We’ve done this more robust version of a “private WordPress site” before (it was a site for HR documents that could potentially contain privileged information–so lots of PDFs). I can walk you through what we did, but it does require some coordination that’s larger than the scope of this plugin.
1) First off, configure Authorizer to only allow logged in users to see the site. This will prevent anonymous access to anything routed through WordPress, including the REST API (e.g., /wp-json/wp/v2/posts).
2) For completeness (in case things change in the future), use the WordPress-suggested way to prevent anonymous access to the REST API:
https://developer.www.ads-software.com/rest-api/using-the-rest-api/frequently-asked-questions/#require-authentication-for-all-requests
3) Now it’s time to prevent anonymous access to static resources. This requires configuration at the web server level, so the info below only applies to Apache.
3a) Place an .htaccess file in your /wp-content/uploads directory:
# Block public access to file uploads directly.
RewriteEngine On
RewriteBase /wp-content/uploads
RewriteRule . /DirectAccessToFilesDenied
Options -Indexes
This basically redirects all requests to something in the uploads directory to some path that doesn’t exist. WordPress’s own .htaccess file tells the web server to handle requests like this, so this will eventually render your WordPress 404 template if we stopped here.
3b) Hook into parse_request to examine all WordPress requests, and do something for the ones requesting a file from the uploads directory. We basically do an is_user_logged_in() check first, and if it fails, send the request on, which will ultimately render the 404 template. If Authorizer is configured to prevent access to anonymous users, at this point you can choose to have it show the access denied message, or redirect to wp-login.php. Moving on, for users that pass the is_user_logged_in() check, we can now tell PHP to do what the web server would have done: just output the headers and raw file content to the client, and then exit. Here’s what that hook might look like:
// Require authentication for direct access to /wp-content/uploads directory.
// NOTE: This feature requires the following .htaccess file to be present
// in the /wp-content/uploads directory, in order to redirect all requests
// to WordPress. We intercept these requests here, and if the current user
// is logged in, show it to them. Otherwise load the 404 template.
// .htaccess file:
//
// # Block public access to file uploads directly (REST endpoint will be the only way to grab them).
// RewriteEngine On
// RewriteBase /wp-content/uploads
// RewriteRule . /DirectAccessToFilesDenied
// Options -Indexes
//
add_action( 'parse_request', function ( $query ) {
// If user isn't logged in, fall through (will go to the 404 template).
if ( ! is_user_logged_in() ) {
return;
}
// Check if this is a request for something in /wp-content/uploads.
$upload_dir = wp_upload_dir();
$relative_upload_dir = str_replace( ABSPATH, '', $upload_dir['path'] ) . '/';
if ( strpos( $query->request, $relative_upload_dir ) === 0 ) {
// Don't do anything if REQUEST_URI contains ../
// (possible attempt to bypass uploads directory).
if ( strpos( $query->request, '../' ) !== false ) {
return $type;
}
// Get attachment file from local filesystem (avoid .htaccess checks).
$file_path = ABSPATH . ltrim( $query->request, '/' );
$detected_type = wp_check_filetype( $file_path, get_allowed_mime_types() );
$mime_type = array_key_exists( 'type', $detected_type ) ? $detected_type['type'] : 'text/plain';
$file_time = filemtime( $file_path );
$file_contents = file_get_contents( $file_path );
// Craft the http response containing the file data (actually just
// short-circuit by outputing the headers and file data).
header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s', $file_time ) . ' GMT' );
header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', $file_time + 86400*365 ) . ' GMT' );
header( 'Content-Length: ' . filesize( $file_path ) );
header( 'Content-Type: ' . $mime_type );
header( 'Content-Disposition: inline; filename="' . addslashes( basename( $file_path ) ) . '"' );
echo $file_contents;
exit;
}
});
4) That should be it. Feel free to poke holes in that!
