/ Plugin Category

/ Security & Privacy

/ Restricted Site Access

Restricted Site Access

By 10up

Security & Privacy /

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

Restricted Site Access Review - In-Depth Analysis

Limit access to your site for visitors who are not logged in or not on an allowed IP list. Customize behavior for blocked visitors.

Performance Overview

WPS Score

7.13/10

User Rating

4.8/5 (based on 62+ reviews)

Active Installations

10,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

5 / 10 (Medium Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin allows you to limit access to your site for visitors who are not logged in or are not accessing from specified IP addresses. You can send restricted visitors to the login page, redirect them, or display a custom message or page. It is an excellent solution for Extranets, publicly hosted Intranets, or parallel development and staging sites.

The plugin adds several configuration options to the Reading settings panel and the Network Settings panel in multisite. You can enable or disable site restriction, change the restriction behavior, and add IP addresses to an unrestricted list, including ranges. Additionally, you can quickly add your current IP to the unrestricted list and customize the redirect location.

Furthermore, you can define a simple message for restricted visitors or select a page to show them, which is great for displaying 'coming soon' teasers.

Comparing to Alternatives

Restricted Site Access is a popular plugin for controlling site access with several viable alternatives available.

Top alternatives

Strengths

Simple and effective IP-based access restriction without complex configuration
Highly rated for reliability and ease of use
Minimalistic design avoids unnecessary features, focusing on core functionality
Good replacement for outdated maintenance plugins
Supports restricting access to registered users or specific IPs

Weaknesses

Had a medium severity security vulnerability fixed in version 7.3.2
Limited advanced features compared to some alternatives
No pro version with extended capabilities
Settings may be too basic for complex access control needs

User Sentiment Analysis

With a 4.8 out of 5 rating from 62 users, the plugin is overwhelmingly praised for its simplicity and effectiveness, with very few negative reviews.

Positive highlights

'Works 100%, super helpful.' — con
'Easy use and powerful plugin.' — maoflager
'Highly recommended. This plugin delivers what it announces and does a perfect job.' — pf92
'Great Plugin for Intranet/Extranet. Settings are absolutely sufficient and completely fulfill their purpose.' — Hans-Gerd Gerhards
'Simple, effective and without unnecessary frills.' — Orsp

Common complaints

Weaknesses

Security vulnerability fixed in version 7.3.2 indicates past risk
Lacks advanced features found in some alternatives
No paid version limits extended functionality options

Who Should Use This?

Best for

Users seeking a straightforward, reliable plugin to restrict site access by IP or user registration without complex setup.

Not ideal for

Those needing advanced access control features or who require a plugin with ongoing premium support and extended capabilities.

Pricing & Value

Free version includes

The free version offers essential site access restriction features suitable for most users.

Final Verdict

Restricted Site Access is a highly rated plugin praised for its simplicity, reliability, and effectiveness in restricting site access. It serves well for users needing basic IP or user-based access control without unnecessary complexity. The plugin's free availability adds to its appeal for budget-conscious users.

However, it has a history of a medium severity security vulnerability that has been addressed, and it lacks advanced features and a pro version, which may limit its suitability for users with more complex access control needs. Alternatives exist that offer more features but may be more complex to configure.

Other Notable Features

Here are a few other notable features of this free Restricted Site Access plugin.

Limit access

IP restrictions

Visitor permissions

Screenshots

FAQ

Restricted Site Access settings are added to the Reading page, with WordPress’s built in site privacy options. (It was moved there from a separate Privacy settings page in 3.5.)

Developers can use the restricted_site_access_is_restricted filter to override normal restriction behavior. Note that restriction checks happen before WordPress executes any queries; it passes the query request from the global $wp variable so developers can investigate what the visitor is trying to load.

For instance, to unblock an RSS feed, place the following PHP code in the theme’s functions.php file or in a simple plug-in:

add_filter( 'restricted_site_access_is_restricted', 'my_rsa_feed_override', 10, 2 );  function my_rsa_feed_override( $is_restricted, $wp ) {     // check query variables to see if this is the feed     if ( ! empty( $wp->query_vars['feed'] ) ) {         $is_restricted = false;     }     return $is_restricted; }

Visitors that are not logged in or allowed by IP address will not be able to browse your site (though be cautious of page caching plugin incompatibilities, mentioned above). Restricted Site Access does not block access to your “real” files, so direct links to files in your media and uploads folder (for instance) are not blocked. It is also important to remember that IP addresses can be spoofed. Because Restricted Site Access runs as a plug-in, it is subject to any other vulnerabilities present on your site.

