by
10up
4.8 (62 reviews)
Restricted Site Access
Limit access to visitors who are logged in or allowed by IP addresses. Includes many options for handling blocked visitors.
Restricted Site Access ranks #1,454 among WordPress.org plugins with 10,000+ active installations, is #154 of 4,518 in the Security category, a 4.8/5 rating from 62 reviews, and was last updated Aug 27, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Compatible with WP 7.1
v7.6.2
Current Version v7.6.2
Updated 2 weeks ago
Last Update on 27 Aug, 2026
Refreshed 6 hours ago
Last Refreshed on
#154 of 4,518 in Security
Top 5% by installs
Downloads -25.7% this week
Actively maintained
Rank
#1,454
+2 this week
Active Installs
10K+
-48.6%
KW Avg Position
53.2
0.2 worse
Downloads
1.1M
+193 today
Support Resolved
100%
—
No change
Rating
96%
Review 4.8 out of 5
4.8
(62 reviews)
Next Milestone 20K
10K+
20K+
34
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 424 more installs to reach 20K+
Rank Changes
Current
#1,454
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
4.8
62 reviews
Overall
96%
5
57
(92%)
4
2
(3%)
3
0
(0%)
2
1
(2%)
1
2
(3%)
Support Threads Overview
Resolved
Unresolved
1
Total Threads
1
Resolved
0
Unresolved
100%
Resolution Rate
Security History
Source: WPVulnerability2 known vulnerabilities on record · 0 in the last 24 months · checked 1 week ago
-
Restricted Site Access [restricted-site-access] < 7.5.0
CVE-2023-48753 · Fixed in v7.5.0
-
Restricted Site Access [restricted-site-access] < 7.3.2
CVE-2022-1613 · Fixed in v7.3.2
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 7.6.2
- Last Updated
- Aug 27, 2026
- Requires WP
- 6.9+
- Tested Up To
- 7.1
- PHP Version
- 7.4 or higher
- Author
- 10up
Support & Rating
- Rating
- ★ ★ ★ ★ ★ 4.8
- Reviews
- 62
- Support Threads
- 1
- Resolved
- 100%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,756
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,007
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#38
TL;DR
AI summary of the plugin's readmeThis plugin is for site owners who need to restrict access to their WordPress site to logged-in users or specific IP addresses, such as for extranets, intranets, or staging sites. It solves the problem of unauthorized visitors accessing the site by letting admins block, redirect, or display messages to restricted visitors.
- Enable or disable site restriction
- Restrict by login or IP address
- Add IP ranges to allowlist
- Quickly add current IP
- Redirect blocked visitors
- Custom HTTP status codes
- Display custom message to visitors
- Select a page to display
Frequently Asked Questions
Common questions about Restricted Site Access
Restricted Site Access settings are added to the Reading page, with WordPress’s built in site privacy options. (It was moved there from a separate Privacy settings page in 3.5.) It’s not working! My site is wide open! Most commonly, Restricted Site Access is not compatible with some page caching solutions. While the plugin hooks in as early as it can to check visitor permissions, its important to understand that some page caching plugins generate static output that prevents plugins like Restricted Site Access from ever checking individual visitors. To the extent that sites blocked by this plugin should not need to concern themselves with high scale front end performance, we strongly recommend disabling any page caching solutions while restricting access to your site. Keep in mind that most page caching plugins do not cache the “logged in” experience, anyhow. Also note that the plugin is fully compatible with other caching layers, like the WordPress object cache.
