1

I have tried numerous ways to prevent the browser's back button from allowing someone from using it to go back into a visitors logged out profile. The codes I used were supposed to prevent the browser from caching data from the last page visited after logout. They don't work. Wordpress logs the visitor out once they click the logged out button, yes this portion wors. Unfortunately, you can see the last page visited by the person who was logged on. The session is destroyed but the cache still holds the info for the last page visited. If you click any link on the profile page you will be brought back to the login page. You were not supposed to have been able to leave this login page without logging in. What code can use to force the browser to delete the data in the cache so the someone can not view info from a loggedout profile. Javascript would pose a security risk. Yes, I know that you can not delete the browser's history, but there must be a secure code for this. Wordpress comes with file that destroys the session but I can't find that file in the twenty sixteen code. Also, these codes do not work:

  if(!isset($_SESSION['logged_in'])) : 
  header("Location: login.php");  

  unset($_SESSION['logged_in']);  
  session_destroy();   

Can you Pleeease help!!!

0

You should use the built in WordPress function is_user_logged_in(), as well as several other WordPress functions:

if ( !is_user_logged_in() ) {
    wp_redirect( get_bloginfo( 'url' ) . '/index.php' );
    exit;
}

wp_redirect() handles the redirection for you. Please be aware that it does not exit automatically, so you should call it afterwards.

I also built in the WordPress Function for getting your URL - this may not be necessary in your case, as you just redirect to the front page.

Be sure that this function is called before any output is sent.

  • Is the code you presented only for blogs or for website that uses pages? The code in reference is: " if ( !is_user_logged_in() ) { wp_redirect( get_bloginfo ...... " – user117689 Apr 15 '17 at 19:23
  • This is for all WordPress sites. @user117689 – fischi Apr 18 '17 at 6:19
  • if ( !is_user_logged_in() ) { wp_redirect( get_bloginfo( 'url' ) . '/index.php' ); exit; } – user117689 Apr 20 '17 at 1:35
  • if ( !is_user_logged_in() ) { wp_redirect( get_bloginfo( 'url' ) . '/index.php' ); exit; } This does not work in function.php or header.php. Still being forced to the last page U were on. Touch any link on page and Session destroy finally activates, preventing U from leaving current page. U are forced back to the login page. Please tell me that there is a solution. Why am I still able to use back button to go into the website? – user117689 Apr 20 '17 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.