WordPress - Auto login from IP address / addresses

[mattx]

Ver of Wordpress - 4.7

Trying to find a plugin ( that actually works ) - the will allow users to auto login from a list of IP addresses ( so no login - straight to the front page )

Any other IP address that is not listed it will ask for login details. I was using this and it worked great - https://10up.com/plugins/restricted-site-access-wordpress/

But now it seems there is not much development taking place on it as it does not work correctly on the updated Word Press.

Would appreciate any ideas / plugins / pointers to solve this.....

[pete]

Is SSO a viable alternative option? From a user perspective (assuming already signed into Google/AD/Azure AD/whatever) it should function the same.

[mattx]

I did think of that but I've been informed users need to go straight in ( as they were before ) which is rather annoying.

[Steve21]

How do you have it setup?

 

Is it a public site, but you want certain IPs auto logged in to admin?

 

Or is it a restricted site, and forces login, but you want some people to bypass this? (Without the requirement to login at all?)

 

Steve

[mattx]

Hi Steve, it's a public site ( Intranet ) which at the moment to logon requires the username and password. Management only want this for if someone wants to access it when they are not in an office. When they are in an office then they want users to be able to go to the site without having to sign in - so basically a trusted IP address / addresses.

I had a plugin working before which did this - https://10up.com/plugins/restricted-site-access-wordpress/ but this no longer works on the latest version of WordPress - 4.7

[Steve21]

We don't use a plugin, just a function in the php of wordpress. Think it's something like this:

 

if ( ( is_single() || is_front_page() || is_page() ) 
      && !is_page('login') && !is_user_logged_in()){ 
           if ( ($_SERVER['REMOTE_ADDR'] == $ip) || ($_SERVER['HTTP_X_FORWARDED_FOR'] == $ip) ) {

	     } else {
               auth_redirect(); 
            }
} 

 

Would need to double check though, or did you want a plugin specifically?

 

Steve

[mattx]

Hi Steve, can you enter more than one IP in there as I would need to enter about 30 ( would they need to be in an array or just listed as individual addresses ? )

Also where is this done - in the htaaccess ?

 

Not bothered about the plugin if this method works, I would just need the correct code and where you would make this change.

[macadder]

$_SERVER['HTTP_X_FORWARDED_FOR'] == $ip

This is not secure ^^ any would be attacker can just set that header to whatever they like. In general the whole idea isn't something I'd recommend.

 

That said I imagine the intention is that the code gets put into your themes function.php something like the below

add_action( 'init', 'checkip' );
function checkip() {
##code goes here
}

For the code to process multiple IPs

$ip = array("127.0.0.1","192,168.0.1");
if ( ( is_single() || is_front_page() || is_page() ) && !is_page('login') && !is_user_logged_in()){ 
  if ( in_array($_SERVER['REMOTE_ADDR'], $ip) || in_array($_SERVER['HTTP_X_FORWARDED_FOR'], $ip) ) {
     return;
  } else {
     auth_redirect(); 
  }
}