Protection Modes

The plugin protects your site for logged-out visitors in one of two modes. Logged-in users always have full access in both modes.

Partial Protection

Best for sites that keep most content public but want a few areas members-only.

• Lock individual BuddyPress or BuddyBoss components: Members, Groups, Site Wide Activity, and Blogs (Sites) on network installs.
• Lock specific page URLs, one per line, with * wildcard support (for example /docs/*).
• Everything you do not list stays public.

Protected content is also removed from front-end search results for logged-out visitors.

Full Protection

Best for private communities, intranets, and membership sites.

• Locks the entire site for logged-out visitors.
• You maintain a whitelist of URLs that stay public.
• With Full Protection on, all published pages except the whitelisted ones are removed from search results for logged-out visitors.

Priority

Full Protection always wins. When Enable Full Site Lock is on, the Partial Protection settings are ignored and the whole site is gated except the whitelist.

The effective order for a logged-out visitor is:

1. Logged-in users - full access, protection never applies.
2. Full Protection whitelist match - public.
3. Full Protection on - protected.
4. Partial Protection component or URL match - protected.
5. Everything else - public.

Always-public routes

Regardless of mode, some requests are never blocked so that login and registration keep working:

• BuddyPress account activation pages (detected via BuddyPress natively, so custom slugs and permalink styles are handled).
• AJAX requests (admin-ajax.php).
• The authentication REST routes JWT auth, wp/v2/users/register, and wp/v2/users/lostpassword.
• The redirect page you select for the redirect protection method.

The WordPress admin (wp-admin) is not affected by this plugin’s front-end protection, so you do not need to whitelist it.