0

I added this to my functions.php to restrict non-admin access to wp-admin by redirecting the non-admin to the home page. However, this does not work for users who aren't users (users who are not logged in).

How can I include visitors who are not users in this script?

/**
 * Restrict access to the administration screens.
 *
 * Only administrators will be allowed to access the admin screens,
 * all other users will be automatically redirected to the front of
 * the site instead.
 *
 * We do allow access for Ajax requests though, since these may be
 * initiated from the front end of the site by non-admin users.
 */
function restrict_admin_with_redirect() {
    if ( ! current_user_can( 'manage_options' ) && ( ! wp_doing_ajax() ) ) {
        wp_redirect( site_url() ); 
        exit;
    }
}
add_action( 'admin_init', 'restrict_admin_with_redirect', 1 );

FYI: I created a custom log-in form on a page other than wp-admin so this will not lock out admin

EDIT 2: this is in the functions.php file which may be complicating the issue since when a non-user accesses wp-admin, the server is treating that access as a failed log-in attempt and redirecting the user to the "access-denied" page and not a 404

/**
 * Redirect user on invalid log-in attempts
 */
function login_failed() {
    $login_page  = home_url( '/access-denied' );
    wp_redirect( $login_page . '?login=failed' );
    exit;
}
add_action( 'wp_login_failed', 'login_failed' );

function verify_username_password( $user, $username, $password ) {
    $login_page  = home_url( '/access-denied' );
    if( $username == "" || $password == "" ) {
        wp_redirect( $login_page . "?login=empty" );
        exit;
    }
}
add_filter( 'authenticate', 'verify_username_password', 1, 3);
4
  • 2
    And if you redirect users that are not logged-in so how you supposed to login as admin?
    – Shibi
    Jan 28 '17 at 19:17
  • You can use is_user_logged_in() to check if the user is signed in or if he is just a guest.
    – Jack Johansson
    Jan 28 '17 at 19:18
  • @Shibi Good one!
    – Jack Johansson
    Jan 28 '17 at 19:19
  • @shibi I created a custom log-in page that logs users in through a different page. :)
    – kidcoder
    Jan 28 '17 at 19:22
0

You can do something like this to redirect everyone that enter to the wp-login.php

Notice that its redirect only when the request is GET so you could still can enter if you post to there. its in the case that you use this wp-login.php with your custom login page.

function login_page_redirect() {
    $redirect_to = "http://google.com"; // url where to redirect
    $page = strtok(basename($_SERVER['REQUEST_URI']), "?");
    if( $page == "wp-login.php" && $_SERVER['REQUEST_METHOD'] == 'GET') {
        wp_redirect($redirect_to);
        exit;
    }
}
add_action('init','login_page_redirect');
2
  • DONT DO IT IN init !!! use admin_init !
    – T.Todua
    Jan 28 '17 at 20:07
  • @T.Todua He can't use the admin_init this action didn't run on the wp-login.php page... therefore use the init
    – Shibi
    Jan 28 '17 at 20:47
0

Simply add that into if:

if ( 
     (!current_user_can( 'manage_options' ) && !wp_doing_ajax() )   
       || 
     (!is_user_logged_in())
   )
1
  • It didn't work only because when a non-user tries to access wp-admin, the server treats that access as a failed log-in attempt and automatically re-directs the user to the access-denied page that I created. I'll post that script in the original post right now so you can see it.
    – kidcoder
    Jan 28 '17 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.