I know there are many ways to do this, however when I think deeply, a global disable of the site might be difficult.

What I want is when a user goes to the website, they are redirected to the login page no matter where they are. I would prefer not to need special settings in every menu item or other area of the page.

Is there a simple way to do this? Or a super awesome plugin that does this? My searches so far have been in vain. However that just might be my choice of keywords in JED/Google.

  • put your site offline in the global configuration?
    – web-tiki
    May 2, 2014 at 18:06
  • That would work somewhat, but that feature is not meant for this, so I would have to mess with user groups and such, so since I am using strict OAuth for login (no users) user groups are not easy to add into it. May 2, 2014 at 18:41

6 Answers 6


Would one of these work?

Members Only (From the JED)

Keep prying eyes away from part or your whole website, while they stay anonymous. Optionally you may allow visitors to directly register to your website with or without requiring for an invitation code.

registeredOnly (From the JED)

registeredOnly plugin restrict access to Joomla site to registered users only.

When a guest tries to access any Joomla content, they are redirected to the login page.

  • 1
    Registered only seems to work like a charm :) May 2, 2014 at 20:49

1) Use Joomla!'s Built-In ACL

I recommend defaulting your visitors to a login page and using Joomla!'s built-in ACL using Registered users.

Set a Top-Level Menu item with permissions to Registered users - and then each Menu item on that tree will be only visible and available to Registered users.

There is an excellent tutorial on ACL in the Joomla! Docs.

However, files and documents can still be downloaded by non-registered users (i.e. if they have the direct link).

In this case, you will have to use a 3rd party extension, if you wish to protect those docs, such as Akeeba Release Systems or SobiPro.

2) Password Protected Directories

The 'simplest' way to protect your site is to Password Protect your directory via .htaccess/

It's inelegant, but if you use cPanel, for example, go to Security -> Password Protected Directories and use the wizard to name directories, add or remove users and assign those users to the Password Protected Directory - you can give each user a unique name and password.

It's inelegant, but simple and used quite often in practice - however, I reiterate, it's probably best use ACL and if protecting docs from download, a 3rd party extension.

If you keep your files/docs under the Password Protected directory, then those will be protected as well - requiring a user with permissions trying to access that directory to login first.


I had a client request to make an extranet for them using Joomla, which had to be 'locked down' as strictly as possible. I did this by setting the site to Offline in Global Configuration, then edited the ACL to give 1 custom user group I created the Offline Access permission.

I notice in the comments you mention you're using OAuth for login - some extensions that assist with this can be configured to automatically add users to a user group, so you could then use this functionality to add them to the group configured as per the above instructions.

I then overrode the offline.php file in my template to make it seem more like an extranet-style login page, rather than the default 'This site is offline' page.


I'm going to give my answer for this based on @Bryan's answer.

The Members Only plugin looks very promising, so no comment on that.

The registeredOnly plugin is free, however I was not impressed with the code, so I took the liberty of forking and re-writing it and removing the deprecated code.

In addition to that, I removed the Community Builder support because....well...I hate Community Builder:

defined('_JEXEC') or die('Restricted access');

class plgSystemRegisteredonly extends JPlugin
    public function onAfterRoute() 
        $app   = JFactory::getApplication('site');
        $input = $app->input;
        $user  = JFactory::getUser();

        // Do nothing if in backend or user is logged in
        if ($app->isAdmin() || !$user->guest)

        // Get the component, view and task
        $option = $input->get('option');
        $view   = $input->get('view');
        $task   = $input->get('task');

        // If user is logging, registering or requesting user/pass, dont redirect
        if (($option == 'com_users') && (($task == 'login') || ($task == 'register_save') || ($task = 'remindusername') || ($task == 'requestreset')))

        // If user is at login form, registering or recovering user/password, dont redirect
        if (($option == 'com_users') && (($view == 'login') || ($view == 'reset') || ($view == 'remind') || ($view == 'register')))

        $app->redirect(JUri::base() . 'index.php?option=com_users&view=login', 'You must be logged in to access this site');

Put it up on Github too: https://github.com/Joomla-StackExchange/registeredOnly

Hope this helps a few of you


You could set the permission of all menu links to registered, forcing the user to log in.

  • 1
    Because no menu item other then login will be shown without the user being logged in, I would prefer to avoid the extra step if possible, as I said in the question. May 2, 2014 at 20:17
  • 1
    You can default to the login page when members hit your site address. They login - the menu items appear. Where is the extra-step? ACL is set-up beautifully for this.
    – NivF007
    May 2, 2014 at 23:43
  • @NivF007 The extra step is having to set the menu access to "Registered" every time you make a menu item. The simplest solution would be to be able to set a default menu access level, instead of it just defaulting to "Public". If you could set it to default to "Registered" no extension would be needed. May 3, 2014 at 3:50
  • 1
    @DavidFritsch Setting one parameter on the creation of a menu link isn't exactly hard work. It's not like you add new menu links every day.
    – Adam B
    May 3, 2014 at 17:52
  • 1
    @AdamB That would work! And then set the menu module to start at level two. If you wanted just one layer. An odd solution in my mind but should be possible May 3, 2014 at 18:42
$haystack= JURI::current();
$needle = '/login';
$is_login_page = $needle === "" || (($temp = strlen($haystack) - strlen($needle)) >= 0 && strpos($haystack, $needle, $temp) !== FALSE);
if(JFactory::getUser()->guest && !$is_login_page && $_SERVER['HTTP_HOST'] != 'vauler.com' && $_SERVER['HTTP_HOST'] != '')

paste this code to index.php file of your current template


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.