Restricted Site Access: Quickly Block Access to Your Website

Restricted Site Access (by 10up) is a powerful, lightweight security tool designed to shield your entire website from public view. As of January 2026 (v7.4.x), the plugin remains the industry standard for securing staging environments, extranets, and private company portals on the mybox infrastructure.

Unlike “Under Construction” plugins that only hide the front end, this plugin provides a robust layer of protection that can also be used to whitelist specific IP addresses (like your office or home) while blocking everyone else.

What is Restricted Site Access and When Is It Useful?

This plugin is a “global gatekeeper.” It restricts access to the entire site-including the dashboard and all subpages-to only logged-in users or visitors from permitted IP addresses.

• Staging & QA: Hide your test site from competitors and clients until it’s ready for launch.
• Intranets: Create a private company hub where only employees with a login can see content.
• Site Redesigns: Allow your developers and designers to work on the live server via their IP addresses while visitors see a “Coming Soon” page.
• SEO Protection: Automatically prevents search engine bots from indexing your development or staging site.

Key Features at a Glance

• Flexible Redirection: Choose to send blocked visitors to the login screen, a custom URL (like your main site), a specific WordPress page, or a simple text message.
• IP Whitelisting: Grant permanent access to specific IP addresses or entire IP ranges. It includes a “Quick Add” button to add your current location with one click.
• HTTP Status Codes: You can set the redirect to 302 (Temporary) for staging or 301 (Permanent) for legacy sites, which helps maintain your SEO integrity.
• Preserve Path: If you redirect a user to a login page, they can be sent back to the exact URL they originally requested after they log in.

Installation and Quick Setup

On the mybox platform, the setup takes less than two minutes:

1. Installation: In your dashboard, go to Plugins > Add New, search for “Restricted Site Access”, and click Activate.
2. Configuration: Navigate to Settings > Reading. You will see a new section titled Restricted Site Access.
3. Enable Restriction: Check the box to enable the mode.
4. Handle Blocked Visitors: Choose your preferred method (e.g., “Show them a simple message”).
5. Add Your IP: Click the Add my current IP address button to ensure you don’t lock yourself out.
6. Save: Click Save Changes. Test the restriction by opening your site in a Private/Incognito browser window.

Multisite: What to Watch Out For

In a WordPress Multisite network, Restricted Site Access adds a global panel to the Network Settings. You can choose to enforce restrictions across all sites or allow individual site administrators to manage their own access rules.

Important: If you use “Redirect to Login” in a multisite environment, ensure users have a role on the specific sub-site they are trying to access. Otherwise, they may find themselves in an infinite redirect loop. For multisite, we recommend redirecting to an Informational Page with instructions on how to request access.

Caching and Proxy Traps

Since the plugin works at the WordPress level, it can sometimes be bypassed by server-side caching.

• Caching: If you are using a plugin like LiteSpeed or WP Rocket on mybox, you must clear the cache after enabling restrictions. Some “hard” caches might serve a cached page to a blocked user before the plugin can intervene.
• Reverse Proxies (Cloudflare): If your site is behind a CDN like Cloudflare, ensure your WordPress installation is correctly configured to see the Real Client IP (via the X-Forwarded-For header). If WordPress sees the CDN’s IP instead of yours, the whitelist will not work correctly.

Impact on SEO and Indexing

Restricted Site Access is an excellent tool for preventing duplicate content issues. By blocking access to your staging or development site, you ensure that Google never indexes your “work in progress” pages. This is much more reliable than using a robots.txt file, which bots can technically ignore.

When you are ready to go live, simply uncheck the “Enable Restriction” box in the Reading settings, and your site will be instantly available for indexing.

Comparison with Alternatives

Summary

Restricted Site Access is the “on/off switch” for your website’s visibility. It is a vital tool for the mybox professional who needs a secure environment to build and test before launching to the public. By combining IP whitelisting with easy redirection, it provides security without complicating the workflow for your team.