Intranet & Private Site – All-In-One Intranet vs Spam protection, Honeypot, Anti-Spam by CleanTalk

Plenty of companies run their intranet on WordPress. The problem is that WordPress was built for public-facing sites. Making it work as a private intranet typically requires installing multiple plugins, configuring each one separately, and hoping they all play nicely together. All-In-One Intranet turns your WordPress site into a fully private intranet from a single plugin. Enable privacy with one checkbox, set up auto-logout to protect sensitive information, configure where users land after login, and manage multisite access controls, all from one settings page. Corporate intranet, private knowledge base, restricted client portal, internal comms hub: the privacy and access control are the same job in each case, and this plugin does that part. What is an Intranet? An intranet is a private website or network used internally by an organization. Unlike a public website, an intranet is only accessible to authorized users: typically employees, contractors, or specific team members. Common uses for a WordPress intranet include: Internal company communications and announcements Employee handbooks, policies, and procedures Knowledge bases and documentation wikis Project collaboration and team coordination HR portals for onboarding and training materials Client portals with restricted access to project files WordPress already has the editing interface and the user roles for all of these. What it does not have is the access control layer, which is what All-In-One Intranet adds. Features All-In-One Intranet has five features, covering what most intranets need: One-Click Private Site Enable the “Force site to be entirely private” checkbox, and your entire WordPress site becomes restricted to logged-in users only. Anyone who is not logged in gets redirected to the WordPress login page automatically. This single setting handles multiple layers of privacy at once: Page and post access – all frontend content requires authentication REST API protection – unauthenticated REST API requests are blocked with a 401 error, so data cannot leak through the API XML-RPC blocking – XML-RPC is disabled entirely when privacy is active Search engine blocking – the robots.txt file is automatically updated to disallow all crawling, so your private content stays out of search indexes Pingback suppression – outgoing pingbacks and trackbacks are disabled so your private site does not announce itself to external services Feed protection – RSS, Atom, and comment feeds require authentication, so protected posts and comments cannot be read through /feed/ or crafted feed URLs Comment and trackback blocking – unauthenticated visitors cannot post comments or trackbacks to protected content through wp-comments-post.php or wp-trackback.php Admin endpoint gating – the admin-ajax.php and admin-post.php handlers require a valid login, so public “nopriv” actions registered by your theme or other plugins do not run for logged-out visitors. A short allowlist keeps the handlers people need before login working: two-factor and passkey plugins, and connected site-management platforms Entry-point coverage – WordPress files that load the site outside the normal page render, such as wp-links-opml.php (the blogroll and OPML export) and wp-activate.php, are sealed so they cannot leak post content, feeds, your site title, or the WordPress version Slug enumeration prevention – WordPress’s canonical redirect does not reveal the slugs of private posts to unauthenticated visitors on pretty permalinks Role and membership enforcement – the REST API and comment gates apply the same role and sub-site membership checks as the rest of the site, so a logged-in user with no role, or who is not a member of the current sub-site, is blocked there too The plugin also watches your registration settings: if “Anyone can register” is enabled, or open registration is allowed on a multisite network, a warning appears on the settings page so you can fix it. Auto-Logout for Inactive Users Shared workstations and forgotten browser tabs are a security risk for intranets. The auto-logout feature lets you set a maximum idle time (in minutes, hours, or days) after which users are automatically logged out. The plugin tracks when each browser session was last active. On every page load, it checks whether the configured idle time has been exceeded. If a session has been idle for too long, the user is logged out immediately and redirected back to the page they were viewing, which triggers the login wall if the site is private. Each session keeps its own timer, so staying active at your desk does not keep a forgotten login on a shared machine alive. This protects sensitive company information without requiring users to remember to log out manually. Set it to 30 minutes for high-security environments, a few hours for typical office use, or leave it blank to disable the feature entirely. Auto-logout counts browser sessions only. A request that authenticates without a login cookie (a site management dashboard using its own API, or a script using an application password) has no session to expire, so it is left alone. Custom Login Redirect By default, WordPress sends users to the dashboard after they log in. For an intranet, this is not useful: your team is logging in to read content, not to manage the site. The login redirect feature lets you set any URL on your site as the post-login landing page. Point it to your company homepage, a news feed, or a team dashboard so users see relevant content right away. This redirect only applies when