• Hi, I want to prevent a URL from being accessed directly using wp_get_referer, and I’ve codes like below:

    function registration_form(){
            if ( ! is_page('registration-page')) {
                return;
            }
            if (wp_get_referer() == (home_url('/registration-tos/'))) {
                return;
            }
            wp_redirect( '/registration-tos/' );
    	}
           add_action('template_redirect', 'registration_form');

    The codes work perfectly but I can’t edit the page from wp-admin, I always redirected to registration-tos page, show a change the code like below:

    function registration_form(){
            if ( ! is_page('registration-page')) {
                return;
            }
            if ((wp_get_referer() == (home_url('/registration-tos/')))) || ((wp_get_referer() == (admin_url('/post.php?post=12800&action=edit')))) {
                return;
            }
            wp_redirect( '/registration-tos/' );
    	}
           add_action('template_redirect', 'registration_form');

    and the codes also work like a charm.
    but when I change the code from (admin_url('/post.php?post=12800&action=edit'))) to only (admin_url()) the code doesn’t work.

    The question is: Is it possible to add admin url to the referer list without adding full URL like this: (admin_url('/post.php?post=12800&action=edit'))), is it possible to get only admin_url()? It because I have many pages to be restricted from URL direct access, and I don’t want to put their ID’s one by one.
    Or maybe there is a way to get dynamic ID’s here (admin_url('/post.php?post=12800&action=edit'))) ?

    Thank you in advance.

Viewing 1 replies (of 1 total)
  • Moderator bcworkz

    (@bcworkz)

    You’d need to parse the value returned by wp_get_referer() (assuming it’s not false) and strip out anything after /wp-admin/.

    Does any of this even matter for any admin request? If not, you could initially check the value of is_admin() and immediately return; if true.

Viewing 1 replies (of 1 total)

The topic ‘Restrict URL direct access using wp_get_referer’ is closed to new replies.