Restricted Site Access is not meant to be a top secret data safe, but simply a reliable and convenient way to handle unwanted visitors.

In 7.3.2, two new filters were added that can be utilized to help prevent IP spoofing attacks. The first filter allows you to set up a list of approved proxy IP addresses and the second allows you to set up a list of approved HTTP headers. For any sites that were using Restricted Site Access prior to version 7.5.0, a handful of HTTP headers are trusted by default. To change this, utilize the rsa_trusted_headers filter to modify the HTTP headers you want to trust. If your site is not running behind a proxy, we recommend doing the following:

add_filter( 'rsa_trusted_headers', '__return_empty_array' );

This will then only use the REMOTE_ADDR HTTP header to determine the IP address of the visitor. This header can’t be spoofed, so this will increase security. Note that this is now the default for all new installs since version 7.5.0.

If your site is running behind a proxy (like a CDN), you usually can’t rely on the REMOTE_ADDR HTTP header, as this will contain the IP address of the proxy, not the user. If your proxy uses static IP addresses, we recommend using the rsa_trusted_proxies filter to set those trusted IP addresses:

add_filter( 'rsa_trusted_proxies', 'my_rsa_trusted_proxies' );  function my_rsa_trusted_proxies( $trusted_proxies = array() ) {   // Set one or more trusted proxy IP addresses.   $proxy_ips       = array(     '10.0.0.0/24',     '10.0.0.0/32',   );   $trusted_proxies = array_merge( $trusted_proxies, $proxy_ips );    return array_unique( $trusted_proxies ); }

And then use the rsa_trusted_headers filter to set which HTTP headers you want to trust. Consult with your proxy provider to determine which header(s) they use to hold the original client IP:

add_filter( 'rsa_trusted_headers', 'my_rsa_trusted_headers' );  function my_rsa_trusted_headers( $trusted_headers = array() ) {   // Set one or more trusted HTTP headers.   $headers = array(     'HTTP_X_FORWARDED',     'HTTP_FORWARDED',   );    return $headers; }

If your proxy does not use static IP addresses, you can still utilize the rsa_trusted_headers filter to change which HTTP headers you want to trust.

In 6.2.0, the behavior in a multisite install changed from allowing any logged-in user to see a site to checking their role for that specific site. This is a safer default given the varying ways multisite is used; however, if you would prefer to rely on the previous behavior rather than explicitly adding users to each site, place the following PHP code in the theme’s functions.php file or in a simple plug-in:

add_filter( 'restricted_site_access_user_can_access', 'my_rsa_user_can_access' );  function my_rsa_user_can_access( $access ) {     if ( is_user_logged_in() ) {         return true;     }      return $access; }

As of version 7.0.0, CLI integration has been added. To see the available commands, type the following in your WordPress directory:

$ wp rsa

In 7.0.0, the capacity to define a pipe delimited array of whitelisted IP addresses via constant was introduced.

In your wp-config.php file, you can define the following:

define( 'RSA_IP_WHITELIST', '192.0.0.1|192.0.0.10' );

In 7.1.1, the capacity to programmatically add / remove / set access IPs programmatically was introduced.

The following are valid statements:

Set IPs, ignoring all stored values (but not the constant defined values), if you’re going to use the approach with array indices rather than mixing the two.

Restricted_Site_Access::set_ips( array( '192.168.0.1', '192.168.0.2', '192.168.0.3' ) ); Restricted_Site_Access::set_ips( array( 'labelfoo' => '192.168.0.1', 'labelbar' => 192.168.0.2', 'labelbaz' => 192.168.0.3' ) );

Add IPs, if they’re not already added.

Restricted_Site_Access::append_ips( array( '192.168.1.5' => 'five', '192.168.1.6' => 'six' ) );

Remove IPs, if they are in the list.

Restricted_Site_Access::remove_ips( array( '192.168.1.2','192.168.1.5','192.168.1.6', ) );

As of version 7.1.0, two constants were introduced that give you the ability to specify if the site should be in restricted mode.

