Title: EDH Restricted Site Author: EncodeDotHost Published: August 6, 2026 Last modified: August 6, 2026 --- Search plugins ![](https://ps.w.org/edh-restricted-site/assets/banner-772x250.jpg?rev=3636583) ![](https://ps.w.org/edh-restricted-site/assets/icon-256x256.png?rev=3636583) # EDH Restricted Site By [EncodeDotHost](https://profiles.wordpress.org/encodedothost/) [Download](https://downloads.wordpress.org/plugin/edh-restricted-site.2.1.2.zip) * [Details](https://wordpress.org/plugins/edh-restricted-site/#description) * [Reviews](https://wordpress.org/plugins/edh-restricted-site/#reviews) * [Installation](https://wordpress.org/plugins/edh-restricted-site/#installation) * [Development](https://wordpress.org/plugins/edh-restricted-site/#developers) [Support](https://wordpress.org/support/plugin/edh-restricted-site/) ## Description EDH Restricted Site gates access to your entire WordPress site behind a simple email- domain verification flow. Visitors enter their email address via a shortcode or Gutenberg block. If their email’s domain is on your configured allow-list, they receive a one-time verification link by email. Clicking it grants them a cookie-based access pass for a period you control. Anyone without that pass is redirected to the verification form. Users who can manage options always have full access, regardless of settings. **Features** * Email-domain allow-list, managed from an admin settings page (one domain per line) * Choose which pages are exempt from the access check (e.g. the verification page itself, a privacy policy page) * Verification form available as a shortcode (`[edhrs_verification_form]`) or as a block (“Email Verification Form”) * Configurable “From” address for verification emails * Configurable access-cookie duration * Configurable rate limiting on verification emails, per address and per IP address * Configurable button colour via WordPress’s native colour picker * A verification-request log (linked from the Settings page and the Plugins screen) showing each email requested and whether its link has been used, with automatic retention-based cleanup * No build tooling required ## Blocks This plugin provides 1 block. * Email Verification Form Displays the email verification form used to gain access to this site. ## Installation 1. Upload the plugin files to `/wp-content/plugins/edh-restricted-site`, or install the plugin through the WordPress plugins screen. 2. Activate the plugin through the “Plugins” screen. 3. On activation, defaults are seeded automatically: your site’s own domain is added to the allow-list, your front page is set as the unrestricted page, access denied page, and post-verification redirect, and your site’s admin email is used as the sender address. 4. Visit **Settings Restricted Site** to review and adjust: 5. * Allowed email domains * Pages that don’t require verification (at least one must remain selected) * The access denied page visitors without access are sent to * The page shown after a successful verification * The “From” email address for verification emails * How many days the access cookie lasts * How many verification emails a single address, or a single IP address, can request per hour * How many days verification-request log entries are kept before automatic deletion 6. Add the `[edhrs_verification_form]` shortcode, or the “Email Verification Form” block, to one of your unrestricted pages. 7. Use the **View Logs** link at the top of the Settings page (or **Logs** next to Activate/Deactivate on the Plugins screen) to see who’s requested access and whether their link has been used. ## FAQ ### Does this restrict access for administrators too? No. Logged-in users who can manage options — administrators on a single site, plus Super Admins on multisite — always have full access, regardless of the verification/ cookie state. ### All my visitors are in one office and they’re hitting the rate limit They’ll all be sharing one internet connection, so they share an IP address, and the per-IP limit counts them as a single visitor. Raise **Requests per IP address( per hour)** under Settings Restricted Site, or set it to **0** to switch that limit off entirely. The per-address limit is unaffected either way. ### Can I allow more than one email domain? Yes. Enter one domain per line in the “Allowed email domains” field under Settings Restricted Site. ### What happens if I don’t select any unrestricted pages? The settings page won’t let you save an empty selection — at least one page must remain unrestricted, since the “Access denied page” setting (where visitors without access are sent) must always be one of them. ### Do I need to use the shortcode and the block? No, either one works on its own; use whichever fits your page-building workflow. ### Does the log record rejected or invalid attempts? No, only successful sends – a valid, allowed-domain email that a verification email was actually sent for. Invalid emails and disallowed domains are never logged. ### What happens to old log entries? They’re deleted automatically once they’re older than the “Log retention (days)” setting (default 90 days), via a daily background task. Deactivating the plugin doesn’t delete any log data; deleting the plugin entirely does. