KW Members Fortress
·
Make your whole WordPress site private — every page, feed, REST endpoint and uploaded file requires login — and prove it isn't leaking.
KW Members Fortress turns a standalone WordPress site into a private, members-only space. Visitors who aren’t logged in can’t reach anything except the login screen and the legal pages you choose to publish — not your pages, posts, archives, search, feeds, REST API, sitemaps, XML-RPC, and crucially not your uploaded files either.
Most “force login” plugins only gate the pages WordPress renders. They leave every file in /wp-content/uploads/ reachable by anyone who has (or guesses) the URL — PDFs, images, documents. KW Members Fortress routes those file requests through WordPress and serves them only to logged-in members, then continuously self-tests that the seal is holding.
What it does
- Whole-site gate — logged-out requests are redirected to login: pages, posts, archives, search, feeds, REST, sitemaps, XML-RPC.
- Protected file URLs — direct hits to
/wp-content/uploads/…are served only to members (Apache/LiteSpeed handled automatically; nginx shows you the one snippet to paste). - Leak self-test (canary) — about once an hour the plugin makes a cookie-less request to one of its own upload URLs and raises a dashboard alarm if a file ever comes back without login. Silent misconfiguration becomes a visible warning.
- Branded login screen — set a background image, overlay colour/gradient, accent colour, and logo from the settings page. No file editing.
- Footer & legal pages — up to three footer items, each a built-in page (rendered theme-less and reachable while logged out) or an external link. Perfect for an Imprint / Privacy notice on an otherwise-private site.
- Hardening (all optional, on by default) — block logged-out admin-ajax, block user-enumeration, no-cache headers on blocked responses, and a progressive login throttle that auto-recovers.
Good to know
- No accounts, tiers, payments, or third-party services. One site, one membership wall.
- Runtime files are stored under
…/wp-content/uploads/kw-members-fortress/— never in the plugin folder. - The leak self-test only ever contacts your own site’s URL; it is not an external service.