Currently I'm trying to change a wordpress knowledge base site so that it is only accessible with JWT header from a mobile web view. So here's what I've tried :

  • I tried AAM plugin to limit access policy for visitor to only home page (https://aamplugin.com/policy/private-wordpress-website), but it doesn't work. It has the JWT authentication for backend APIs but I can't find how to limit the frontend with JWT as well
  • I tried WP Basic Authentication. It works on limiting access, where it asks for username and password if I visit any page, but I can't send the username and password programatically
  • I tried JWT Authentication for WP-API, but I can't find if it works for the frontend part as well

Any help / suggestion on what plugins to use for my case?

  • 1
    "but I can't send the username and password programatically" - why? You can set it as Authorization header. – kero May 4 at 9:04
  • If JWTs don't work on the frontend yet then you'd just need to add a determine_current_user filter that accepts the JWT. – Rup May 4 at 9:44
  • @kero: yep, i just figured that out. the plugin sent the username/password as a base64 encode, is it safe? or is there another plugin but with stronger token check? – Aldibaraniz May 4 at 10:05
  • @Aldibaraniz Safe against what? I'm no security expert, but having control over the device I could probably catch the request and read the headers; but the same is true for JWT or other scenarios. – kero May 4 at 16:11

Browse other questions tagged or ask your own question.