Who gets through#

Four ways in, for different people.

Roles — tick the roles that see the site as normal. Anyone who can change these settings always gets through whatever is ticked, because unticking your own role would otherwise lock you out of your own front end with no way back but the database.

Show a Sign in link on the page, under the roles, is for a site you open to customers or members by ticking their role. The login screen is never closed, but nothing on your page leads there, and with WooCommerce the account page is behind your page too. The link sits at the foot of the page, beside the password link, and goes to WordPress's sign-in page, which brings the person back to the page they asked for rather than to wp-admin. Somebody already signed in whose role is not ticked gets one line instead, with the name they are shown by (never their email address) and a Sign out link: You are signed in as Ana, but this site is not open to your account yet. The link is off to begin with, and the screen suggests it as soon as you tick a role other than Administrator. Link text changes its words. Until you change it, Sign in is shown in the language of the page, like the plugin's own wording, rather than in the language of whoever last saved the screen, and words of your own are offered for translation in WPML and Polylang with the page's other words. It is not on the page shown while WordPress installs updates, which nobody can sign in from.

The link goes wherever WordPress says your sign-in page is, so a plugin that moves it to an address of its own, such as Login Security by Traslatability or WPS Hide Login, is followed. That also means every visitor of your page can read the moved address. The Access screen says so under the setting, and names the address, before you switch the link on. Moving the sign-in page keeps away the machines that guess wp-login.php; it is not a lock, and the members the link is for need the address anyway. If keeping it out of sight matters more to you than the link, leave the link off. If your sign-in form is a page of your site, such as a theme's own login page, leave that page open under Exclude, or the link leads back to your page.

A link — send it to a client and they see the finished site with no account and no password. Opening it once is enough; their browser remembers for a week and the key is taken out of the address bar straight away, so it does not end up in a referrer or a pasted URL. Treat it as a password: anyone holding it can see the site.

Give each person their own link, under Preview Links at the foot of the Access screen. Add a link asks for a name, such as Acme marketing or Printer, and an end, a date and time in your site's time zone, or nothing for a link that never ends. The list shows each link's name and the day it was added, its address with a button to copy it, when it ends, and the day it last let somebody in: Today, Yesterday, 3 days ago, a date after a month, or Not yet. Only that day is kept, never a time, an address or anything else about who opened it.

Remove asks first, then shuts out the people holding that link from their next visit. Everybody holding another link stays in.
New address keeps the name and the end and gives the link a new address. The old address, and the browsers that opened it, stop working at once.
A link that has Ended says so in the list. Its holders see your page like any other visitor, and nothing on it tells them the link ever worked. Their browser forgets it at the end too, rather than a week after opening it.

The list holds up to 50 links. Adding, removing and new addresses happen as you press them; Save changes never touches the links. Sites updated from 1.11.0 or earlier find their one link as the first row, Preview link, with no end and the same address, so every copy already sent goes on working, and so do the browsers that already opened it. A new site starts with that one link. On a network each site has its own links.

A password — a discreet link at the foot of the page, under everything else, that opens a box for a group who share one password. It is stored scrambled, so nobody can read it back, and it is never shown again. Five wrong guesses and that visitor waits fifteen minutes. Changing the password signs out everyone using the old one.

IP addresses — one address or range per line, such as 203.0.113.7 or 203.0.113.0/24; IPv6 works too. Everyone arriving from those addresses sees the site on every device, with nothing to forward: an office, a client's staff network, an uptime monitor. The screen shows your own address as the site sees it, so you can copy it in. A server that reports IPv4 visitors the IPv6 way (::ffff:203.0.113.7) is understood, and the list keeps the plain IPv4 spelling. Spaces and commas separate entries as well as line breaks, so one typed line can be two entries. An entry that is not an address, or a range wider than a /8 (a /16 for IPv6), is left out and the save names it. The address is the visitor's connection, or the one Cloudflare or a proxy on your own server passed on; a forwarding header from anywhere else is not believed. Behind another proxy, the traslatability_client_ip filter can say which address to trust.

Where it applies#

Everything, by default. Two cases come up constantly and both are settings here.

Apply to narrows it: Everywhere, The front page only, Shop and product pages, or Only what I choose below with tick lists for places, kinds of content and archives, all built from your own site.

