exclusions ) ) {

    // if ( is_user_logged_in() ) { wp_die('<strong>You are logged in but do not have enough privileges to access this site.</strong>'); } // orig for multisite
    // Still here? Okay, then redirect to the login form

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.