WordPress：如何阻止登出用户返回wp-admin页面？含缓存禁用/重定向方案

Great question! Let's break this down into actionable steps that address both direct wp-admin access attempts and the browser back button scenario you mentioned. Disabling admin page caching is part of the solution, but we also need to enforce server-side checks and adjust browser caching behavior to make this solid.

1. 后端强制权限验证（核心解决方案） #

WordPress allows unauthenticated users to hit wp-admin by default, but we can add a server-side check to redirect them to the login page immediately. This works for direct URL attempts and will trigger when the browser re-requests the page (fixing the back button issue).

Add this code to your theme's functions.php file or a custom plugin:

function restrict_admin_access() {
    // 排除登录页面本身，避免重定向循环
    if ( !is_user_logged_in() && is_admin() && !wp_doing_ajax() && !str_contains( $_SERVER['REQUEST_URI'], 'wp-login.php' ) ) {
        wp_redirect( wp_login_url() );
        exit;
    }
}
add_action( 'admin_init', 'restrict_admin_access' );

This hook runs when the admin area initializes, checks if the user is logged in, and redirects unauthenticated users to the login page. The wp_doing_ajax() check ensures we don't break AJAX requests that might be needed for public-facing features.

2. 禁止浏览器缓存wp-admin页面（解决返回按钮问题） #

The browser back button issue occurs because browsers cache previously loaded pages. If we tell the browser not to cache wp-admin pages, hitting back will force it to re-request the page, triggering our server-side redirect above.

Add this code snippet to handle caching headers:

function disable_admin_caching() {
    if ( is_admin() && !is_user_logged_in() ) {
        header( 'Cache-Control: no-cache, no-store, must-revalidate' ); // HTTP 1.1
        header( 'Pragma: no-cache' ); // HTTP 1.0
        header( 'Expires: 0' ); // Proxies
    }
}
add_action( 'admin_init', 'disable_admin_caching' );

This sets headers that tell browsers and proxies not to store a cached version of the admin page when the user is logged out. For logged-in users, we leave caching behavior as-is to avoid performance hits.

3. 调整缓存插件设置（如果使用缓存工具） #

If you're using a caching plugin like WP Rocket, W3 Total Cache, or LiteSpeed Cache, make sure to exclude the /wp-admin/ path from being cached. Most plugins have an "Exclude Paths" or "Do Not Cache URLs" setting where you can add /wp-admin/* to prevent cached versions of admin pages from being served to unauthenticated users.

为什么仅禁用admin缓存不够？ #

Disabling admin caching helps, but it doesn't prevent unauthenticated users from accessing the admin area directly if we don't have the server-side redirect. The combination of server-side checks + caching controls ensures that even if someone tries to access wp-admin directly or uses the back button, they're always sent to the login page when logged out.

内容的提问来源于stack exchange，提问作者Rahul Sahni