Hello everyone,

Recently, I've got several emails regarding the ability to password-protect specific set of posts and pages for visitors. However wanted to allow access to the protected content when some query parameter is present in the URL (e.g. ?referral=MK458, ?referral=RG001).

In this post I'll show you how to build couple Access Policies that will protect your content with a single password or redirect visitor to the login page.

Note! Some of the aspects of mentioned bellow functionality requires AAM v5.9.6 or higher as well as premium Plus Package extension. At the moment of writing this post, the latest AAM version is 5.9.5, however you can already download release candidate from the Official WordPress Repository.

Here is the example of the policy that will restrict access to all posts with a single password DemoPassword123 however will allow to read content if there is a ref query parameter in the URL with some value.

{
    "Version": "1.0.0",
    "Dependency": {
        "wordpress": ">=5.1.1",
        "advanced-access-manager": ">=5.9.5"
    },
    "Statement": [
        {
            "Effect": "deny",
            "Resource": "PostType:post:posts",
            "Action": "Read",
            "Metadata": {
                "Password": {
                    "Value": "DemoPassword123"
                }
            },
            "Condition": {
                "Equals": {
                    "(*null)${QUERY.ref}": null
                }
            }
        }
    ]
}

There is one Statement here that uses PostType resource to define default access settings to all posts PostType:post:posts.

The Statement is applicable when there is no ref parameter in QUERY in the list of query (GET) parameter.

FYI! AAM returns null if specified marker does not exist.

In case you need to redirect user to the login form, you can use policy like this one:


{
    "Version": "1.0.0",
    "Dependency": {
        "wordpress": ">=5.1.1",
        "advanced-access-manager": ">=5.9.5"
    },
    "Statement": [
        {
            "Effect": "deny",
            "Resource": "PostType:post:posts",
            "Action": "Read",
            "Metadata": {
                "Redirect": {
                    "Type": "login"
                },
                "Teaser": {
                    "Value": "This is protected content. You must login to see it."
                }
            },
            "Condition": {
                "Equals": {
                    "(*null)${GET.ref}": null
                }
            }
        }
    ]
}

In the policy above I'm restricting access to read all posts and redirect visitor to the login page. When authentication is successful, user will be redirected back to the original page.

Note, that we also want to set a teaser message in case post is listed on the List of Posts page.