Membership area “.htaccess style”
-
I am not sure is this easy question or not. But 8 hour coding session answer is: “Extremely difficult”.
Simply, I want make “traditional .htaccess-style protected membership pages”. It is, without wordpress I can simply make folder, make password protection and put all to this folder. index.html, pdf-files, etc etc.
Password protection: Yes, it work in WordPress. Simply “page” and “password protection”. This is enough, BUT if I add some media… it is just in “public wordpress folder” and direct access.
Plugins cannot help me: Eg. “Ultimate member”, “simple membership” this all make very difficult way. Pluginless is also impossible: “check user logged in” ok, but still: no media protection. In history it was easier: simply make password protected folder, as I said.
All my page is “traditional technology homepage”, much public media, pages etc.
Most typical way is, I make user and pw manually, meself. This is quite similar than eg. schools: teacher make homepage and tell username and pw to students. Students can read some documents, fill answering forms etc. Username + pw is not individual: it is, “username: classgrade5, pw”. So, all students use same username and pw. Reason my case is just as school, I use “students”, “class” etc instead customer…
So: I try make password protection incl pages and media, and, as I wrote, “old way is password protected folder”.
mydomain.com/students/class1 is log in page, and username is class1students and password is password.
Or,
mydomain.com/students/class2 and username class2students and pw.. etc…As you see, this is very simple. Of course I can accept password protected page: it is most easiest way. But, in WordPress it is unpossible protect media. (… “is user logged in” php is excelent, but it is only for posts and pages, for media not…)
The page I need help with: [log in to see the link]
-
In my opinion this all is easy. But, media files (wp-content/uploads etc) are allways public.
Uploads are public because the vast majority of WordPress site users want their uploads public and indexable by search engines. Luckily, WordPress is open source, and numerous solutions exist (in the form of plugins) for people who want to protect their uploads.
It seems to me we’re dealing with the so-called project triangle here:
The static .htaccess access control list can be (relatively) secure and easy to implement. But it’s not going to have any features. Eg: what happens when one of your users forgets his/her password?
Using the native WordPress protection (password-protected page or private page) is easy and has basic user management features. But as you’ve said yourself, files are not protected in any way, so the level of security you need isn’t there.
If you want a solution that is secure and feature-rich (at least having WordPress’ basic user management), expect a higher level of complexity.
There are plugins (eg Prevent Direct Access, Prevent File Access, Easy Digital Downloads, etc) that can lessen the complexity while solving this “security” problem, but then you say plugins cannot help you because they are complicated.
Let’s hope someone else can join the discussion and offer a solution that checks off all your requirements: easy to implement, protects your files, and without using any plugin.
Good luck!
- The topic ‘Membership area “.htaccess style”’ is closed to new replies.