I'm using the WordPress database and back end to administer the news for my band's website and everything is working great however I'd like to disable the front end of WordPress itself.

I have the WordPress installation installed in /wordpress/ and obviously the admin section is under /wordpress/wp-admin/.

What would be the best way to restrict someone from accessing the rather *un*setup WordPress site itself without affecting the admin section?

If anything, I could simply redirect to the website's proper home page (domain.com/).


To make sure only the front end redirects to domain.com, make a theme that uses the PHP header() function.

  • Create a folder called redirect or something.

  • Add two files to the folder: style.css and index.php (necessary for a valid WP theme)

  • In style.css, add something like this:

       Theme Name: Redirect  
       Description: Redirects the front end to domain.com  
  • In index.php add this:

         header( "Location: http://domain.com" );
  • Upload the folder to the themes directory and then activate it in the admin UI.

  • It's funny cause that light just went off in my head. Why not just make a theme that redirects! Thanks. – Nick Bedford May 23 '11 at 9:18
  • 2
    may be obvious to some but this only worked for me when the first line of index.php was <?php – finsbury Mar 14 '19 at 11:41

Use a theme with "empty data". Put two files in directory, then activate "theme".


Theme Name: turn off frontend
Theme URI: 
License: GNU 
License URI: 

and index.php

  • I like this solution, this way you can easily switch back to a full working theme. Moreover you can add something like <?php wp_redirect(site_url('wp-admin'));die(); instead of exit to automatically redirect to a given resource. – Alessandro Benoit Jan 15 '16 at 8:45

Put this in your .htaccess and list the paths you want to keep available:

RewriteCond %{REQUEST_URI} !^/wp-admin
RewriteCond %{REQUEST_URI} !^/wp-includes
RewriteCond %{REQUEST_URI} !^/wp-login
RewriteCond %{REQUEST_URI} !^/wp-content/uploads
RewriteCond %{REQUEST_URI} !^/wp-content/plugins
RewriteCond %{REQUEST_URI} !^/wp-content/cache
RewriteRule (.*) http://yournewdomain.com/ [R=301,L]

Although this is a rather old question with an already accepted answer, someone might find this useful, specially since none of these solutions worked for me.

function redirect_to_backend() {
    if( !is_admin() ) {
        wp_redirect( site_url('wp-admin') );
add_action( 'init', 'redirect_to_backend' );

The code itself is pretty explanatory:

  • run the check on the 'init' hook
  • check if the page we are loading is front end (not wp-admin)
  • redirect to back end (wp-admin)

Just put the code in any plugin or the theme's function.php and it should work out of the box.


If this is not working for you (I had minor issues even with this code), you can create a new theme (or a child theme) and put only this content inside the header.php file:

header("Location: ".get_admin_url());

add this to the .htaccess in your root directory

redirect 301 /wordpress http://www.domain.com

EDIT: This is really just a quick fix, there might be better solutions. Another way would be to add a function to your functions.php file, that is then called in wp_head() to redirect that way. Using that method you could also allow yourself to view it with a simple IP check.

  • This has a side effect that /wordpress/wp-admin now redirects to //wp-admin – Nick Bedford May 23 '11 at 5:53

IMO, a plugin would require less work and is more appropriate for the specific case.

Plugin Name: Disalbe Frontend
Description:  Disable the frontend interface of the website, leave only CMS and REST API
Version: 1.0

add_action('init', 'redirect_to_backend');

function redirect_to_backend() {
        !is_admin() &&
        !is_wplogin() &&
    ) {

if (!function_exists('is_rest')) {
     * Checks if the current request is a WP REST API request.
     * Case #1: After WP_REST_Request initialisation
     * Case #2: Support "plain" permalink settings
     * Case #3: URL Path begins with wp-json/ (your REST prefix)
     *          Also supports WP installations in subfolders
     * @returns boolean
     * @author matzeeable
    function is_rest() {
        $prefix = rest_get_url_prefix( );
        if (defined('REST_REQUEST') && REST_REQUEST // (#1)
            || isset($_GET['rest_route']) // (#2)
                && strpos( trim( $_GET['rest_route'], '\\/' ), $prefix , 0 ) === 0)
            return true;

        // (#3)
        $rest_url = wp_parse_url( site_url( $prefix ) );
        $current_url = wp_parse_url( add_query_arg( array( ) ) );
        return strpos( $current_url['path'], $rest_url['path'], 0 ) === 0;

function is_wplogin(){
    $ABSPATH_MY = str_replace(array('\\','/'), DIRECTORY_SEPARATOR, ABSPATH);
    return ((in_array($ABSPATH_MY.'wp-login.php', get_included_files()) || in_array($ABSPATH_MY.'wp-register.php', get_included_files()) ) || (isset($_GLOBALS['pagenow']) && $GLOBALS['pagenow'] === 'wp-login.php') || $_SERVER['PHP_SELF']== '/wp-login.php');
If you want to keep your REST api working use this in your index.php:

 * Front to the WordPress application. This file doesn't do anything, but loads
 * wp-blog-header.php which does and tells WordPress to load the theme.
 * @package WordPress

 * Tells WordPress to load the WordPress theme and output it.
 * @var bool
define( 'WP_USE_THEMES', false );

/** Loads the WordPress Environment and Template */
require __DIR__ . '/wp-blog-header.php';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.