0

On my website there is, beside my WordPress installation, a folder full of html files. I need to protect them using the WordPress user authentication system. The policy is simple: if you have a role, you can pass, otherwise you will not.
Is there any way to implement this?
I would not use .htaccess because I either use nginx, and I need the same members privileges as defined in one of my roles in WordPress.

4
  • This is something that happens outside of WordPress. The WordPress cookie doesn't seem to store any role information, AFAICT. You could add a cookie that handles that, and then set something up in your nginx config to read that cookie. NB: I can't speak to any security risks there might be in exposing a given user's role in a cookie.
    – Pat J
    Commented May 12, 2023 at 16:58
  • 1
    You could save the HTML files in the theme with .php extensions and a short comment at the top naming each template, then either put the check-for-certain-role conditional within the php files and apply each template to a Page you create in wp-admin; or create a custom post type, apply each template to a CPT you create in wp-admin, and keep the which-role-can-read logic within the CPT registration.
    – WebElaine
    Commented May 12, 2023 at 20:29
  • It sounds like you are looking for WordPress as a OAuth Provider (see the answer by Lana Codes). You can also view this question. Since you are looking to protect files in a sibling folder to your WordPress installation, .htaccess (or something like it) might have to be involved. Your server needs to redirect all traffic to those sibling files on every page request to confirm the user is logged in and/or has sufficient role privileges to view the requested HTML file.
    – kofeigen
    Commented May 13, 2023 at 0:35
  • I don't think OAuth is relevant to this, and what the OP wants is not possible using raw HTML files as no code is executed. To do this you'd need WordPress to handle the request so that authentication can be checked, which means each HTML file will need an associated page. @WebElaine you should write your comment as an answer
    – Tom J Nowell
    Commented May 16, 2023 at 10:44

1 Answer 1

0

You could save the HTML files in the theme with .php extensions and a short comment at the top naming each template, then either put the check-for-certain-role conditional within the php files and apply each template to a Page you create in wp-admin; or create a custom post type, apply each template to a CPT you create in wp-admin, and keep the which-role-can-read logic within the CPT registration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.