Anyone can still login even when plugin is enabled.

  • Resolved Ron Strilaeff

    (@ronstrilaeff)


    11 years, 4 months ago

    On first impression this plugin works and gives a nice splash message with a full screen darkened image behind it.

    However, users can still log in or browse the site if they came in with an innocent bookmark like mysite.com/wp-login.php . Most post or page links are blocked, but once someone is logged in (or their cookie says they are) they would never know they weren’t “supposed” to be there and if they stumbled across a page that was in development, they might consider the site broken.

    So I guess it really serves as a polite notice and not a way to actually prevent anyone from seeing the site when it is in maintenance mode. Am I missing something or is this really true for others?

    https://www.ads-software.com/extend/plugins/ultimate-maintenance-mode/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author John Turner

    (@johnnytee)

    So the only way a user can login is if you add them as a subscriber or some other role. User not logged in will not see the site , they may see the login page but will not be able to log in. If you need to control the role level at which can view the site there are a few other plugin that can do that for free or my pro version does it. https://www.seedprod.com

    Let me know if you have any other questions!

    Thanks

    Thread Starter Ron Strilaeff

    (@ronstrilaeff)

    they may see the login page but will not be able to log in

    Not so in this case… ??
    I did this test for a subscriber and contributor:
    – logged them out
    – login as admin
    – enable MM
    – logout from admin (see UMM screen)
    – login as test user (using their saved bookmark to mysite.com/wp-login.php
    – subscriber is now logged in and able to navigate site

    This is not a contrived scenario. Our site wants to keep people logged in so they can see their favorites, share links to posts on social media, leave comments, etc. In fact we installed the “Remember Me Controls” plugin with “remember me forever” to encourage that behavior, and make it easy for people to stay connected to us and make new contributions without having to re-login everytime. Our users are either admins(2) or contributors(3142).

    No problem though, if I need to actually block the site I’m sure (as you say) there are many ways.

    Thanks for putting together this very attractive and easy to use plugin.

    Plugin Author John Turner

    (@johnnytee)

    Right, if you are logged as per your scenario you will see the site. I need to add role control just have not had the time ??

    “Thanks for putting together this very attractive and easy to use plugin.”
    Thanks !

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Anyone can still login even when plugin is enabled.’ is closed to new replies.