htaccess and protected option

yu
(@yudesign)

9 years, 9 months ago

Hi there,

for security reasons I use htaccess to protect my wp-login.php.

Now I’d like to protect a single page by using the WordPress password protected option (http://wordpress.tv/2009/01/14/setting-your-posts-or-entire-blog-to-private/)

Unfortunately the /wp-login.php?action=postpass is needed by this option. In the consequence I have do give my wp-login protecting password to others. Otherwise they can’t enter my protected page 🙁

As an alternative I tried to protect the single page via htaccess. Therefore I added a new template to the theme, let’s call it new.php and used it for my single page. Then I protected new.php via htaccess. But this did not work at all. Probably because the new.php will not show up in the URL but the name of the single page.

Any ideas for a solution?

Cheers
yu

Viewing 12 replies - 1 through 12 (of 12 total)

esmi
(@esmi)

9 years, 9 months ago

Have you reviewed Using_Password_Protection?

Thread Starter yu
(@yudesign)

9 years, 9 months ago

Yes, I did. It’s the same info as in the video mentioned above. And I could not find a hint regarding the conflict between htaccess protected wp-login and the protected option via Visibility. Or am I missing something?

esmi
(@esmi)

9 years, 9 months ago

If you do not make the Post or Page private and simply password protect it, no on will have to login to view it. They’ll just need to enter the Post/Page specific password via the front end of the site.

Thread Starter yu
(@yudesign)

9 years, 9 months ago

Nope. Have a try. Password for the page is: 123
http://www.publishing-bootcamp.de/test/

esmi
(@esmi)

9 years, 9 months ago

Can you not whitelist the ips you want to have access to this page?

Thread Starter yu
(@yudesign)

9 years, 9 months ago

No, that is not possible.

The protected page is for the participants of our event. We want to provide them downloads for the sessions, pics and so on. We can’t control which IP they use and in most cases their IPs will be dynamic.

3dfrivgame
(@3dfrivgame)

9 years, 9 months ago

use master WP-admin Panel,

esmi
(@esmi)

9 years, 9 months ago

Then I can’t think of a solution using core WordPress. sorry.

You might want to have a look around to see if there are any membership-type plugins that could help you restrict this content without undermining your wp-login.php protection.

Thread Starter yu
(@yudesign)

9 years, 9 months ago

Uhhh, that’s a pity. But thanks for your help so far!

At this point my suggestion to the wp developer team would be to find a way to use protected options for single pages and posts without using wp-login.php. Maybe by creating an extra transfer page for protected content naming differently as wp-login?

I really do need this on at least every second project. Maybe other users would take advantage as well from this adjustment…

watcher951
(@watcher951)

9 years, 3 months ago

Did anyone find a solution for the problem?

Thread Starter yu
(@yudesign)

9 years, 3 months ago

Plugins seem to be the only viable solution. I’m personally not very keen on plugins that always are potential security risks. The core won’t be modified, see my ticket: https://core.trac.wordpress.org/ticket/28798#comment:2.

senzuk
(@senzuk)

9 years, 2 months ago

Having exactly the same problem. Sadly, there doesn’t seem like any way to work around this.