Initial Set-Up

After installation, set up a No Access Page. This is where visitors are redirected when they cannot view a page.

1. Go to Deadbolt > Settings.
2. In the General box, click Create Page. This creates a page with the [deadbolt] shortcode and selects it for you. You can also select an existing page, as long as its content includes the shortcode.
3. Click Save (or press Ctrl+S).

The Create Page button disappears once a page is selected. Visitors are only redirected after a published No Access Page is selected. Until then, restricted content stays viewable when visited directly.

The No Access Page is always visible to everyone, so you cannot restrict it.

Settings

Go to Deadbolt > Settings.

General

• No Access Page: The page visitors are redirected to. It must include the [deadbolt] shortcode, which displays the matching template (see Templates below).
• Login URL: Used by the login merge tags. Leave blank to use the default WordPress login page. After logging in, visitors are sent back to the page they tried to view.
• Register URL: Used by the register merge tags. Leave blank to use the default WordPress registration page.
• Administrators Bypass Restrictions: Lets users who can manage options view all restricted content, including in menus, searches and feeds. When unchecked, administrators follow the same rules as everyone else. Turn this off while testing.
• Show Templates in the Access Column: Lists the templates each restricted post will show in the Access column of the post list, with unique templates marked.

Hide Restricted Content

Restricted content is always protected when visited directly. These options also remove it from lists for anyone who cannot view it. See Hiding Restricted Content below. Every option except XML Sitemaps is on by default.

Post Types

• Enabled: Turn on access controls for each post type.
• Default Access: The access that post type uses unless a post says otherwise. Options are Everyone, Logged-In Only, Logged-Out Only and URL Parameter.

Roles

• Roles Available in Access Controls: Choose which roles can be selected when limiting Logged-In Only content, menu items and templates.

Advanced

• Remove All Plugin Data on Uninstall: Permanently deletes all Deadbolt settings, templates, menu rules and the access rules saved on your posts when the plugin is deleted. Keep this unchecked until you are ready to uninstall it permanently.
• Download/Upload Settings: Export the settings as a JSON file for backup or to copy to another site. Templates and the access rules on your posts are not included. Importing overwrites your current settings.
• Import from Nav Menu Roles: Only shown while the Nav Menu Roles plugin is active. Copies its menu item rules, turns on Navigation Menus and deactivates Nav Menu Roles. Its own data is left untouched.
• Import Earlier Data: Only shown when data from Restricted Page Templates or Role Visibility is found. See Moving from Restricted Page Templates or Role Visibility below.
• Reset Settings: Resets every option on the Settings tab to its default. Templates and the access rules on your posts are never touched.

Changing the Access for a Post or Page

Go to Posts, Pages, or any post type you enabled. The Access column shows the current access. You can change it from Quick Edit or Bulk Edit, or by editing the post and using the Access box in the sidebar.

• Who should have access? Options are Default (the post type’s default from Settings), Everyone, Logged-In Only, Logged-Out Only and URL Parameter.
• Logged-In Only: If you choose no roles or users, anybody who is logged in can view the page. Otherwise, only the roles you select, plus any specific users you add, have access.
• Limit to roles: Choose from the roles you made available in Settings.
• Limit to specific users: Search for and add individual users.
• Logged-Out Only: Only logged-out visitors can view the page. This is mostly used for login and registration pages.
• URL Parameter: Visitors can view the page only when the link they arrive with matches your rule, whether or not they are logged in. See URL Parameter Access below.

Under the access fields, a Templates in use list shows which template is displayed in each situation. It updates as you change the access, before you save. Click Create a unique template for this post to make a template for just that post. The link is hidden when templates made only for that post already cover it.

URL Parameter Access

URL Parameter opens a page only for links that carry the right parameter, such as ?id=123. Choose it as a post’s access, in Quick Edit or Bulk Edit, or as a post type’s Default Access. Then fill in:

• Parameter: The name in the link, such as id.
• Condition: is, is not, contains, does not contain, starts with, ends with, is greater than, or is less than.
• Value: What to compare against. Leave it blank to compare with empty.

A missing parameter counts as empty, and comparisons ignore upper and lower case. Greater than and less than only work with numbers. WordPress query names, such as p, s and page_id, can’t be used as the parameter.

Examples:

• id is not with no value: the page only opens for links that include an id.
• id is with no value: the page only opens for links without an id.
• ref is email: the page only opens for links that include ref=email.

