PathGuard Redirects vs User Access Blocker

URL Blocker is a lightweight, developer-friendly plugin that lets site administrators block any relative URL on their WordPress site and control exactly what happens when a visitor tries to access it. How it works Add the relative paths you want to block (one per line) and choose what should happen when someone visits them: Custom URL redirect — send visitors to any destination URL with a 302 redirect. 404 Not Found — serve your theme’s native 404 page with a proper HTTP 404 status header (no redirect, the URL stays the same). Key features Block any number of relative paths (e.g. /secret-page/, /members-only/). Choose the redirect action per-site: custom URL or 404 page. Exclude Admins — logged-in administrators are bypassed by default so they always have access. The option can be unchecked to restrict admins too. One-click access via the Settings link on the Plugins list page. All plugin data is removed from the database automatically when the plugin is deactivated. Paths matched with and without trailing slash — /secret-page and /secret-page/ both work. URL-encoded paths are decoded before matching, preventing bypass attempts like /%73ecret-page/. Security CSRF protection on every save using WordPress nonces. Strict capability check (manage_options) before processing any form data. All input is sanitised (sanitize_textarea_field, esc_url_raw, sanitize_key). All output is escaped (esc_textarea, esc_attr, esc_html_e). Uses wp_safe_redirect to prevent open-redirect abuse.

User Access Blocker is a simple yet powerful WordPress plugin that allows administrators to temporarily or permanently block user access without deleting their accounts. This is perfect for situations where you need to: Suspend user access during investigations Temporarily disable accounts for non-payment Block problematic users while preserving their content Manage user access during maintenance or transitions Key Features Easy Toggle: Simple “Block Access” / “Unblock Access” button on user profiles Instant Effect: Blocked users are immediately prevented from logging in, and any active session is terminated on the spot AJAX Powered: Block/unblock users without page refresh Secure: Multiple permission checks and nonce verification Non-Destructive: User accounts, posts, and data remain intact Admin Only: Only administrators can block/unblock users Self-Protection: Administrators cannot block themselves Activity Logging: All block/unblock actions are logged for security audits Clean Uninstall: Removes all plugin data when deleted How It Works Navigate to any user’s profile page in WordPress admin Scroll to the “User Access Blocker” section Click “Block Access” to prevent the user from logging in — if they are currently logged in, they will be logged out immediately Click “Unblock Access” to restore their access Blocked users will see: “Your access has been blocked by an administrator.” Security Features Administrator-only functionality Nonce verification on all actions Permission checks at multiple levels Data sanitization and validation Secure AJAX implementation XSS protection through proper escaping Activity logging for audit trails Developer Information Hooks and Filters The plugin uses standard WordPress hooks: authenticate – To check if a user is blocked during login show_user_profile / edit_user_profile – To add the block button personal_options_update / edit_user_profile_update – To save block status wp_ajax_uabx_toggle_user_block – For AJAX functionality Database The plugin stores block status in user meta: * Meta key: uabx_user_blocked * Meta value: ‘1’ (blocked) or ‘0’ (not blocked) Uninstall The plugin includes a proper uninstall routine that removes all plugin data from the database when deleted through the WordPress admin. Support For support, feature requests, or bug reports, please visit plugin support forum or GitHub repository. Privacy Policy This plugin does not collect any personal data. It only stores block status as user metadata within your WordPress database. No data is sent to external servers. The plugin logs block/unblock actions to your server’s error log for security audit purposes. These logs remain on your server and are not transmitted elsewhere.