WP-Members allowing pages to be accessed via Google to logged out people
-
I have the WP-Members plugin, but today a user alerted me that they were able to access both https://thehartwoodclub.org/category/minutes/ page, this document from our media directory https://thehartwoodclub.org/wp-content/uploads/2013/11/HWCMinutes11-3-13.pdf and also the blog page https://thehartwoodclub.org/news-events/page/3/ –all are still visible to logged out users, and shouldn’t be. Actually, any url that matches a post category on the site is accessible via a link that reads https://thehartwoodclub.org/category/***SampleCategoryName***/ While most people on earth would die of boredom if they accessed these files, we’d prefer to keep everything on the site private except to logged on users.
How is this happening, and how can I put a stop to it?
-
This is due to the way you have things set up, combined with an expectation that is outside of the plugin’s normal setup. The “pages” you have indicated (https://thehartwoodclub.org/category/***SampleCategoryName***/) are not “pages” in the WordPress sense of the term. They are archive templates. WP-Members does not restrict these.
There is more information here:
https://rocketgeek.com/plugins/wp-members/docs/faqs/#blockAlso see the heading “Archives and the Read More Tag” here:
https://rocketgeek.com/blog/how-the-plugin-handles-blocking-content/The wpmem_redirect_to_login() API function can be used to redirect users away from these types of pages and force them to log in:
https://rocketgeek.com/plugins/wp-members/docs/api-functions/wpmem_redirect_to_login/You may also want to go through the initial setup video as this is explained in there as well:
https://rocketgeek.com/plugins/wp-members/docs/videos/As for documents (or anything else) showing up in Google, if you had this content available prior to installing the plugin, anything that Google indexed previously would still be there.
Also, while you can put a document behind the login which would prevent users (and bots/spiders) from accessing it, if the link is known, the file can be directly accessed. The plugin only handles what is in WP’s post content. A direct link is completely different from that. There is a premium extension available for handling downloadable files that prevents them from being accessed without being logged in:
https://rocketgeek.com/plugins/wp-members/extensions/download-protect/
- The topic ‘WP-Members allowing pages to be accessed via Google to logged out people’ is closed to new replies.
