{"id":204311,"date":"2024-09-25T17:17:00","date_gmt":"2024-09-25T17:17:00","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/private-website-login-required\/"},"modified":"2026-05-28T02:44:00","modified_gmt":"2026-05-28T02:44:00","slug":"private-website","status":"publish","type":"plugin","link":"https:\/\/en-au.wordpress.org\/plugins\/private-website\/","author":20943170,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"0.3.1","stable_tag":"0.3.1","tested":"7.0","requires":"5.0","requires_php":"7.4","requires_plugins":null,"header_name":"Private Website - Login Required","header_author":"Robin Oehler","header_description":"This plugin is straightforward to use: you only need to activate it. If you decide that you no longer want to enforce the login requirement, simply deactivate the plugin.","assets_banners_color":"","last_updated":"2026-05-28 02:44:00","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/www.roehler.nrw","header_plugin_uri":"https:\/\/www.roehler.nrw","header_author_uri":"https:\/\/www.roehler.nrw","rating":5,"author_block_rating":0,"active_installs":200,"downloads":3182,"num_ratings":1,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"0.1":{"tag":"0.1","author":"roehler","date":"2025-05-20 03:58:27"},"0.2.2":{"tag":"0.2.2","author":"roehler","date":"2025-09-05 23:42:19"},"0.2.3":{"tag":"0.2.3","author":"roehler","date":"2025-09-05 23:42:29"},"0.2.4":{"tag":"0.2.4","author":"roehler","date":"2025-09-05 23:52:34"},"0.2.5":{"tag":"0.2.5","author":"roehler","date":"2025-09-06 22:44:27"},"0.2.6":{"tag":"0.2.6","author":"roehler","date":"2025-09-06 22:47:50"},"0.2.7":{"tag":"0.2.7","author":"roehler","date":"2025-09-06 22:58:29"},"0.2.8":{"tag":"0.2.8","author":"roehler","date":"2025-09-06 23:01:35"},"0.2.9":{"tag":"0.2.9","author":"roehler","date":"2025-09-08 20:58:11"},"0.3.0":{"tag":"0.3.0","author":"roehler","date":"2026-04-02 23:36:47"},"0.3.1":{"tag":"0.3.1","author":"roehler","date":"2026-05-28 02:44:00"}},"upgrade_notice":{"0.3.1":"

Blocks additional entry points (comments, admin-post, wp-mail). Updated for WordPress 7.0 and PHP 7.4.<\/p>","0.3.0":"

Critical security update: Protects uploaded media files, REST API, XML-RPC, feeds, AJAX, and sitemaps from unauthenticated access. Strongly recommended for all users. Please deactivate and reactivate the plugin after updating to apply .htaccess rules.<\/p>","0.2.9":"

Consent banner re-appears after each admin login until you opt in. No data is collected unless you explicitly allow it.<\/p>","0.2.8":"

Adds a visible tracking status badge in the Plugins list description block.<\/p>","0.2.7":"

Adds a convenient opt-in\/out link in the Plugins list to toggle Appsero tracking.<\/p>","0.2.6":"

Adds clean uninstall support (removes Appsero options and scheduled events). Recommended for sites that value easy rollbacks.<\/p>","0.2.5":"

Introduces optional usage telemetry via Appsero with explicit admin opt-in and adds a Privacy Policy section. No data is collected by default.<\/p>","0.2.3":"

This version improves function naming to prevent conflicts with other plugins and fixes repository structure. Recommended update for better compatibility.<\/p>","0.2.2":"

This version updates compatibility for WordPress 6.8.1 and includes minor code improvements. It's recommended to update for the best compatibility.<\/p>","0.1":"

Initial release. No upgrade required.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":1},"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3233234,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3233234,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["0.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[602,1919,870,7668,713],"plugin_category":[38,58],"plugin_contributors":[232112],"plugin_business_model":[],"class_list":["post-204311","plugin","type-plugin","status-publish","hentry","plugin_tags-login","plugin_tags-members","plugin_tags-private","plugin_tags-restrict-access","plugin_tags-user-authentication","plugin_category-authentication","plugin_category-user-management","plugin_contributors-roehler","plugin_committers-roehler"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/private-website\/assets\/icon-128x128.png?rev=3233234","icon_2x":"https:\/\/ps.w.org\/private-website\/assets\/icon-256x256.png?rev=3233234","generated":false},"screenshots":[],"raw_content":"\n

