Disable website to all but logged in users

Question

I know there are many ways to do this, however when I think deeply, a global disable of the site might be difficult.

What I want is when a user goes to the website, they are redirected to the login page no matter where they are. I would prefer not to need special settings in every menu item or other area of the page.

Is there a simple way to do this? Or a super awesome plugin that does this? My searches so far have been in vain. However that just might be my choice of keywords in JED/Google.

Answer 1

Would one of these work?

Members Only (From the JED)

Keep prying eyes away from part or your whole website, while they stay anonymous. Optionally you may allow visitors to directly register to your website with or without requiring for an invitation code.

registeredOnly (From the JED)

registeredOnly plugin restrict access to Joomla site to registered users only.

When a guest tries to access any Joomla content, they are redirected to the login page.

Answer 2

1) Use Joomla!'s Built-In ACL

I recommend defaulting your visitors to a login page and using Joomla!'s built-in ACL using Registered users.

Set a Top-Level Menu item with permissions to Registered users - and then each Menu item on that tree will be only visible and available to Registered users.

There is an excellent tutorial on ACL in the Joomla! Docs.

However, files and documents can still be downloaded by non-registered users (i.e. if they have the direct link).

In this case, you will have to use a 3rd party extension, if you wish to protect those docs, such as Akeeba Release Systems or SobiPro.

2) Password Protected Directories

The 'simplest' way to protect your site is to Password Protect your directory via .htaccess/

It's inelegant, but if you use cPanel, for example, go to Security -> Password Protected Directories and use the wizard to name directories, add or remove users and assign those users to the Password Protected Directory - you can give each user a unique name and password.

It's inelegant, but simple and used quite often in practice - however, I reiterate, it's probably best use ACL and if protecting docs from download, a 3rd party extension.

If you keep your files/docs under the Password Protected directory, then those will be protected as well - requiring a user with permissions trying to access that directory to login first.

Answer 3

I had a client request to make an extranet for them using Joomla, which had to be 'locked down' as strictly as possible. I did this by setting the site to Offline in Global Configuration, then edited the ACL to give 1 custom user group I created the Offline Access permission.

I notice in the comments you mention you're using OAuth for login - some extensions that assist with this can be configured to automatically add users to a user group, so you could then use this functionality to add them to the group configured as per the above instructions.

I then overrode the offline.php file in my template to make it seem more like an extranet-style login page, rather than the default 'This site is offline' page.

Answer 4

I'm going to give my answer for this based on @Bryan's answer.

The Members Only plugin looks very promising, so no comment on that.

The registeredOnly plugin is free, however I was not impressed with the code, so I took the liberty of forking and re-writing it and removing the deprecated code.

In addition to that, I removed the Community Builder support because....well...I hate Community Builder:

defined('_JEXEC') or die('Restricted access');

class plgSystemRegisteredonly extends JPlugin
{
    public function onAfterRoute() 
    {
        $app   = JFactory::getApplication('site');
        $input = $app->input;
        $user  = JFactory::getUser();

        // Do nothing if in backend or user is logged in
        if ($app->isAdmin() || !$user->guest)
        {
            return;
        }

        // Get the component, view and task
        $option = $input->get('option');
        $view   = $input->get('view');
        $task   = $input->get('task');

        // If user is logging, registering or requesting user/pass, dont redirect
        if (($option == 'com_users') && (($task == 'login') || ($task == 'register_save') || ($task = 'remindusername') || ($task == 'requestreset')))
        {
            return;
        }

        // If user is at login form, registering or recovering user/password, dont redirect
        if (($option == 'com_users') && (($view == 'login') || ($view == 'reset') || ($view == 'remind') || ($view == 'register')))
        {
            return;
        }

        $app->redirect(JUri::base() . 'index.php?option=com_users&view=login', 'You must be logged in to access this site');
    }
}

---

Put it up on Github too: https://github.com/Joomla-StackExchange/registeredOnly

Hope this helps a few of you

Answer 5

You could set the permission of all menu links to registered, forcing the user to log in.

Answer 6

$haystack= JURI::current();
$needle = '/login';
$is_login_page = $needle === "" || (($temp = strlen($haystack) - strlen($needle)) >= 0 && strpos($haystack, $needle, $temp) !== FALSE);
if(JFactory::getUser()->guest && !$is_login_page && $_SERVER['HTTP_HOST'] != 'vauler.com' && $_SERVER['HTTP_HOST'] != '127.0.0.1:92')
    $app->redirect('index.php/login');

paste this code to index.php file of your current template