Restricted Site Access

FAQ

¿Dónde cambio los ajustes de las restricciones?

Los ajustes de Restricted Site Access se añaden a la página de Lectura, con las opciones nativas de WordPress de privacidad. (Fue movido aquí desde una página independiente de ajustes de Privacidad en la versión 3.5.)

¡No funciona! ¡Mi sitio es totalmente accesible!

Normalmente, Restricted Site Access no es compatible con algunas soluciones de caché de páginas. Si bien el plugin se engancha lo antes posible para verificar los permisos de los visitantes, es importante entender que algunos plugins de caché de páginas generan resultados estáticos que evitan que los plugins, como Restricted Site Access, puedan comprobar los visitantes individuales.

En la medida en que los sitios bloqueados por este plugin no deberían preocuparse por el alto rendimiento en en la parte pública, recomendamos encarecidamente deshabilitar las soluciones de almacenamiento en caché de páginas mientras se restringe el acceso a tu sitio. Ten en cuenta que de todos modos la mayoría de los complementos de caché de páginas no almacenan en caché las opciones de «conectado». También ten en cuenta que el plugin es totalmente compatible con otras capas de almacenamiento en caché, como la memoria caché de objetos de WordPress.

¿Cómo permito el acceso a páginas específicas o partes de mi sitio?

Los desarrolladores pueden usar el filtro restricted_site_access_is_restricted para anular el comportamiento de restricción normal. Ten en cuenta que las comprobaciones de restricción suceden antes de que WordPress ejecute cualquier consulta; pasa la solicitud de consulta de la variable global $wp para que los desarrolladores puedan investigar qué está intentando cargar el visitante.

Por ejemplo, para desbloquear una feed RSS, coloca el siguiente código PHP en el archivo functions.php del tema o en un simple plugin:

add_filter( 'restricted_site_access_is_restricted', 'my_rsa_feed_override', 10, 2 );

function my_rsa_feed_override( $is_restricted, $wp ) {
    // check query variables to see if this is the feed
    if ( ! empty( $wp->query_vars['feed'] ) ) {
        $is_restricted = false;
    }
    return $is_restricted;
}

¿Cómo de seguro es este plugin?

Los visitantes que no están conectados o permitidos por una dirección IP no podrán navegar por tu sitio (pero ten cuidado con las incompatibilidades de los plugins del almacenamiento en caché de página, mencionados anteriormente). Restricted Site Access no bloquea el acceso a, enlaces directos a los archivos en la carpeta de medios y cargas (por ejemplo). También es importante recordar que las direcciones IP pueden ser falsificadas. Debido a que Restricted Site Access se ejecuta como un plugin, está sujeto a cualquier otra vulnerabilidad presente en tu sitio.

Restricted Site Access no está destinado a ser una caja fuerte de datos secretos, sino simplemente una forma confiable y conveniente de manejar visitantes no deseados.

In 7.3.2, two new filters were added that can be utilized to help prevent IP spoofing attacks. The first filter allows you to set up a list of approved proxy IP addresses and the second allows you to set up a list of approved HTTP headers. For any sites that were using Restricted Site Access prior to version 7.5.0, a handful of HTTP headers are trusted by default. To change this, utilize the rsa_trusted_headers filter to modify the HTTP headers you want to trust. If your site is not running behind a proxy, we recommend doing the following:

add_filter( 'rsa_trusted_headers', '__return_empty_array' );

This will then only use the REMOTE_ADDR HTTP header to determine the IP address of the visitor. This header can’t be spoofed, so this will increase security. Note that this is now the default for all new installs since version 7.5.0.

If your site is running behind a proxy (like a CDN), you usually can’t rely on the REMOTE_ADDR HTTP header, as this will contain the IP address of the proxy, not the user. If your proxy uses static IP addresses, we recommend using the rsa_trusted_proxies filter to set those trusted IP addresses:

add_filter( 'rsa_trusted_proxies', 'my_rsa_trusted_proxies' );

function my_rsa_trusted_proxies( $trusted_proxies = array() ) {
  // Set one or more trusted proxy IP addresses.
  $proxy_ips       = array(
    '10.0.0.0/24',
    '10.0.0.0/32',
  );
  $trusted_proxies = array_merge( $trusted_proxies, $proxy_ips );

