How to block link access (on a custom script installed server) if visitor not referred from our wordpress site?

I mean we want to block access to links inside of our wordpress posts and make them only accessible via logged in wp users. Note: we have the control of other server and its files/database.


Although not a question for this place (perhaps try over at StackOverflow https://stackoverflow.com/ ), you could try

  • checking the referring page (although that can be spoofed)
  • setting a cookie on WP and looking for it on the other site (although the 2nd site may not be able to read the first site's cookie). (added) Domain 2 cannot read a cookie that domain 1 sets - see https://stackoverflow.com/questions/2919968/php-read-a-cookie-that-is-on-another-domain - so this choice will not work across domains.
  • setting a query variable as you redirect from site 1 to site 2 and checking that queary variable on site 2
  • only showing the links on the WP page if the user is logged in (otherwise, there is no link shown to the non-logged in user). (Which means, if your question said "How do I show a link only to a logged-in WP user?", that might have been more proper for this place.)


Based on the two links I provided in my comments to my answer, and to show you how easy it is to do the 4th choice (the best cboice) using information in those two links, here is some sample code to allow a shortcode to show the HREF link only to logged in users.

// function for the [url] shortcode
function show_link_to_users ($atts) {
    // check if user is logged in
    if (is_user_logged_in()) { 
        $the_link =  "a href='". $atts['link'] . "'>$atts['url'</a>";
    return;     // returns a null if user not logged in

add_shortcode('url', 'show_link_to_users');

/*  Usage in content area of page/post

 This link only shown for logged in users: [url="https://www.example.com/somepage/here"]

The HREF link will only be shown for logged in users.

Note: no sanitation of the link value in the shortcode

This code would be placed in your Child Theme's functions.php file. (You don't want to put it in your theme's functions.php file, because a theme update will overwrite (destroy) the code. (Read up on Child Themes - there are tons of them out there on the googles/bings/ducks.)

Also Added

If you want to block access to a URL on your site that someone would type in (or a URL that was shared unuathorized), then you will need to use htaccess/htpasswd rules to block a specific file or subfolder of the site.

You can't do it with WP functions (pretty sure), because the user could access the link directly, rather than through a link on your page.

And Added More

Background thinking about this. General idea, but will take some programming.

  • Put all downloadable/hidden content in the same subfolder of the site.
  • Use htaccess rules to redirect all requests to any file in that subfolder to a specific page
  • that specific page has a template that checks if the user is logged in.
  • if user is logged in, then provided the file to download via headers (not a link)
  • if user is not logged in, display a message telling them to log in.

You could use a query value to specify the file to download (via a lookup in a custom table that links the query value to the file to provide via the headers.

  • seems cookie option is the best go to solution but dont know how to do – maxwassim May 4 at 8:33
  • Ask the googles (or bings or ducks) for info on cookies - how to write and read them. Plenty of tutorials on how to do it, on WP sites and non-WP sites. But, you can't read a cookie that another domain sets, so #2 will not work (see stackoverflow.com/questions/2919968/… , which I found with a quick google [hint]). If you only show the link on a WP site, then #4 will work nicely. Again, there are many googles/bings/ducks on how to do #4 . – Rick Hellewell May 4 at 20:29
  • yeah found some tutorials but can u suggest one? – maxwassim May 6 at 6:22
  • Psuedocode: 1) if user is logged in, show the link. 2) if user is not logged in, don't show the link. How to check for user logged in? developer.wordpress.org/reference/functions/is_user_logged_in . Where to put it/enable it? You could do a shortcode in the content: [link=example.com/this/page]. To create a shortcode, see this: codex.wordpress.org/Shortcode_API . That should get you started. (This place doesn't always give you exact code for your question. We let you learn how by suggesting a starting point. ) There are tutorials on both of the above subjects. – Rick Hellewell May 7 at 4:13
  • yeah but its not what i asked actually, and its something that s2member easily do, i asked how to block external download link access by non-logged in wordpress members. and that ext. link site has a perl based script – maxwassim May 7 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.