I've looked at a couple of plugins, but none that ticks the boxes. Plus... I would ideally do this myself in the code (to ensure safety). I'm making a site, that should work as an intern CRM-system, built in WordPress. I have a custom-made parent-theme, so I'm making a child-theme, that should put all content behind the login-wall (menu, footer, sidebar, all post types, you name it).

I considered just going through all the code and putting this around everything:

if ( is_user_logged_in() ) {
  <nav class="header-nav">
        'theme_location'  => 'header-menu',
        'fallback_cb'     => false,
        'container_class' => 'menu-header-menu-container',

But it seems like quite a hassle. Besides, then if someone 'guesses' a URL to an image, then they'd still be able to see that.

Am I missing some obvious/better way of doing this?

  • 2
    If this is for a non-public system, why not put the whole WordPress instance behind some authentication (such as http auth via .htaccess & .htpasswd)? – kero Apr 5 '18 at 15:09
  • You're right... That is actually a better way to do it. I found this guide on how to set it up: digitalocean.com/community/tutorials/… - and I'm going to do it this way... However, I'll give Andy the 'Correct answer', since he found a way to do it, that can be done on shared hosting and such. – Zeth Apr 5 '18 at 16:49

Redirecting web pages

You can save yourself adding code to all templates in your theme by hooking this in instead.

function wpse299924_redirect() {
    if( !is_user_logged_in() ) {
        wp_redirect( wp_login_url() );
add_action( 'template_redirect', 'wpse299924_redirect' );

You're right that your images and other media will still be accessible to anyone who knows the URL, but this will redirect all pages to the login page for users who aren't logged in.

Redirecting media

WordPress permalinks (on the Apache web server) rely on Apache settings, usually in a site's .htaccess file, to redirect all URLs to the main WordPress index.php file which then processes them into the WP query that returns the web page you're after. Doing this for any images would be wasteful and so there are two .htaccess lines that specifically bypass WP if the requested file or directory exists:

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d

If the requested filename or directory exists as a real file (or directory) for your site then Apache serves it directly without running WP at all.

You could remove these lines (using the mod_rewrite_rules filter) to force WP to handle media URLs for you, but you would then need to code up suitable permalink rewrite patterns and return the appropriate image file yourself after checking a user is logged in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.