users log in directly through the standard WordPress login page. A user who was redirected to the login page from a specific URL is sent back to that URL instead. Multisite Sub-site Privacy If you run a WordPress multisite network, you can require logged-in users to be members of a specific sub-site before they can view it. This is useful for organizations with multiple departments, teams, or client areas, each with their own sub-site that should only be visible to relevant people. When a user who is logged in but not a member of the current sub-site tries to access it, they see a message listing all the sub-sites they do have access to, with clickable links to navigate there. Access to the Network Admin area is never restricted by this setting. This option works in combination with the main privacy setting: enable private site first, then add sub-site membership requirements on top of it. Multisite Default Role Assignment Managing user access across multiple sub-sites in a WordPress network can be tedious: every new user and every new sub-site means assigning roles by hand. The default role assignment feature automates this. Choose a role (Subscriber, Editor, Administrator, or any custom role), and the plugin handles the rest: When a new user is created, they are automatically added to every active sub-site in the network with the selected role When a new sub-site is created, all existing users are automatically added to it with the selected role How to Make Your WordPress Site Private It takes about a minute to make your WordPress site private with All-In-One Intranet: Install and activate the plugin from the WordPress plugin directory Go to Settings > All-In-One Intranet in your WordPress admin (or Network Admin > Settings > All-In-One Intranet for multisite) Check the box labeled “Force site to be entirely private” Click Save Changes That is all it takes. Your site is now private. Any visitor who is not logged in will be redirected to the WordPress login page. The REST API, XML-RPC, and search engine indexing are all locked down automatically. If you see a warning about registration settings, follow its link to disable open registration. How to Set Up Auto-Logout for Inactive Users The auto-logout feature protects your intranet from unattended browser sessions: Go to Settings > All-In-One Intranet Find the Auto Logout section Enter a number in the time field (e.g., 30) Select the time unit from the dropdown: Minutes, Hours, or Days Click Save Changes Users who are inactive for longer than the configured period will be logged out on their next page interaction. Their activity timer resets on every page load, so active users are never interrupted. The timer belongs to the browser session, so being active in one browser does not keep the same account signed in on another machine. To disable auto-logout, clear the time field and save. How to Configure Login Redirect To send users to a specific page after they log in: Go to Settings > All-In-One Intranet Find the Login Redirect section Enter the full URL of your desired landing page (e.g., https://example.com/welcome) Click Save Changes Users who log in via /wp-login.php will now land on that page instead of the WordPress dashboard. Users who were redirected to the login page from a specific URL will still return to that URL after logging in. How to Set Up a WordPress Multisite Intranet For organizations running a WordPress multisite network: Go to Network Admin > Settings > All-In-One Intranet Enable “Force site to be entirely private” to restrict the entire network to logged-in users Optionally enable “Require logged-in users to be members of a sub-site to view it” for per-site access control Under Sub-site Membership, select a default role to automatically assign users to sub-sites Click Save Changes The privacy and membership settings apply network-wide. The default role assignment runs automatically when new users or new sub-sites are created. Existing sub-sites and users are not affected retroactively when you change the role setting. Security Features All-In-One Intranet takes a layered approach to access control: Authentication enforcement – uses WordPress’s built-in auth_redirect() function for reliable login redirection REST API lockdown – blocks unauthenticated API requests to endpoints like /wp-json/wp/v2/posts XML-RPC disabling – completely disables XML-RPC when privacy is active No-role user handling – on single-site installations, users who are logged in but have no assigned role are logged out and shown an error message, so an account deactivated by removing its role cannot get in Registration monitoring – warns you if WordPress is configured to allow open registration, which would undermine your private site setup Nonce verification and capability checks – settings forms use WordPress nonce validation, and settings pages require manage_options (single site) or manage_network_options (multisite) Media uploads (images, PDFs, etc.) remain accessible to anyone who knows their direct URL. This is a limitation of how WordPress stores media files and is common to most privacy plugins. If you need to protect individual file downloads, consider a dedicated file protection plugin alongside All-In-One Intranet. For Developers All-In-One Intranet provides the aioi_allow_public_access filter for developers who need to make specific pages or endpoints accessible without authentication. This filter runs during both the template redirect check and the REST API dispatch check. Return true to allow public access for the current request: add_filter( 'aioi_allow_public_access', function( $allow ) { // Allow public access to a specific page if ( is_page( 'public-landing' ) ) { return true; } return $allow; } ); This is useful for exposing specific landing pages, webhook endpoints, or custom API routes while keeping the rest of the site private. Two more filters cover login-screen plugins, which have to finish their authentication exchange while the visitor is still logged out. aioi_public_actions lists the admin-ajax.php / admin-post.php actions that may still run while the site is private, and aioi_public_rest_routes does the same for plugins that verify a second factor over the REST API, matching a route exactly or as a path segment prefix. Two-factor and passkey plugins are already covered out of the box, and every bundled entry applies only while the plugin it belongs to is active, so a private site never leaves an endpoint open for a plugin it does not run. Only add authentication endpoints to either list. Anything on them can be called by logged-out visitors, so it must not return site content, and it must do its own credential or token check. Site-management platforms are the deliberate exception, because returning site content is their whole purpose. See the next section. Site Management Dashboard Compatibility Many agencies and IT teams look after every site they run from a central dashboard that handles updates and backups. Making a site private should not cut it off from that dashboard, so these connector plugins are supported out of the box, with nothing to configure: ManageWP Worker – also the connector used by GoDaddy Pro MainWP Child InfiniteWP Client WP Umbrella WP Remote Each of these talks to its dashboard over its own signed protocol rather than a browser login. Site syncing, plugin and theme updates, backups, and the dashboard’s one-click login into wp-admin all keep working with “Force site to be entirely private” enabled. ManageWP, MainWP and InfiniteWP answer their dashboards from their own hooks, before the privacy gate runs, so nothing needs to be opened for them. The other two each need one narrow exemption, granted only to a request the platform itself has already vouched for. WP Umbrella works entirely through the WordPress REST API, which a private site otherwise closes, so its own namespace opens only for a request presenting WP Umbrella’s credentials, and the admin-ajax.php calls it makes back to itself open only for a request carrying the nonce those handlers verify. WP Remote routes part of its traffic through admin-ajax.php, and that one action opens only once WP Remote has checked the caller’s signature and registered its handler. An anonymous request to either still meets the login wall, a credentialed one still has to satisfy the platform’s own checks, and every other route, action and page stays private. Auto-logout handles those background calls too: a dashboard request is never logged out in the middle of an API call, and it does not count as the connected administrator’s own activity, so frequent polling cannot hold a real person’s session open past the idle limit you set. A private site does still hide anything a service fetches anonymously from its own servers: uptime monitoring, broken-link checking, and SEO or page-speed scans. Those requests carry no login, so they get the login redirect and the dashboard usually reports the site as down or its links as broken. That applies to every external service, not only these five.

Trusted by over 200,000 websites and rated among the top anti-spam solutions for WordPress in 2026. No CAPTCHAs, no puzzles, and no visitor friction — just automatic spam blocking for forms, comments, registrations, subscriptions, and fake orders. Powered by a global spam detection network that includes over 1,078,000 websites and helps stop spam before it reaches your website. Install it in less than 30 seconds and start protecting your site immediately. Superpowers Stops spam comments. Stops spam registrations and logins. Stops spam contact emails. Stops fake orders eCommerce sites and online stores. Antispam for bookings. Antispam subscriptions. Stops spam surveys, polls. Stops spam in WooCommerce. Antispam for Search Form. Real-time email validation. Check if an email is real or fake. Checks and removes the existing spam comments and spam users. Blocking disposable & temporary emails. Block messages by languages, countries, networks and stop words. Public reviews It’s more than just a tool to combat spam; it’s an integral component that enhances the overall quality and performance of your website. techbusinessnews.com.au Improve Your Security WordPress Spam Protection With CleanTalk Anti-Spam The Hacker News. Compare reCAPTCHA & Akismet VS CleanTalk CleanTalk vs Google reRECAPTCHA CleanTalk vs Akismet Free trial then $12 per year CleanTalk is an anti-spam plugin which works with the premium Cloud Anti-Spam service cleantalk.org. This plugin as a service https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/#6-software-as-a-service-is-permitted AntiSpam protection for comments Native spam protection for WordPress, JetPack comments and any other comment plugins. The plugin moves spam comments to SPAM folder or you can set the option to ban spam comments silently. You can also enable the option in the plugin settings to auto-delete comments from SPAM folder. Contact Form 7 Antispam Plugin extends spam protection for Contact Form 7 (CF7). It can be used with any other third-party spam filters. How to protect your Contact Form 7 using CleanTalk Anti-Spam plugin Contact Form by WPForms Antispam Plugin extends Contact Form by WPForms to provide spam protection. It filters