Set Up Full Protection

Full Protection locks your entire site for logged-out visitors and keeps only a whitelist of URLs public. It overrides Partial Protection.

Open WB Plugins > Private Community > Full Protection.

Enable the lock

Turn on Enable Full Site Lock. The whitelist section appears once the toggle is on. A status notice at the bottom of the tab confirms whether protection is active.

Configure the whitelist

The Public Pages (Whitelist) box lists the URLs that stay accessible without login, one per line. The default whitelist is:

# Homepage (remove this line to force login on homepage)
/

# WordPress Login Page
wp-login.php

# BuddyPress/BuddyBoss Register Page
register

# BuddyPress Account Activation
activate
/activate/*

# Password Reset Pages
wp-login.php?action=lostpassword
wp-login.php?action=rp
wp-login.php?action=resetpass

# Add your custom URLs below (one per line)
# Examples:
# /contact
# /about-us
# /docs/*

Notes on whitelist matching:

• Lines starting with # are comments.
• / matches the homepage only.
• * is a wildcard, for example /docs/*.
• You can whitelist by path, by page slug, or by page ID.
• BuddyPress account activation pages are always allowed even if you remove them from the list, so new members can activate their accounts.

You do not need to whitelist wp-admin or admin-ajax.php. The admin area is not gated by front-end protection, and AJAX requests are allowed automatically.

Whitelist toolbar

The whitelist box has helper buttons:

• Reset Defaults - restore the default whitelist.
• Clear All - empty the whitelist. Warning: this locks every page, including the homepage and login, so use it only before adding your own rules.
• Add All Pages - append every published page URL to the whitelist, skipping ones already listed.
• Remove Duplicates - strip repeated lines.

Confirmation prompts for Reset Defaults and Clear All appear as an in-page modal.

Save

Click Save Changes to apply. Test the result in a private browser window while logged out.