This plugin allows you to make your WordPress site accessible to logged in users only.
This plugin allows you to make your WordPress site accessible to logged in users only. In other words, to view your site they have to create or have an account on your site and be logged in. No configuration necessary, simply activating – that’s all.
The team at Inpsyde is engineering the web and WordPress since 2006.
You want to donate – we prefer a positive review, not more.
Please give me feedback, contribute and file technical bugs on GitHub Repo.
Good news, this plugin is free for everyone! Since it’s released under the GPL, you can use it free of charge on your personal or commercial blog. But if you enjoy this plugin, you can thank me and leave a small donation for the time I’ve spent writing and supporting this plugin. And I really don’t want to know how many hours of my life this plugin has already eaten 😉
The plugin comes with various translations, please refer to the WordPress Codex for more information about activating the translation. If you want to help to translate the plugin to your language, please have a look at the translation possibility in this page here.
You want to donate – we prefer a positive review, not more.
On PHP-CGI setups:
– mod_setenvif
or mod_rewrite
(if you want to user HTTP authentication for feeds).
/wp-content/plugins/
directory.Plugins
menu in WordPress.or use the installer via the back end of WordPress.
If you want to use HTTP authentication for feeds (available since 1.1.0 as an optional feature) you have to update your .htaccess
file. If mod_setenvif is available, add the following line to your .htaccess
:
SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
Otherwise you need mod_rewrite to be enabled. In this case you have to add the following line to your .htaccess
:
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
In a typical WordPress .htaccess
it all looks like:
<IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteRule . /index.php [L] </IfModule>
On a multisite installation:
# BEGIN WordPress RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] # uploaded files RewriteRule ^files/(.+) wp-includes/ms-files.php?file=$1 [L] RewriteCond %{REQUEST_FILENAME} -f [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^ - [L] RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteRule . index.php [L] # END WordPress
You can change the settings of Authenticator in Settings
Reading. The settings refer to the behavior of your blog’s feeds. They can be protected by HTTP authentication (not all feed readers support this) or by an authentication token which is added to your feed URL as a parameter. The third option is to keep everything in place. So feed URLs will be redirected to the login page if the user is not logged in (send no auth-cookie).If you using token authentication, you can show the token to the blog users on their profile settings page by setting this option.
Users can gain access to the feed with their username and password.
The plugin will generate a token automatically when choosing this option. Copy this token and share it with the people who should have access to your feed. If your token is ef05aa961a0c10dce006284213727730
the feed URLs look like so:
# Main feed https://example.com/feed/?ef05aa961a0c10dce006284213727730 # Main comment feed https://example.com/comments/feed/?ef05aa961a0c10dce006284213727730 # Without permalinks https://example.com/?feed=rss2&ef05aa961a0c10dce006284213727730
Filters
authenticator_get_options
gives you access to the current authentication token:
<?php
$authenticator_options = apply_filters( ‘authenticator_get_options’, array() );
authenticator_bypass
gives you the possibility to completely bypass the authentication. No authentication will be required then.
<?php
add_filter( ‘authenticator_bypass’, ‘__return_true’ );
authenticator_bypass_feed_auth
gives you the possibility to open the feeds for everyone. No authentication will be required then.
<?php
add_filter( ‘authenticator_bypass_feed_auth’, ‘__return_true’ );
authenticator_exclude_pagenows
Pass an array of $GLOBALS[ 'pagenow' ]
values to it, to exclude several WordPress pages from redirecting to the login page.
authenticator_exclude_ajax_actions
AJAX-Actions (independend of _nopriv
) which should not be authenticated (remain open for everyone)
authenticator_exclude_posts
List of post-titles which should remain public, like the follow example source to public the ‘Contact’-page.
<?php add_action( 'plugins_loaded', function() { add_filter( 'authenticator_exclude_posts', function( $titles ) { $titles[] = 'Contact'; // here goes the post-title of the post/page you want to exclude return $titles; } ); } );
authenticator_bypass
, see the readme.XMLRPC_REQUEST
.$reauth
for redirect #11.