spam submissions for each type of forms – simple contact form, marketing form, request a quote and etc. Antispam for WooCommerce & fake orders filter Anti-spam by CleanTalk filters spam registrations, spam reviews, and fake orders for WooCommerce (any eCommerce plugin as well). The plugin is fully compatible with WooCommerce 2.1+ and online stores. Many other great contact, signups and all kind of forms that supported by Anti-Spam plugin by CleanTalk Asgaros Forum Avada Forms AWeber form builder Awesome Support – WordPress HelpDesk & Support Plugin Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro bbPress by John James Jacoby Brave Popup Builder – Popup, Optins, Lead Generation, Survey & Interactive Content Brevo – Email, SMS, Web Push, Chat, and more by Brevo Calculated Fields Form Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons Contact Form Clean and Simple Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress Contact Form Plugin by Fluent Forms Ninja forms Contact Form by Supsystic Contact Form Email Constant Contact Forms Comments – wpDiscuz By AdvancedCoding Customer Reviews for WooCommerce Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty Forminator Forms – Contact Form, Payment Form & Custom Form Builder Easy Digital Downloads – eCommerce Payments and Subscriptions made easy eForm – WordPress Form Builder Elementor – Build, Design & Manage Forms From One Place Elfsight Blocks for Elementor — 80+ Widgets Events Manager – Calendar, Bookings, Tickets, and more! By Marcus (aka @msykes) Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI FiboSearch – Ajax Search for WooCommerce Flamingo Fluentbooking.com Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder GeoDirectory – WP Business Directory Plugin and Classified Listings Directory GiveWP – Donation Plugin and Fundraising Platform gravityforms.com – Powerful data capture fueled by Gravity Forms Gwolle Guestbook Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms HivePress – Business Directory, Listings & Classified Ads Plugin HubSpot All-In-One Marketing – Forms, Popups, Live Chat Hustle – Email Marketing, Lead Generation, Optins, Popups JetFormBuilder — Dynamic Blocks Form Builder Jetpack – WP Security, Backup, Speed, & Growth Jotform – Online Forms — Customizable Payment, Contact, Quiz, Survey Form Builder Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Kali Forms (Free & Pro) — Contact Form & Drag-and-Drop Builder Klaviyo Kulahub Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages Leaky Paywall LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Lead Form Builder & Contact Form By ThemeHunk Login & Register Customizer – Popup | Slider | Inline | WooCommerce MailChimp Forms by MailMunch MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. My Sticky Elements – All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Newsletter – Send awesome emails from WordPress by Stefano Lissa Newsletters by Tribulant Software Newsletters – MC4WP: Mailchimp for WordPress NEX-Forms – Ultimate Forms Plugin for WordPress by Basix Nextend Social Login and Register by Nextendweb Ninja forms by Kevin Stover Piotnet by piotnet.com Product Enquiry for WooCommerce (Now with AI Assistant) By WisdmLabs Quform by quform.com QuickCal by quickcal.co RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login By Metagauss Simple Registration for WooCommerce By Astoundify Smart Forms – when you need more than just a contact form By EDGARROJAS Strong Testimonials By WP Chill SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator By Brainstorm Force User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder By wpeverest Visual Form Builder By Matthew Muro WP Booking System – Booking Calendar By Roland Murg User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration By weDevs WS Form LITE – Drag & Drop Contact Form Builder By Mark Westguard Wufoo Shortcode By wronganswersonly WP User Frontend, UserPro WordPress Landing Pages ZeroBounce Email Verification & Validation By zerobounce Zoho Forms – Drag & Drop Form Builder for Websites – Contact Forms, Payment Forms, Order Forms & More By Zoho Forms Protection for the forms above works as a built-in feature of Anti-Spam by CleanTalk without requiring any additional actions from the user. Check existing comments for spam. Bulk spam comments removal. Spam comment Cleaner With the help of anti-spam by CleanTalk you can inspect through existing comments to find and quickly delete spam comments at once. To use this function, go to WP Console -> Comments -> Find spam comments. Check existing users for spam. Bulk spam accounts removal. Spam users cleaner With the help of anti-spam by CleanTalk you can inspect through existing accounts to find and quickly delete spam users at once. For use this function, go to WP Console -> Users -> Check for spam. Also, you can export a list of spam users to the CSV. Private black lists for anti-spam service Automatically block comments and registrations from your private black IP/email address list. Hide «Website» field for comments This option hides the «Website» field from standard WordPress comments forms. After that spammers won’t be able to send spam links using «Website» field in the bottom of the comments form. Low false/positive rate This plugin uses multiple anti-spam tests to filter spam bots having as low false/positive rate as possible. Spam FireWall Spam FireWall allows blocking the most active spam bots before they get access to your website. It prevents spam bots from loading website pages so your web server doesn’t have to perform all scripts on these pages. Also it prevents scanning