1

What is best way to prevent access to Custom Post Types unless authenticated when the post type has an archive and is publicly_queryable?

Is code below enough to keep the content secure and prevent search engines from index the pages? Are there any another parts/places that need to be disabled?

function cptui_register_my_cpts() {
    $labels = array(
        "name" => "Members",
        "singular_name" => "Member",
        );

    $args = array(
        "labels" => $labels,
        "description" => "",
        "public" => true,
        "publicly_queryable" =>true,
        "show_ui" => true,
        "has_archive" => true,
        "show_in_menu" => true,
        "exclude_from_search" => true,
        "capability_type" => "page",
        "map_meta_cap" => true,
        "hierarchical" => false,
        "rewrite" => array( "slug" => "alumni-directory/members", "with_front" => false ),
        "query_var" => false,
        "menu_icon" => "dashicons-groups",      
        "supports" => array( "title", "editor", "custom-fields", "thumbnail" ),     
    );
    register_post_type( "member", $args );

}
add_action( 'init', 'cptui_register_my_cpts' );

Currenlty all of the feeds for the CPT have been disable with the following code:

function lnm_disable_cpt_feed( $query ) {
    if ( $query->is_feed() && in_array( 'member', (array) $query->get( 'post_type' ) ) ) {
        die( 'Feed disabled for Members' );
    }
}
add_action( 'pre_get_posts', 'lnm_disable_cpt_feed' );

Access to CPT unless authenticated is handle by:

function lnm_members_redirect_admin(){
    if ( ! defined('DOING_AJAX') && ! current_user_can('edit_posts') ) {
        wp_redirect( '/alumni-directory/members' ); 
        exit;       
    }
}
add_action( 'admin_init', 'lnm_members_redirect_admin' );
  • Your current implementation of "Access to CPT unless authenticated" (the last code snippet you posted) works only in admin. Can you explain exactly when and where do you want to block the access? Why not to set the status of the posts to private when they are saved? – cybmeta Jan 8 '16 at 10:42
  • It prevents authenticated users with the "subscriber role" from editing posts. I should have mentioned that subscribers should only view the CPT. – eurotrash Jan 9 '16 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.