Visitors whose link doesn’t match are sent to the No Access Page, where the “Link does not match the URL Parameter rule” template is shown. The visitor’s parameters are kept on the way, and they are sent back to the page they wanted after logging in.

In archives, search, feeds, sitemaps and menus, links carry no parameters, so URL Parameter content is checked as a link without any.

Templates

The messages visitors see are Templates. Go to Deadbolt > Templates. Four default templates are created on activation, and you edit them in the block editor like any page. You can add as many more as you need.

When a template is used

In the Template Settings box, Applies When chooses the situation:

• Visitor must log in: The page is Logged-In Only and the visitor is logged out.
• User lacks the required role or user: The visitor is logged in but is not one of the allowed roles or users.
• Logged-in user on a logged-out-only page: The page is Logged-Out Only and the visitor is logged in.
• Link does not match the URL Parameter rule: The page uses URL Parameter access and the visitor’s link doesn’t match.

Scope chooses where the template applies:

• Global: Every restricted page.
• Post Types: The post types you check.
• Specific Posts: Individual posts and pages you search for and add. By default, the template follows each post’s Access setting and shows to whoever that post blocks. You can instead limit it to certain situations.

The most specific match is shown: Specific Posts, then Post Types, then Global. If two templates tie, the most recently modified one wins. A template with no Applies When option checked is not used.

The Templates list has All, Published and other status links, a search box, and a per-page setting. If you delete all of the default templates, a notice offers to restore them.

Merge tags

Use merge tags anywhere in a template. The Merge Tags box on the template screen lists them with a copy button.

• {login_link}, {login_url}
• {logout_link}, {logout_url}
• {register_link}, {register_url}
• {retry_link}, {retry_url}
• {home_link}, {home_url}
• {post_title}: the title of the restricted page
• {post_url}: the URL of the restricted page
• {required_roles}: the roles that can view the page
• {user_display_name}: the current user’s display name
• {site_name}

The link tags output a complete link. The URL tags output only the address, for use in buttons or your own links.

Hiding Restricted Content

In Deadbolt > Settings > Hide Restricted Content, choose where restricted content is removed for anyone who cannot view it:

• Archives, Blog and Post Lists: Category, tag, date and author archives, the blog page, and front-end post lists, including Query Loop blocks and most page builder post widgets.
• Search Results: Front-end search results.
• RSS Feeds: Feed readers are not logged in, so feeds only include content that logged-out visitors can view.
• REST API: Lists and single items. Requests made by the block editor while editing are not affected.
• Navigation Menus: Adds visibility controls to menu items. See Navigation Menus below.
• Previous/Next Post Links: Skips restricted posts. Themes that build these links with their own queries may not be affected.
• XML Sitemaps: Removes content that logged-out visitors cannot view from the WordPress core sitemap and from Yoast SEO, Rank Math, All in One SEO and SEOPress sitemaps. Clear your SEO plugin’s sitemap cache after changing access rules.

Navigation Menus

With Navigation Menus on, each menu item in Appearance > Menus, and each link in the Navigation block, gets a Who can see this link? option.

• Match linked content: For items that link to a post or page, the item is hidden whenever the visitor cannot view the linked content.
• Everyone, Logged-In Only, Logged-Out Only: Set it manually, which is useful for custom links.
• Limit to roles: Available with Logged-In Only.

If you use the Nav Menu Roles plugin, click Import Menu Rules under Deadbolt > Settings > Advanced while it is still active.

Testing

Test access to your pages to be sure visitors see what you want.

If something still appears, clear your caching plugin, host cache and CDN. Feeds and sitemaps are commonly cached.

Turn off Administrators Bypass Restrictions while testing, or use a private window or a different browser to view the site logged out.

Visit a restricted page directly and confirm you are redirected to the No Access Page with the correct template.

Check the lists you turned on: the blog and archives, search, /feed/, /wp-json/wp/v2/posts, and your sitemap.

Log in with a test user for each role you restrict by.

Pages Overview

Go to Deadbolt > Pages. A table counts the content in each post type with access controls: how many posts are Logged-In Only, Logged-Out Only, URL Parameter and Everyone, plus the post type’s default access.

Click a post type to expand it. It lists every restricted post with its access and the templates blocked visitors will see for it. Templates made for just that post are marked Unique. Long lists load 50 at a time, with a Load More button.