如何将WordPress安全机制扩展至独立子目录？

Sure thing! You absolutely can lock down a specific subdirectory in your WordPress site to only logged-in users. Below are two solid approaches—one using .htaccess for server-level security, and another using WordPress core code for more flexible control. Let’s break them down:

This is a fast, broad solution that covers even static files (like PDFs, images, or static HTML) in your target subdirectory. Here’s how to set it up:

1. Locate your site’s root .htaccess file (usually in the same folder as wp-config.php).
2. Add the following rule at the top of the file (before any existing WordPress rewrite rules):

# Restrict access to /members-only subdirectory
RewriteEngine On
RewriteBase /

# Redirect unlogged users to login page
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_[0-9a-f]+=.*$ [NC]
RewriteRule ^members-only/(.*)$ /wp-login.php?redirect_to=%{REQUEST_URI} [L,R=302]

What this does: #

• It checks if the visitor doesn’t have a WordPress logged-in cookie (these always start with wordpress_logged_in_).
• If they’re not logged in, it redirects them to the WordPress login page, and sends them back to the restricted page once they successfully log in.
• Replace /members-only/ with your actual subdirectory path (e.g., /vip-content/).

Pro tip for static files: #

If you want to exclude certain file types (like public images) from the restriction, add an extra condition before the RewriteRule:

# Allow access to JPG/PNG files in the restricted directory
RewriteCond %{REQUEST_URI} !\.(jpg|png)$ [NC]

This approach is more flexible—great if you want to restrict access to specific user roles, or add custom logic beyond just "logged in vs not logged in".

Add this code to your theme’s functions.php file (or better yet, a custom plugin, so your changes don’t get lost when you update your theme):

function restrict_members_only_directory() {
    // Define your protected subdirectory
    $protected_dir = '/members-only/';
    
    // Check if request is for the protected directory AND user is not logged in
    if (strpos($_SERVER['REQUEST_URI'], $protected_dir) !== false && !is_user_logged_in()) {
        // Redirect to login page, with a return to the requested URL
        wp_redirect(wp_login_url($_SERVER['REQUEST_URI']));
        exit;
    }
}
// Hook into WordPress before page loads
add_action('template_redirect', 'restrict_members_only_directory');

Customize for user roles: #

If you want to restrict access to only certain roles (e.g., only editors or subscribers), replace !is_user_logged_in() with a role check:

// Restrict to only subscribers or higher
if (strpos($_SERVER['REQUEST_URI'], $protected_dir) !== false && !current_user_can('subscriber')) {
    wp_redirect(wp_login_url($_SERVER['REQUEST_URI']));
    exit;
}

• Backup first: Always save a copy of your .htaccess file before editing it—one typo can cause a 500 server error.
• Caching: If you use a caching plugin, exclude your members-only directory from caching. Unlogged users might see cached versions of restricted pages otherwise.
• Static files vs WP pages: The .htaccess method covers all files in the directory, while the code method only works for WordPress-generated pages. If your subdirectory has both, combine both approaches.

内容的提问来源于stack exchange，提问作者C-Sway