CFB Must Login

Not every site is meant for the public. A staging site waiting on client sign-off. A company intranet. A members-only community. A family blog.

CFB Must Login puts your entire site behind the WordPress login. Switch it on from the admin bar, and anyone who isn’t signed in is sent to the login page, then straight back to the page they wanted once they are.

What you get

• One-click toggle. Turn the login requirement on or off from the admin bar, on any page.
• Status at a glance. A lock icon in the admin bar always shows whether your site is private.
• Smart redirects. Visitors land back on the page they asked for after logging in.
• REST API protection. Logged-out requests to /wp-json/ are refused, so your content can’t be read through the API. Login, contact form and oEmbed endpoints keep working.
• Automatic cache clearing. Ten popular caching plugins are cleared the moment you toggle, so the change takes effect right away instead of whenever the cache expires.
• A simple settings page under Settings → CFB Must Login.
• Lightweight, translation ready, and extendable with filters and actions.

Good to know

• It starts switched off. Nothing changes for your visitors until you turn it on.
• It’s all or nothing, for now. Version 1.0 protects the entire site. Per-page exclusions may come in a future version.
• Search engines can’t crawl your site while it’s on. That’s usually the point, but remember to switch it off before launch.

Built by Code For Broke

CFB Must Login is made and maintained by Code For Broke, an independent web developer working with marketing teams and small businesses on WordPress and fast, secure websites. Questions and suggestions come straight to me through the support forum.

Developer documentation

Filter: cfb_must_login_redirect_url

Send logged-out visitors somewhere other than the default login page.

add_filter( 'cfb_must_login_redirect_url', function ( $redirect_url, $redirect_to ) {
    return 'https://example.com/custom-login';
}, 10, 2 );

Filter: cfb_must_login_allowed_rest_routes

Keep additional REST API endpoints open while protection is on.

add_filter( 'cfb_must_login_allowed_rest_routes', function ( $routes ) {
    $routes[] = '/my-plugin/v1/public';
    return $routes;
} );

Action: cfb_must_login_clear_cache

Runs whenever the plugin clears caches. Hook in to clear a cache it doesn’t know about.

add_action( 'cfb_must_login_clear_cache', function () {
    // Your custom cache clearing.
} );

Capability: cfb_must_login_manage

Controls who can change the plugin’s settings. It maps to manage_options by default; change it with the map_meta_cap filter.