Private Website - Login Required<\/strong> is a simple and straightforward WordPress plugin designed to restrict access to your website. By activating this plugin, users must be logged in to view any content on your site. This is ideal for websites that host sensitive or exclusive content and want to ensure that only authenticated users can access it.<\/p>\n\n

There are no complicated settings to configure. Simply activate the plugin to enforce the login requirement and deactivate it to remove the restriction.<\/p>\n\n

This plugin was developed by Robin Oehler<\/a>.<\/p>\n\n

Privacy Policy<\/h3>\n\n

Private Website – Login Required uses Appsero<\/a> SDK to collect some telemetry data upon user's confirmation. This helps us to troubleshoot problems faster & make product improvements.<\/p>\n\n

Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice. We collect the data to ensure a great user experience for all our users.<\/p>\n\n

Integrating Appsero SDK DOES NOT IMMEDIATELY start gathering data, without confirmation from users in any case.<\/p>\n\n

Learn more about how Appsero collects and uses this data<\/a>.<\/p>\n\n

Bugs & Feedback<\/h3>\n\n

Your feedback is important to me. If you find mistakes, have wishes, ideas, or suggestions, please send an email to mail@roehler.nrw<\/a>.<\/p>\n\n

Legal notice (German): https:\/\/roehler.nrw\/impressum\/<\/a><\/p>\n\n

You are free to use it on any website across countries to protect the privacy of your users.<\/p>\n\n

Note: Activating this plugin cannot guarantee that your website is completely compliant with GDPR. When using Google Analytics, Facebook pixels, or other similar tools, additional measures may need to be taken.<\/p>\n\n\n

    \n
  1. Upload the plugin files to the \/wp-content\/plugins\/private-website<\/code> directory, or install the plugin through the WordPress plugins screen directly.<\/li>\n
  2. Activate the plugin through the 'Plugins' screen in WordPress.<\/li>\n
  3. Once activated, the plugin will automatically restrict content to logged-in users only.<\/li>\n
  4. To remove the login requirement, simply deactivate the plugin.<\/li>\n<\/ol>\n\n\n
    \n

    What does this plugin do?<\/h3><\/dt>\n

    This plugin restricts access to your website content to only logged-in users. If a user is not logged in, they will be redirected to the login page.<\/p><\/dd>\n

    Are there any settings I need to configure?<\/h3><\/dt>\n

    No, there are no settings to configure. Simply activate the plugin to enforce the login requirement and deactivate it if you no longer want to restrict access.<\/p><\/dd>\n

    Can I allow access to specific pages without login?<\/h3><\/dt>\n

    Currently, the plugin does not provide the option to allow access to specific pages without login. It restricts access to the entire website.<\/p><\/dd>\n

    How do I stop the login requirement?<\/h3><\/dt>\n

    To stop requiring a login to access your site, simply deactivate the plugin from the 'Plugins' screen in WordPress.<\/p><\/dd>\n\n<\/dl>\n\n\n

    0.3.1<\/h4>\n\n
      \n
    • Security:<\/strong> Block wp-comments-post.php for non-logged-in users (bypassed template_redirect).<\/li>\n
    • Security:<\/strong> Block wp-admin\/admin-post.php for non-logged-in users (prevents nopriv form actions).<\/li>\n
    • Security:<\/strong> Block wp-mail.php for non-logged-in users.<\/li>\n
    • Compatibility:<\/strong> Dynamic uploads path detection \u2014 supports custom content directories.<\/li>\n
    • Compatibility:<\/strong> AJAX whitelist is now filterable via private_website_allowed_ajax_actions<\/code> (for 2FA plugins etc.).<\/li>\n
    • Compatibility:<\/strong> XML-RPC disable is now filterable via private_website_xmlrpc_enabled<\/code> (for Jetpack etc.).<\/li>\n
    • Compatibility:<\/strong> Updated \"Tested up to\" for WordPress 7.0.<\/li>\n
    • Compatibility:<\/strong> Raised minimum PHP version to 7.4 (matching WordPress 7.0 requirements).<\/li>\n<\/ul>\n\n