Developers can use the restricted_site_access_is_restricted filter to override normal restriction behavior. Note that restriction checks happen before WordPress executes any queries; it passes the query request from the global $wp variable so developers can investigate what the visitor is trying to load. For instance, to unblock an RSS feed, place the following PHP code in the theme's functions.php file or in a simple plug-in: add_filter( 'restricted_site_access_is_restricted', 'my_rsa_feed_override', 10, 2 ); function my_rsa_feed_override( $is_restricted, $wp ) { // check query variables to see if this is the feed if ( ! empty( $wp->query_vars['feed'] ) ) { $is_restricted = false; } return $is_restricted; }
Visitors that are not logged in or allowed by IP address will not be able to browse your site (though be cautious of page caching plugin incompatibilities, mentioned above). Restricted Site Access does not block access to your "real" files, so direct links to files in your media and uploads folder (for instance) are not blocked. It is also important to remember that IP addresses can be spoofed. Because Restricted Site Access runs as a plug-in, it is subject to any other vulnerabilities present on your site. Restricted Site Access is not meant to be a top secret data safe, but simply a reliable and convenient way to handle unwanted visitors. In 7.3.2, two new filters were added that can be utilized to help prevent IP spoofing attacks. The first filter allows you to set up a list of approved proxy IP addresses and the second allows you to set up a list of approved HTTP headers. For any sites that were using Restricted Site Access prior to version 7.5.0, a handful of HTTP headers are trusted by default. To change this, utilize the rsa_trusted_headers filter to modify the HTTP headers you want to trust. If your site is not running behind a proxy, we recommend doing the following: add_filter( 'rsa_trusted_headers', '__return_empty_array' ); This will then only use the REMOTE_ADDR HTTP header to determine the IP address of the visitor. This header can't be spoofed, so this will increase security. Note that this is now the default for all new installs since version 7.5.0. If your site is running behind a proxy (like a CDN), you usually can't rely on the REMOTE_ADDR HTTP header, as this will contain the IP address of the proxy, not the user. If your proxy uses static IP addresses, we recommend using the rsa_trusted_proxies filter to set those trusted IP addresses: add_filter( 'rsa_trusted_proxies', 'my_rsa_trusted_proxies' ); function my_rsa_trusted_proxies( $trusted_proxies = array() ) { // Set one or more trusted proxy IP addresses. $proxy_ips = array( '10.0.0.0/24', '10.0.0.0/32', ); $trusted_proxies = array_merge( $trusted_proxies, $proxy_ips ); return array_unique( $trusted_proxies ); } And then use the rsa_trusted_headers filter to set which HTTP headers you want to trust. Consult with your proxy provider to determine which header(s) they use to hold the original client IP: add_filter( 'rsa_trusted_headers', 'my_rsa_trusted_headers' ); function my_rsa_trusted_headers( $trusted_headers = array() ) { // Set one or more trusted HTTP headers. $headers = array( 'HTTP_X_FORWARDED', 'HTTP_FORWARDED', ); return $headers; } If your proxy does not use static IP addresses, you can still utilize the rsa_trusted_headers filter to change which HTTP headers you want to trust.
As of version 7.6.0, RSA attempts to prevent full page caching on sites with an IP address allow list. This is to prevent the page content from being stored at the caching level and displayed to unauthorized visitors. Page caching plugins often hook into WordPress to quickly serve the last cached output of a page before we can check to see if a visitor’s access should be restricted. Not all page caching plugins behave the same way, but several solutions – including external solutions we might not detect – can ignore the no-caching headers set by WordPress and show cached content to unauthorized users.
In 6.2.0, the behavior in a multisite install changed from allowing any logged-in user to see a site to checking their role for that specific site. This is a safer default given the varying ways multisite is used; however, if you would prefer to rely on the previous behavior rather than explicitly adding users to each site, place the following PHP code in the theme's functions.php file or in a simple plug-in: add_filter( 'restricted_site_access_user_can_access', 'my_rsa_user_can_access' ); function my_rsa_user_can_access( $access ) { if ( is_user_logged_in() ) { return true; } return $access; }
As of version 7.0.0, CLI integration has been added. To see the available commands, type the following in your WordPress directory: $ wp rsa
In 7.0.0, the capacity to define a pipe delimited array of whitelisted IP addresses via constant was introduced. In your wp-config.php file, you can define the following: define( 'RSA_IP_WHITELIST', '192.0.0.1|192.0.0.10' ); In 7.1.1, the capacity to programmatically add / remove / set access IPs programmatically was introduced. The following are valid statements: Set IPs, ignoring all stored values (but not the constant defined values), if you're going to use the approach with array indices rather than mixing the two. Restricted_Site_Access::set_ips( array( '192.168.0.1', '192.168.0.2', '192.168.0.3' ) ); Restricted_Site_Access::set_ips( array( 'labelfoo' => '192.168.0.1', 'labelbar' => 192.168.0.2', 'labelbaz' => 192.168.0.3' ) ); Add IPs, if they're not already added. Restricted_Site_Access::append_ips( array( '192.168.1.5' => 'five', '192.168.1.6' => 'six' ) ); Remove IPs, if they are in the list. Restricted_Site_Access::remove_ips( array( '192.168.1.2','192.168.1.5','192.168.1.6', ) );
As of version 7.1.0, two constants were introduced that give you the ability to specify if the site should be in restricted mode. You can force the plugin to be in restricted mode by adding the following to your wp-config.php file: define( 'RSA_FORCE_RESTRICTION', true ); Or to ensure your site won't be in restricted mode: define( 'RSA_FORBID_RESTRICTION', true ); Make sure you add it before the /* That's all, stop editing! Happy blogging. */ line. Please note that setting RSA_FORCE_RESTRICTION will override RSA_FORBID_RESTRICTION if both are set.
When this option is activated, it serves as a barrier to all visitors except those who are authenticated (logged in) or whose IP addresses are included in the 'Unrestricted IP addresses' setting. This restriction applies universally, even to automated crawlers such as search engines.
Please report security bugs found in the source code of the Restricted Site Access plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
