0

I have a page that contain all my servers data, it really sensitive information. Is there any strong way to hide it from google spiders and non login users.

I found small solutions that's hide the page, but not secured at all, if someone search in the website directory he will get access to that page easily. Any hints here?!

Improve this question
1
  • unfortunately anyone can access the page if he know the directory..
    – narzan
    Aug 21, 2017 at 20:18

3 Answers 3

Reset to default
3

Use password protection mechanism

Alterative you can use wordpress hook in your theme to show your post/page only for administrators this way:

add_action('wp', function() {
  if(is_page('my-data') && !current_user_can('manage_options')) 
    die("123")
});

Note: don't use this code. It is just for demonstration. Better use hook template_redirect or something else.

We need more info about your environment to answer more specifically.

Perhaps the best option for you would be set password by http-server. For apache using .htacces with something:

AuthType Basic
AuthName "restricted area"
AuthUserFile .htpasswd
require valid-user
Improve this answer
2
  • I really loved this idea but unfortunately, there is no restriction on the password, so anyone can run a script to unblock that page, Is it possible to add captcha to it?
    – narzan
    Aug 21, 2017 at 20:35
  • 1
    Of course you can. If you really care about security better use default wordpress auth mechanism (not password protected pages) with 2-step auth plugins. You can find turnkey solutions here. Than use one-time passwords to authenticate. Show your page only for authorized admin profiles as mentioned above
    – Anton Lukin
    Aug 21, 2017 at 20:42
1

Besides using a password protect mechanism, as mentioned in the other answer, you can also use htaccess rules, as explained in this Stack question: https://stackoverflow.com/questions/14603568/password-protect-a-specific-url

Another resource that can help you with the password encryption is this place: http://tools.dynamicdrive.com/password/ (that site and info has been around for years, so little chance of the link 'dying').

Improve this answer
1

The strongest way is simply to not display it unless the user has been validated.

If you have manually entered this info, or have access to make your sensitive info to use a custom-page template or with a shortcode, you can program your code to only selectively display after the user has been authenticated.

For example (the shortcode method):

function my_data_func( $atts ){
    if(is_user_logged_in() && current_user_can('manage_options')) {
        //display my server data via return statement.
    } else {
        return 'I am sorry. You must be logged in as an administrator to view this content.';
    }
}
add_shortcode( 'my_data', 'my_data_func' ); //Ex. [my_data]

The page template method works in a similar way, but uses an extra file in the theme that you then specify your protected page to use.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.