How can you add Roundcube (or any other PHP webmail client script) to the WordPress backend? Can this be done so that the webmail client can be accessed only from inside wp-admin? It should not be accessible from any URL outside of wp-admin.

Where must the webmail client be installed on the webserver? If it's installed for example at /webmail it could also be accessed through https://server.com/webmail, which is something I'd like to avoid.

Please note that single sign on/off is not needed. The only thing that's required is to hide the webmail script behind WordPress admin.

How would you do this? Your advise is highly appreciated. Thank you.

Edit: Would it be valid to:

  1. create a folder at /wp-content/plugins/webmail/roundcube and install roundcube into it?
  2. have a script to add a menu item to wp-admin, to display roundcube inside an iframe

Theoretically, this should hide Roundcube behind WordPress admin. But would that work? Or would that cause problems? How to tell WordPress to ignore the scripts at /wp-content/plugins/webmail/roundcube and ensure they are handled by PHP without WordPress interfering?

1 Answer 1


You could register a custom menu page and then use an iframe for the webmail as an output for this.

To secure your /webmail URL you can set access-controls within your .htaccess file to only allow your website address to access the path.

  • Thank you for your advise! Any ideas how to set up the .htaccess rule in a secure way? In the past I've used the referrer to determine if it's the website who's accessing the webmail folder, but that's by no means secure. Commented Sep 24, 2018 at 18:01
  • @SePröbläm Use a shared secret in the GET string - only authorized users would be able to see the URL anyway, so you can just block requests to /webmail/ if they don't have the super-top-secret-phrase=1 parameter set.
    – Gray
    Commented Sep 25, 2018 at 2:15
  • @Gray I see, thank you. Seems to be easy to implement. Still a little more solid/secure solution would be preferred. Would it be valid to install the webmail client at /wp-content/plugins/webmail/roundcube and let php (without Wordpress) handle it? Like explained in the edited section of the original question. Would that work? Commented Sep 25, 2018 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.