Restricted Site Access

FAQ

Où puis-je modifier les réglages de restriction ?

Restricted Site Access settings are added to the Reading page, with WordPress’s built in site privacy options. (It was moved there from a separate Privacy settings page in 3.5.)

Ça ne fonctionne pas ! Mon site est grand ouvert !

Most commonly, Restricted Site Access is not compatible with some page caching solutions. While the plugin hooks in as early as it can to check visitor permissions, its important to understand that some page caching plugins generate static output that prevents plugins like Restricted Site Access from ever checking individual visitors.

To the extent that sites blocked by this plugin should not need to concern themselves with high scale front end performance, we strongly recommend disabling any page caching solutions while restricting access to your site. Keep in mind that most page caching plugins do not cache the “logged in” experience, anyhow. Also note that the plugin is fully compatible with other caching layers, like the WordPress object cache.

Comment puis-je autoriser l’accès à des pages ou parties spécifiques de mon site ?

Developers can use the restricted_site_access_is_restricted filter to override normal restriction behavior. Note that restriction checks happen before WordPress executes any queries; it passes the query request from the global $wp variable so developers can investigate what the visitor is trying to load.

For instance, to unblock an RSS feed, place the following PHP code in the theme’s functions.php file or in a simple plug-in:

add_filter( 'restricted_site_access_is_restricted', 'my_rsa_feed_override', 10, 2 );

function my_rsa_feed_override( $is_restricted, $wp ) {
    // check query variables to see if this is the feed
    if ( ! empty( $wp->query_vars['feed'] ) ) {
        $is_restricted = false;
    }
    return $is_restricted;
}

Quel est le degré de sécurité de cette extension ?

Visitors that are not logged in or allowed by IP address will not be able to browse your site (though be cautious of page caching plugin incompatibilities, mentioned above). Restricted Site Access does not block access to your « real » files, so direct links to files in your media and uploads folder (for instance) are not blocked. It is also important to remember that IP addresses can be spoofed. Because Restricted Site Access runs as a plug-in, it is subject to any other vulnerabilities present on your site.

L’accès restreint au site n’est pas un coffre-fort de données top secret, mais simplement un moyen fiable et pratique de gérer les visites indésirables.

In 7.3.2, two new filters were added that can be utilized to help prevent IP spoofing attacks. The first filter allows you to set up a list of approved proxy IP addresses and the second allows you to set up a list of approved HTTP headers. For any sites that were using Restricted Site Access prior to version 7.5.0, a handful of HTTP headers are trusted by default. To change this, utilize the rsa_trusted_headers filter to modify the HTTP headers you want to trust. If your site is not running behind a proxy, we recommend doing the following:

add_filter( 'rsa_trusted_headers', '__return_empty_array' );

This will then only use the REMOTE_ADDR HTTP header to determine the IP address of the visitor. This header can’t be spoofed, so this will increase security. Note that this is now the default for all new installs since version 7.5.0.

If your site is running behind a proxy (like a CDN), you usually can’t rely on the REMOTE_ADDR HTTP header, as this will contain the IP address of the proxy, not the user. If your proxy uses static IP addresses, we recommend using the rsa_trusted_proxies filter to set those trusted IP addresses:

add_filter( 'rsa_trusted_proxies', 'my_rsa_trusted_proxies' );

function my_rsa_trusted_proxies( $trusted_proxies = array() ) {
  // Set one or more trusted proxy IP addresses.
  $proxy_ips       = array(
    '10.0.0.0/24',
    '10.0.0.0/32',
  );
  $trusted_proxies = array_merge( $trusted_proxies, $proxy_ips );

  return array_unique( $trusted_proxies );
}

And then use the rsa_trusted_headers filter to set which HTTP headers you want to trust. Consult with your proxy provider to determine which header(s) they use to hold the original client IP:

add_filter( 'rsa_trusted_headers', 'my_rsa_trusted_headers' );

function my_rsa_trusted_headers( $trusted_headers = array() ) {
  // Set one or more trusted HTTP headers.
  $headers = array(
    'HTTP_X_FORWARDED',
    'HTTP_FORWARDED',
  );

  return $headers;
}

If your proxy does not use static IP addresses, you can still utilize the rsa_trusted_headers filter to change which HTTP headers you want to trust.

J’ai reçu un avertissement concernant la mise en cache des pages. Que cela signifie-t-il ?

As of version 7.6.0, RSA attempts to prevent full page caching on sites with an IP address allow list. This is to prevent the page content from being stored at the caching level and displayed to unauthorized visitors.

Page caching plugins often hook into WordPress to quickly serve the last cached output of a page before we can check to see if a visitor’s access should be restricted. Not all page caching plugins behave the same way, but several solutions – including external solutions we might not detect – can ignore the no-caching headers set by WordPress and show cached content to unauthorized users.

Pourquoi les internautes connectés ne peuvent-ils pas voir tous les sites de mon instance multisite ?