Exclude wins over all of it. Common exclusions ticks the places most often left out — a place already chosen on the left cannot be ruled out here, and greys out rather than cancelling itself. Excluded pages takes a particular page, post, product or category by name. Excluded addresses takes one address per line with standing for anything: /contact/ leaves everything under /contact/ open. You can paste an address straight from the browser: only the part after the domain name is kept, and letters from other alphabets or with accents keep working whether the browser wrote them as letters or as %D0%BA-style codes. A line typed with two slashes at the start, //contact/, is read as /contact/.

Earlier versions deleted those codes as they saved a line, so /контакты/ pasted from the browser was saved as //, which is the front page, and /блог/ as //, which is every page. Pasted without the domain name, either was saved as /, the front page, and /año-nuevo/ became /ao-nuevo/, which is no page. A line saved like that keeps doing what it did until you delete it: if the box holds /, // or //* that you did not mean, or a line missing letters, delete it and paste the address again.

A line opens the address it names and nothing more. A link to that address that asks WordPress for a post, a page, a search or a feed in its query (?p=12, ?s=), or a form sent to it with one of those, gets your page, and so does one that asks with nothing after the = (?pagename=&s=), which WordPress reads as a search for everything. A campaign tag, a page number or a contact form's own fields leave it open. With your front page left open (/) and a page chosen as your front page under Settings → Reading, WordPress shows your latest posts instead when a link adds almost any other word of its own to the address (/?order=asc), so anything there that is not your front page gets your page. While your page is up, the Dashboard says so when a line leaves your front page open (/) or every page (/*), and the Access screen says the same above Exclude.

The admin, the login screen, cron, the REST API, WP-CLI, robots.txt and your sitemap are never closed. A maintenance mode that locks the owner out of wp-admin is the oldest support ticket in this category of plugin. Signing in always works; making a new account is the one thing the login screen refuses while your page is up (see New accounts below).

One exception, in coming soon mode only, and only while the page covers the whole site: somebody who cannot edit the site and has not been let through cannot read your content through the REST API. Posts, pages, images and authors at /wp-json/wp/v2/ are refused, and so are your WooCommerce products, categories, brands and reviews in the Store API. The cart, the checkout and other plugins' routes keep working, and on a site with any part left open — under Exclude, or a page that covers the front page only — nothing is refused at all, because those pages and the blocks on them are still being shown to everybody.

New accounts#

While your page covers the whole site (Apply to is Everywhere on the site), nobody can make a new account, unless you tick Allow new accounts while your page is up in the New Accounts panel. A site that is not open yet rarely wants sign-ups, and with Anyone can register ticked under Settings → General, the registration form on WordPress's sign-in page is where bots find a site before its owner has told anybody about it. It is off to begin with, on sites set up before it existed too.

What is refused:

WordPress's own registration form (wp-login.php?action=register). Anyone who opens it is sent back to the sign-in form, which says why, and the Register link under the form is gone.
A network's wp-signup.php and wp-activate.php. They belong to the main site, so they follow the main site's page: while it is up and new accounts are refused, both show your page instead. An activation link opened then makes no account; it works once your page comes down. WordPress loads only network-activated plugins on wp-activate.php, so that page is covered when the plugin is network-activated. A sign-up form elsewhere that checks a new user the same way is refused too.
WooCommerce's My account page, if you leave it open under Exclude: the registration form is not shown and a sentence says why. A registration posted there anyway is refused.
WooCommerce's checkout, classic and block. A shop that sells to guests stops offering Create an account, and the order goes through as a guest's. A shop that needs an account to order (guest checkout off) keeps the offer, and the account, and so the order, is refused with the same sentence. Leaving the checkout open under Exclude does not change this: tick the setting if you want people to order with an account before you open.
WooCommerce's Create an account after an order, and any other plugin that makes accounts through register_new_user() or WooCommerce's wc_create_new_customer().

The visitor reads one plain sentence: This site is not open yet, so new accounts cannot be created. Please come back when it opens. In maintenance mode it says the site is down for maintenance and to try again later.

What is never refused:

Signing in and resetting a password.
Anybody you let in on this screen: a preview link, the password, a listed IP address. Anybody already signed in, too, which covers an administrator adding a customer, a shop manager's till and an integration with its own API key.
Code with nobody behind it: WP-CLI, cron, and Action Scheduler's queue (an import or a sync from another system).
A page that covers part of the site only (the front page, the shop, or what you choose), and Shop closed for orders, which puts no page up. The panel says so when Apply to is anything but Everywhere on the site.

Accounts made in wp-admin, and by plugins that insert users directly with wp_insert_user(), are not affected. Developers can change the answer with the trcs_refuse_new_account filter, and the sentence with trcs_new_account_refused_text.