      0.3.0<\/h4>\n\n
        \n
      • Security:<\/strong> Protect direct access to uploaded files (images, PDFs, videos) via .htaccess in uploads directory.<\/li>\n
      • Security:<\/strong> Restrict REST API access to authenticated users only (prevents data leaking via \/wp-json\/).<\/li>\n
      • Security:<\/strong> Disable XML-RPC completely (prevents brute-force attacks and content leaking via xmlrpc.php).<\/li>\n
      • Security:<\/strong> Block RSS\/Atom feeds for non-logged-in users (prevents content leaking via \/feed\/).<\/li>\n
      • Security:<\/strong> Restrict AJAX requests to a whitelist of allowed actions for non-logged-in users.<\/li>\n
      • Security:<\/strong> Disable XML sitemaps for non-logged-in users to prevent site structure leaking.<\/li>\n
      • Security:<\/strong> Make robots.txt fully restrictive (Disallow: \/) to prevent search engine indexing.<\/li>\n
      • Improvement:<\/strong> Creates a self-contained .htaccess in wp-content\/uploads\/ instead of modifying the root .htaccess.<\/li>\n
      • Improvement:<\/strong> Show admin notice when .htaccess cannot be created or when Nginx is detected.<\/li>\n
      • Improvement:<\/strong> Clean up .htaccess on plugin deactivation. Supports subdirectory installs.<\/li>\n<\/ul>\n\n

        0.2.9<\/h4>\n\n
          \n
        • Ask for Appsero consent again after each admin login until consent is granted (re-prompts post-login).<\/li>\n<\/ul>\n\n

          0.2.8<\/h4>\n\n
            \n
          • Show tracking status badge directly in the plugin description (Plugins screen).<\/li>\n<\/ul>\n\n

            0.2.7<\/h4>\n\n
              \n
            • Add opt-in\/out action link directly in the Plugins screen for this plugin (enables\/disables Appsero tracking).<\/li>\n<\/ul>\n\n

              0.2.6<\/h4>\n\n
                \n
              • Add uninstall.php for clean uninstall (removes Appsero options and clears scheduled events; multisite-aware).<\/li>\n<\/ul>\n\n

                0.2.5<\/h4>\n\n
                  \n
                • Add Appsero SDK (opt-in telemetry only), with admin notice and weekly schedule.<\/li>\n
                • Add Privacy Policy section to readme; no data is collected without consent.<\/li>\n
                • Minor refactors; keep strict redirects and security hardening from 0.2.4.<\/li>\n<\/ul>\n\n

                  0.2.4<\/h4>\n\n
                    \n
                  • Enhanced security with better input validation and sanitization.<\/li>\n
                  • Improved code structure following WordPress coding standards.<\/li>\n
                  • Added proper internationalization support with textdomain.<\/li>\n
                  • Better handling of AJAX requests, REST API, and cron jobs.<\/li>\n
                  • Added activation checks for minimum WordPress and PHP versions.<\/li>\n
                  • Updated contributor information to link to author website.<\/li>\n
                  • More efficient redirect logic with wp_safe_redirect.<\/li>\n<\/ul>\n\n

                    0.2.3<\/h4>\n\n
                      \n
                    • Improved function naming to follow WordPress coding standards and prevent conflicts.<\/li>\n
                    • Fixed SVN repository structure and tag management.<\/li>\n
                    • Reduced plugin tags to comply with WordPress.org requirements (maximum 5 tags).<\/li>\n<\/ul>\n\n

                      0.2.2<\/h4>\n\n
                        \n
                      • Updated \"Tested up to\" for WordPress 6.8.1.<\/li>\n
                      • Minor code enhancements for redirect URL generation and logic.<\/li>\n<\/ul>\n\n

                        0.2.1<\/h4>\n\n
                          \n
                        • Internal code refinements and minor updates.<\/li>\n<\/ul>\n\n

                          0.2.0<\/h4>\n\n
                            \n
                          • Updated compatibility information (previously tested up to WordPress 6.7.2).<\/li>\n
                          • General maintenance and minor improvements.<\/li>\n<\/ul>\n\n

                            0.1<\/h4>\n\n
                              \n
                            • Initial release of the plugin.<\/li>\n
                            • Basic functionality to require login for viewing website content.<\/li>\n<\/ul>","raw_excerpt":"This plugin requires users to be logged in to view the website. Activate the plugin to enforce login, and deactivate it to remove the restriction.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/204311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=204311"}],"author":[{"embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/roehler"}],"wp:attachment":[{"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=204311"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=204311"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=204311"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=204311"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=204311"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/en-au.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=204311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}