We currently have a multisite wordpress solution implemented. We have created a separate application in raw php for searching one of the tables within the installation for one of the sites on the multisite installation. Is there anyway that we can have this application reside within the multisite installation but to where it's not accessible by all other sites on the multisite.

For example, if I create a new directory /app within the document root, I can access the application without problem, however, so can every other site that is hosted within the multisite installation. We would need some way of making particular directories only accessible to the site which should have access to them.

Has anyone done this before? Does anyone have any suggestions?

  • 2
    It would probably be more efficient and more foolproof to convert your custom PHP into a WP plugin. That doesn't take much effort - just move it under the plugins folder and add a few lines of comments so you can activate it. Then, only activate it on the install where you want it available.
    – WebElaine
    Commented Jan 10, 2018 at 15:34

1 Answer 1


You could check for the referring page by using the wp_get_referer() function, which returns the referring page . See https://codex.wordpress.org/Function_Reference/wp_get_referer .

But note that the function uses the $_SERVER['HTTP_REFERER'] value, which is set by the client, and can be spoofed (or disabled) by the client.

So another alternative is to set a global variable that contains the last page ID visited. Then check if your page with your custom function has the proper 'last-page-id' value set, which tells you that the custom-php page is being called from an authorized location.

A shortcode could be created (as mentioned in the comment, but that doesn't really require a custom plugin, you could just include the shortcode stuff in your functions.php of your child theme) that would return the HTML to display the custom function.

You could also create your custom function to include logic that checks for the correct site_id value; if that value is not correct, you can bypass your custom function code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.