  return array_unique( $trusted_proxies );
}

And then use the rsa_trusted_headers filter to set which HTTP headers you want to trust. Consult with your proxy provider to determine which header(s) they use to hold the original client IP:

add_filter( 'rsa_trusted_headers', 'my_rsa_trusted_headers' );

function my_rsa_trusted_headers( $trusted_headers = array() ) {
  // Set one or more trusted HTTP headers.
  $headers = array(
    'HTTP_X_FORWARDED',
    'HTTP_FORWARDED',
  );

  return $headers;
}

If your proxy does not use static IP addresses, you can still utilize the rsa_trusted_headers filter to change which HTTP headers you want to trust.

He recibido una advertencia sobre la caché de página. ¿Qué significa?

As of version 7.6.0, RSA attempts to prevent full page caching on sites with an IP address allow list. This is to prevent the page content from being stored at the caching level and displayed to unauthorized visitors.

Page caching plugins often hook into WordPress to quickly serve the last cached output of a page before we can check to see if a visitor’s access should be restricted. Not all page caching plugins behave the same way, but several solutions – including external solutions we might not detect – can ignore the no-caching headers set by WordPress and show cached content to unauthorized users.

Why can’t logged-in users see all the sites on my multisite instance?

In 6.2.0, the behavior in a multisite install changed from allowing any logged-in user to see a site to checking their role for that specific site. This is a safer default given the varying ways multisite is used; however, if you would prefer to rely on the previous behavior rather than explicitly adding users to each site, place the following PHP code in the theme’s functions.php file or in a simple plug-in:

add_filter( 'restricted_site_access_user_can_access', 'my_rsa_user_can_access' );

function my_rsa_user_can_access( $access ) {
    if ( is_user_logged_in() ) {
        return true;
    }

    return $access;
}

Is there a way to configure this with [WP-CLI](https://make.wordpress.org/cli/)?

As of version 7.0.0, CLI integration has been added. To see the available commands, type the following in your WordPress directory:

$ wp rsa

How can I programatically define whitelisted IPs?

In 7.0.0, the capacity to define a pipe delimited array of whitelisted IP addresses via constant was introduced.

In your wp-config.php file, you can define the following:

define( 'RSA_IP_WHITELIST', '192.0.0.1|192.0.0.10' );

In 7.1.1, the capacity to programmatically add / remove / set access IPs programmatically was introduced.

The following are valid statements:

Set IPs, ignoring all stored values (but not the constant defined values), if you’re going to use the approach with array indices rather than mixing the two.

Restricted_Site_Access::set_ips( array( '192.168.0.1', '192.168.0.2', '192.168.0.3' ) );
Restricted_Site_Access::set_ips( array( 'labelfoo' => '192.168.0.1', 'labelbar' => 192.168.0.2', 'labelbaz' => 192.168.0.3' ) );

Add IPs, if they’re not already added.

Restricted_Site_Access::append_ips( array( '192.168.1.5' => 'five', '192.168.1.6' => 'six' ) );

Remove IPs, if they are in the list.

Restricted_Site_Access::remove_ips( array( '192.168.1.2','192.168.1.5','192.168.1.6', ) );

Is there a constant I can set to ensure my site is (or is not) restricted?

As of version 7.1.0, two constants were introduced that give you the ability to specify if the site should be in restricted mode.

You can force the plugin to be in restricted mode by adding the following to your wp-config.php file:

define( 'RSA_FORCE_RESTRICTION', true );

Or to ensure your site won’t be in restricted mode:

define( 'RSA_FORBID_RESTRICTION', true );

Make sure you add it before the /* That's all, stop editing! Happy blogging. */ line.

Please note that setting RSA_FORCE_RESTRICTION will override RSA_FORBID_RESTRICTION if both are set.

What does ‘Discourage search engines from indexing this site’ do?

When the ‘Discourage search engines from indexing this site’ option is enabled, it prevents search engines from indexing the site while still permitting access to regular visitors.

What does ‘Restrict site access to visitors who are logged in or allowed by IP address’ do?

When this option is activated, it serves as a barrier to all visitors except those who are authenticated (logged in) or whose IP addresses are included in the ‘Unrestricted IP addresses’ setting. This restriction applies universally, even to automated crawlers such as search engines.