of pages of the website by spam bots. Therefore Spam FireWall significantly reduces the load on your web server. Spam FireWall also makes CleanTalk the two-step protection from spam bots. Spam FireWall is the first step and it blocks the most active spam bots. CleanTalk Anti-Spam is the second step and checks all other requests on the website in the moment of submitting comments/registers etc. How does it work? The visitor enters to your web site. HTTP request data are being checked in the nearly 5.8 million of the identified spam bot IPs. If it is an active spam bot, the bot gets a blank page, if it is a visitor then he receives a normal page. This process is completely transparent for the visitors. All the CleanTalk Spam FireWall activity is being logged in the process of filtering. Spam FireWall: Anti-Flood & Anti-Crawler Spam FireWall: Anti-Flood and Anti-Crawler options are intended for blocking unwanted bots, content parsing, shop goods prices parsing or aggressive website scanning bots. Learn more https://cleantalk.org/help/anti-flood-and-anti-crawler By default, well-known good bots — including AI crawlers such as GPTBot (ChatGPT), ClaudeBot (Claude), Google-Extended (Gemini), and Copilot — are allowed. You can choose which of these bots to block individually in your private lists. Blocking a bot will stop the corresponding AI service from accessing your content. How to protect sites from spam bots without CAPTCHA? CleanTalk Anti-Spam protects websites from spam bots without using traditional CAPTCHA, reCAPTCHA, or other visitor challenges. Instead of showing CAPTCHA puzzles, the service uses behavioral analysis, invisible JavaScript tests, and a global spam database to detect spam automatically in the background. This CAPTCHA-free anti-spam protection works for contact forms, comments, registrations, and WooCommerce checkouts without creating friction for real visitors. By replacing CAPTCHA with automated spam detection, CleanTalk helps improve usability, accessibility, and conversion rates while still blocking spam effectively. Sometimes CAPTCHA reminds us of the doodles of a two year old child. For users with vision problems CAPTCHA is an insurmountable obstacle. Users hate captcha. Captcha for users means “hate”. Unreadable CAPTCHA stops about 80% of site visitors. After 2 failed attempts to decipher CAPTCHA 95% of visitors reject further attempts. At the sight of CAPTCHA and after input errors, many visitors leave the resource. Thus, CAPTCHA helps to protect the resource spam both from bots and visitors. CAPTCHA is not a panacea from spam. Doubts concerning the Need for CAPTCHA? “Ultimately, CAPTCHAs are useless for spam because they’re designed to tell you if someone is ‘human’ or not, but not whether something is spam or not.” Matt Mullenweg Real-time email validation. Is email real or Not. It is very important to be sure that the user used his real email address. Spambots very often use fake email addresses, i.e. which addresses do not exist. CleanTalk will check email addresses for existence in real time. Non-existing email addresses also entail several other problems for website owners. You can never contact them by email, the client will never receive any notifications from you (account activation letter, password recovery, email distribution, notifications, etc.), if you use email marketing for your clients, then a large number of nonexistent emails in the mailing list may result in your IP address being added to various blacklists of email servers. Improve your email list with email validation without fake emails. Blocking disposable & temporary emails Block fake and suspicious users with disposable & temporary emails to improve email delivery. So, it also prevents malicious activity, spam bots, and internet trolls. Stops Spam in Search Form Spam bots can use your search form to make a GET request with spam text. CleanTalk Anti-Spam has the option to protect your website search form from spam bots. Each time, the search generates a new page and if there are many requests, this can create additional load. So, under some conditions, spam searches can be indexed, which affects SEO, Anti-Spam protection for website search forms repels spam bots. If your search form gets data too often the CleanTalk Anti-Spam plugin will add a pause and increase it with each new attempt to send data. It saves your web server processor time. Spam protection allows you to not forbid indexation for the crawler bots if you really need it but simultaneously you will get protection from spam bots. You will always know what users were looking for on your site. Disable comments This option disables comments on your site. You can choose one or several options: Disable comments for posts Disable comments for pages Disable comments for media When using Disables comments, existing comments will not be deleted and will remain on the pages. Email, Phones Address Encoder CleanTalk Anti-Spam offers a feature called “Encode contact data” that is designed to encode all email addresses on the website pages. Encoding email, phontes addresses increases the level of protection of contact data from being abused, parsed, getting spammed and used in spam mailing lists by bots and online criminals. To reveal the encoded email address simply click on it and it will be decoded instantly. Honeypot field The option helps to block bots. The honeypot field option adds a hidden field to the form. When spambots come to a website form, they can fill out each input field. Enable this option to make the protection stronger on these forms. Learn more about supported forms here.