CFB Must Login

What it does

CFB Must Login puts an entire WordPress site behind the login screen. Visitors who aren’t logged in are sent to log in, then taken back to the page they were trying to reach.

It’s for sites that shouldn’t be public: a staging site waiting on sign-off, a company intranet, a members-only community, or a family blog.

The details that matter

• One switch. Turn protection on or off from the settings page, or from the lock in the admin bar. It’s off until you turn it on.
• No back doors. Content feeds and the WordPress REST API are covered too, while logins and popular form plugins keep working.
• No stale copies. Switching protection clears the page cache of ten popular caching plugins, so a cached page can’t keep showing content to logged-out visitors.
• Safe redirects. After logging in, visitors only return to pages on your own site.
• Quiet and tidy. It makes no outside requests and removes its settings when it’s uninstalled.

Developers can adjust where visitors are sent and which API routes stay open through filters, and control who can change the setting.

What it doesn’t do

It protects the whole site. There’s no per-page exception list yet.