You can force the plugin to be in restricted mode by adding the following to your wp-config.php file:

define( 'RSA_FORCE_RESTRICTION', true );

Or to ensure your site won’t be in restricted mode:

define( 'RSA_FORBID_RESTRICTION', true );

Make sure you add it before the /* That's all, stop editing! Happy blogging. */ line.

Please note that setting RSA_FORCE_RESTRICTION will override RSA_FORBID_RESTRICTION if both are set.

add_filter( 'restricted_site_access_user_can_access', 'my_rsa_user_can_access' );  function my_rsa_user_can_access( $access ) {     if ( is_user_logged_in() ) {         return true;     }      return $access; }

When the site is restricted, blocked REST API requests (/wp-json/... or ?rest_route=...) receive a JSON error with a 401 status code (403 for logged-in users without access to the site) instead of the redirect, message or page configured under “Handle restricted visitors”. This lets API clients, such as mobile apps, headless front ends and MCP clients, detect that they need to authenticate. The response looks like a core REST API error and is sent with no-cache headers:

{"code":"rest_not_logged_in","message":"This site is restricted. You must be logged in to access it.","data":{"status":401}}

Visitors with an unrestricted IP address and requests unrestricted by the restricted_site_access_is_restricted filter are not affected. REST API requests no longer go through the restricted_site_access_message, restricted_site_access_redirect_url or restricted_site_access_head filters, so code that used those to handle API requests needs to move to the filters below (or turn this behavior off).

Use the restricted_site_access_rest_response filter to change the status (any 4xx or 5xx code), body or headers. A header set to false is removed, and an array of values sends the header once per value. A response in any other shape falls back to the default, so the filter can’t lift the restriction by accident. For example, to point OAuth clients at your protected resource metadata (RFC 9728):

add_filter( 'restricted_site_access_rest_response', function ( $response, $wp ) {     $response['headers']['WWW-Authenticate'] = 'Bearer resource_metadata="' . home_url( '/.well-known/oauth-protected-resource' ) . '"';     return $response; }, 10, 2 );  // The metadata itself has to be reachable without logging in. add_filter( 'restricted_site_access_is_restricted', function ( $is_restricted, $wp ) {     if ( 0 === strpos( $wp->request, '.well-known/oauth-protected-resource' ) ) {         return false;     }     return $is_restricted; }, 10, 2 );

To handle REST API requests like any other request, as in earlier versions, use the restricted_site_access_use_rest_response filter:

add_filter( 'restricted_site_access_use_rest_response', '__return_false' );

Contributors and developers

“Restricted Site Access” is open source software. The following people have contributed to this plugin.

Siddharth Thevaril

Darin Kotter

Free Version

WPS

7.13

Very Good

Ratings

4.8 out of 5 | 62

Version

7.6.4

Last updated

2 days ago

Active installations

10,000+

WordPress version

7.1.3 or higher

PHP version

7.4 or higher

Languages

Other plugins you might like

Wordfence Security – Firewall, Malware Scan, and Login Security

By Mark Maunder

WPS

7.87

Very Good

4.7/5

5k+reviews

5M+

active installation

Tested with

7.1.3

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

By Really Simple Plugins

WPS

7.7

Very Good

4.9/5

8.9k+reviews

3M+

active installation

Tested with

7.1.3

Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content

By Saad Iqbal

WPS

7.19

Very Good

4.4/5

141+reviews

300k+

active installation

Tested with

7.0.7

Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More

By AAM Plugin

WPS

6.95

Average

4.2/5

420+reviews

100k+

active installation

Tested with

7.1.3

My Private Site

By David Gewirtz

WPS

Average

4.5/5

82+reviews

10k+

active installation

Tested with

7.1.3

.htaccess Site Access Control

By Miina Sikk

WPS

6.71

Average

4/5

3+reviews

800+

active installation

Tested with

4.4.34

Restricted Site Access Review - In-Depth Analysis

Performance Overview

What It Does

Comparing to Alternatives

User Sentiment Analysis

Who Should Use This?

Pricing & Value

Final Verdict

Other Notable Features

Screenshots

FAQ

Contributors and developers

Ratings

Reviews (62)

Sort by:

Contributors & Developers

Interested in development?

Changelog

Security Status

Secure

No Unpatched Vulnerabilities

Known Vulnerabilities (2)

Previous Versions

WPS

7.13

Other plugins you might like

Wordfence Security – Firewall, Malware Scan, and Login Security

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content

Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More

My Private Site

.htaccess Site Access Control