Protect Access to Specific URLs in Your WordPress Site

Paid Memberships Pro can protect almost everything in your WordPress site without any custom code. But there are some rare cases where a URL is generated in the WordPress site, but it isn’t a post you can actually edit.

In this case, you need custom code to protect access to the specific URL.

This tutorial gives you a very simple-to-edit code recipe that blocks access to the URL and redirects visitors and non-members to your pricing page.

What Kind of URLs?

The best example of a “URL you can’t edit” is the archive view of a post category, post tag, or even a custom post type, like “Recipes” or “Videos”.

Other plugins also add these magical pages that you can certainly link to, but aren’t an actual, editable post in your site.

Some examples include the shop page in your eCommerce plugin, an automatic “All Downloads” page in your file management plugin, or even an “All Events” list view from your favorite events plugin.

How it Works

This tutorial is very specific: give the code a URL string for something in WordPress. Everyone without a membership level OR people that are not logged in get redirected to the Membership Levels page.

Search bots and web crawlers are also redirected when you use this code. This means that the content on the page will never be crawled or indexed in search.

And before I get to the code—there is one final benefit or feature in the way this function works. The function protects ANY content that has the included string in the URL. This means that you can use a single function and protect the entire tree of content within that URL structure. For example, if you protect the URL /recipes/, this code also protects every URL like /recipes/cake/ and /recipes/muffins/.

Think of the code as a short-circuit to protecting the entire tree of subpages.

About the Code Recipe

The code below uses two primary functions:

• pmpro_hasMembershipLevel: This function checks if the current logged in user has a membership level.
• wp_redirect: This core WordPress function triggers before any on-page content is loaded. When wp_redirect is run, the browser is immediately taken to the new target URL and will not see anything on the original destination URL.

To make this code work for your site, edit the $not_allowed array on lines 32-34 with each URL string to protect.

The Code Recipe (PHP)

Adding the Recipe to Your Website

You can add this recipe to your site by creating a custom plugin or using the Code Snippets plugin available for free in the WordPress repository. Read this companion article for step-by-step directions on either method.

Changing the Redirect Priority 

This function runs on the WordPress template_redirect hook: the last possible hook that runs before the page is displayed.

There may be cases where you want to run this redirect earlier, depending on whether you want other WordPress core or plugin-enabled features to run or be blocked.

To adjust the function’s priority, change line 49 to another WordPress hook, such as the init hook which looks like this:

add_action( 'init', 'my_redirect_nonmembers', 1 );

Extending This Code Recipe

You can extend in loads of ways. Some examples include:

• Check for one or more specific level IDs on line 26.
• Build multiple loops of level ID requirements and restricted URLs for tiered access.
• Update the redirected URL based on level ID.

For more help customizing the function for your unique needs, please reach out to our technical support team.