In 6.2.0, the behavior in a multisite install changed from allowing any logged-in user to see a site to checking their role for that specific site. This is a safer default given the varying ways multisite is used; however, if you would prefer to rely on the previous behavior rather than explicitly adding users to each site, place the following PHP code in the theme’s functions.php file or in a simple plug-in:

add_filter( 'restricted_site_access_user_can_access', 'my_rsa_user_can_access' );

function my_rsa_user_can_access( $access ) {
    if ( is_user_logged_in() ) {
        return true;
    }

    return $access;
}

Existe-t-il un moyen de configurer cela avec [WP-CLI] (https://make.wordpress.org/cli/) ?

À partir de la version 7.0.0, l’intégration de CLI a été ajoutée. Pour voir les commandes disponibles, tapez ce qui suit dans votre répertoire WordPress :

$ wp rsa

Comment puis-je définir par programme des adresses IP sur liste blanche ?

En 7.0.0, la capacité de définir un tableau d’adresses IP en liste blanche via une constante a été introduite.

Dans votre fichier wp-config.php, vous pouvez définir ce qui suit :

define( 'RSA_IP_WHITELIST', '192.0.0.1|192.0.0.10' );

In 7.1.1, the capacity to programmatically add / remove / set access IPs programmatically was introduced.

Les déclarations suivantes sont valides :

Définir les IP, en ignorant toutes les valeurs stockées (mais pas les valeurs définies constantes), si vous allez utiliser l’approche avec les indices de tableau plutôt que de mélanger les deux.

Restricted_Site_Access::set_ips( array( '192.168.0.1', '192.168.0.2', '192.168.0.3' ) );
Restricted_Site_Access::set_ips( array( 'labelfoo' => '192.168.0.1', 'labelbar' => 192.168.0.2', 'labelbaz' => 192.168.0.3' ) );

Ajouter des adresses IP, si elles ne sont pas déjà ajoutées.

Restricted_Site_Access::append_ips( array( '192.168.1.5' => 'five', '192.168.1.6' => 'six' ) );

Retirer des adresses IP, si elles figurent dans la liste.

Restricted_Site_Access::remove_ips( array( '192.168.1.2','192.168.1.5','192.168.1.6', ) );

Existe-t-il une constante que je peux définir pour m’assurer que mon site est (ou n’est pas) restreint ?

Depuis la version 7.1.0, deux constantes ont été introduites qui vous permettent de spécifier si le site doit être en mode restreint.

Vous pouvez forcer l’extension en mode restreint en ajoutant ce qui suit à votre fichier wp-config.php :

define( 'RSA_FORCE_RESTRICTION', true );

Ou pour s’assurer que votre site ne sera pas en mode restreint :

define( 'RSA_FORBID_RESTRICTION', true );

Make sure you add it before the /* That's all, stop editing! Happy blogging. */ line.

Please note that setting RSA_FORCE_RESTRICTION will override RSA_FORBID_RESTRICTION if both are set.

How are REST API requests handled?

When the site is restricted, blocked REST API requests (/wp-json/... or ?rest_route=...) receive a JSON error with a 401 status code (403 for logged-in users without access to the site) instead of the redirect, message or page configured under « Handle restricted visitors ». This lets API clients, such as mobile apps, headless front ends and MCP clients, detect that they need to authenticate. The response looks like a core REST API error and is sent with no-cache headers:

{"code":"rest_not_logged_in","message":"This site is restricted. You must be logged in to access it.","data":{"status":401}}

Visitors with an unrestricted IP address and requests unrestricted by the restricted_site_access_is_restricted filter are not affected. REST API requests no longer go through the restricted_site_access_message, restricted_site_access_redirect_url or restricted_site_access_head filters, so code that used those to handle API requests needs to move to the filters below (or turn this behavior off).

Use the restricted_site_access_rest_response filter to change the status (any 4xx or 5xx code), body or headers. A header set to false is removed, and an array of values sends the header once per value. A response in any other shape falls back to the default, so the filter can’t lift the restriction by accident. For example, to point OAuth clients at your protected resource metadata (RFC 9728):

add_filter( 'restricted_site_access_rest_response', function ( $response, $wp ) {
    $response['headers']['WWW-Authenticate'] = 'Bearer resource_metadata="' . home_url( '/.well-known/oauth-protected-resource' ) . '"';
    return $response;
}, 10, 2 );

// The metadata itself has to be reachable without logging in.
add_filter( 'restricted_site_access_is_restricted', function ( $is_restricted, $wp ) {
    if ( 0 === strpos( $wp->request, '.well-known/oauth-protected-resource' ) ) {
        return false;
    }
    return $is_restricted;
}, 10, 2 );

To handle REST API requests like any other request, as in earlier versions, use the restricted_site_access_use_rest_response filter:

add_filter( 'restricted_site_access_use_rest_response', '__return_false' );

Que fait l’option « Décourager les moteurs de recherche d’indexer ce site » ?

When the ‘Discourage search engines from indexing this site’ option is enabled, it prevents search engines from indexing the site while still permitting access to regular visitors.

What does ‘Restrict site access to visitors who are logged in or allowed by IP address’ do?

When this option is activated, it serves as a barrier to all visitors except those who are authenticated (logged in) or whose IP addresses are included in the ‘Unrestricted IP addresses’ setting. This restriction applies universally, even to automated crawlers such as search engines.

Where do I report security bugs found in this plugin?

Please report security bugs found in the source code of the Restricted Site Access plugin through the Patchstack Vulnerability Disclosure  Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.