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “EDH Restricted Site” is open source software. The following people have contributed to this plugin. Contributors * [ EncodeDotHost ](https://profiles.wordpress.org/encodedothost/) [Translate “EDH Restricted Site” into your language.](https://translate.wordpress.org/projects/wp-plugins/edh-restricted-site) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/edh-restricted-site/), check out the [SVN repository](https://plugins.svn.wordpress.org/edh-restricted-site/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/edh-restricted-site/) by [RSS](https://plugins.trac.wordpress.org/log/edh-restricted-site/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.1.2 * Documentation only, no code changes: corrected a stale pre-2.0.0 shortcode in README.md and brought its feature and setup lists back in line with this file. #### 2.1.1 * Fixed a fatal error in wp-admin for any logged-in user without the `manage_options` capability — an Editor, Author or Subscriber opening the dashboard got a white screen. `add_options_page()` returns false for them, and assigning that to a string-typed property is a TypeError under strict types. Present since 1.5.x, not new in 2.1.0. * Applied the same guard to the settings option read, which would otherwise fatal on every request rather than only in wp-admin if the option row were ever corrupted. * Fixed an infinite redirect loop on an unconfigured install — with no unrestricted pages set, the access-denied redirect pointed at a page that was itself gated. The gate now fails closed with a 403 message instead of looping. #### 2.1.0 * **Security:** fixed a bypass that let anyone unlock the whole site by setting the access cookie to an arbitrary value — it was only ever checked for presence, never validated. Cookies are now signed with `wp_salt('auth')` and verified on every request. * Verification links no longer carry the visitor’s email address, keeping it out of browser history, access logs and `Referer` headers. Requesting a second link no longer invalidates the first. * Added configurable rate limiting on verification emails — per address and per IP address, either settable to 0 for no limit. * The plugin is now fully translatable; previously no string used the declared text domain. * The administrator bypass now checks the `manage_options` capability rather than the `administrator` role name, so multisite Super Admins are covered. * Further plugin-review fixes: allowed-domain validation, output escaping in the form, no email address in the “failed to store token” error log, removed the empty `Plugin URI:` header. * Expired options-table fallback tokens are now cleaned up by the existing daily cron event. #### 2.0.0 * Renamed every global identifier prefix from `edh`/`edh_rs` to `edhrs` (options, log table, cookie, shortcode, AJAX action, cron hook, classes, constants) per WordPress.org plugin review requirements. **Breaking:** existing installs lose their saved settings and log history when updating – reconfigure under Settings Restricted Site. * The shortcode is now `[edhrs_verification_form]`. * Removed the “If you get stuck, email…” line from the verification email. * Added a “Button text colour” setting, controlling the text colour of both the frontend form’s submit button and the email’s “Verify Email Address” button. The “Button colour” setting now also applies to the email’s button. * Verification email styles are now fully inline for better email-client compatibility. * Additional input-sanitization and SQL-hardening changes from the WordPress.org plugin review. #### 1.5.5 * Fixed a “Text Domain” typo (`edh-resticted-site` `edh-restricted-site`) and renamed the main plugin file to match. #### 1.5.4 * Added a “Back to Settings” button to the Logs page. #### 1.5.3 * Fixed the Logs page showing no heading above the table. #### 1.5.2 * Fixed two more Plugin Check warnings from 1.5.1’s log-viewer query fix. #### 1.5.1 * Fixed remaining Plugin Check warnings from 1.5.0’s log-viewer queries. * “Restricted Site Logs” is no longer a separate entry in the Settings menu – use the “View Logs”/”Logs” links instead. #### 1.5.0 * Added a verification-request log (Settings Restricted Site Logs): email address, requested date, Pending/Used/Expired status, and used date for every successful verification send. * Added a “Log retention (days)” setting – old entries are purged automatically. * Added “Settings”/”Logs” links on the Plugins screen and a “View Logs” link on the Settings page. * Added uninstall cleanup for the new log table and its scheduled task. #### 1.4.0 * Replaced the fixed-palette button colour picker with WordPress’s native colour picker, accepting any valid hex colour. #### 1.3.0 * Fixed an edge case where the static front page or “posts page” couldn’t be correctly selected as an unrestricted page. * Hardened the access check against caching plugins/CDNs serving a gated response to the wrong visitor. * Added optional debug logging for diagnosing access-check behaviour. #### 1.2.2 * “Unrestricted pages” and “Access denied page” now only offer published pages. * Renamed the “Default page” setting to “Access denied page” for clarity. #### 1.2.1 * Fixed a remaining Plugin Check input-sanitization warning on the verification link’s email parameter. #### 1.2.0 * Added an explicit “Access denied page” setting for where visitors without access are sent, replacing the previous implicit reliance on the first selected unrestricted page. * Fixed several WordPress.org Plugin Check compliance issues (block API version, output escaping, input sanitization, packaging). #### 1.1.0 * Added a “Button colour” setting, chosen from WordPress’s default editor colour palette. * Fixed the verification form’s stylesheet not loading in the block editor. #### 1.0.0 * Initial release. * Email verification flow with a domain allow-list, shortcode and Gutenberg block, and cookie-based access passes. * Admin settings page for allowed domains, unrestricted pages, redirect-after-verification page, sender email address, and cookie duration. * Verification tokens stored as transients with an automatic options-table fallback for reliability. ## Meta * Version **2.1.2** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.3 or higher ** * Tested up to **7.0.3** * PHP version ** 7.4 or higher ** * Tags * [access-control](https://wordpress.org/plugins/tags/access-control/)[email verification](https://wordpress.org/plugins/tags/email-verification/) [login](https://wordpress.org/plugins/tags/login/)[private site](https://wordpress.org/plugins/tags/private-site/) [Restrict access](https://wordpress.org/plugins/tags/restrict-access/) * [Advanced View](https://wordpress.org/plugins/edh-restricted-site/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/edh-restricted-site/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/edh-restricted-site/reviews/) ## Contributors * [ EncodeDotHost ](https://profiles.wordpress.org/encodedothost/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/edh-restricted-site/)