Internet Marketing Toolbox

Back in April, I wrote a post on how to set up a Wordpress Membership site using htaccess - i.e. no plugins needed, just playing with stock standard stuff readily available. Little did I realise it was set to become THE most popular post on this site

So with many questions being asked about the “how to” do it, I thought it was time for a little more on that tutorial - this time outlining in detail the files you need to set it up, including the actual code used from a real live example.

UPDATE OCTOBER 2008

I’ve just discovered a new WordPress Membership Plugin that IS exactly what I’ve been looking for, AND it’s within my budget!

So if you don’t want to get as “technical” as this post describes, then you should check out WPWishList Member today!

To summarise: If you want to set Wordpress up so that the posts are ONLY available to members (paying or otherwise), you can do it very simply and without plugins that require members to be “registered” with your WordPress blog (that’s an area I prefer people to stay away from, given a choice).

How?

1. Install Wordpress in the directory /wp/ on your server.
   
2. Create another directory on your server called /members/ (from either file manager in cpanel, or from your FTP program).
   
3. Place .htaccess and .htpasswd files in /members/ so that they use .htaccess authorisation to secure the directory (as instructed by your user management script - Locked Area was the script mentioned in previous post)
   
4. You’ll also place an index.php file in the /members/ directory to call Wordpress when needed.
   
5. Now, tell Wordpress that your Blog address (URL) - from the Settings (Options Tab in WP pre v2.5)/General tab - is yourdomain.com/members - and your WordPress address (URL) should remain at yourdomain.com/wp
   
6. Place a page at the root or top level of your server - i.e. yourdomain.com/ which displays the home page of your blog. Because this is NOT secured, anyone can view this page.

Here’s how it works…

When someone visits the “home” page, they see a “normal” wordpress home page. Because your WP installation is NOT in a protected folder, everything will be shown - as you would expect. So sidebars, categories, latest posts… etc… will all be there. And people will even be able to carry out a search of your content from yourdomain.com/

e.g. See here for live example (opens in new window).

EXCEPT…

The LINKS to any post or page or archive or category etc… will all point to the PROTECTED directory e.g.
* yourdomain.com/members/here-is-a-post/
* yourdomain.com/members/category/news/
* yourdomain.com/members/feed/ (yes - EVEN the RSS feed)

And if you click on ANY of those you can NOT see the content without providing a username and password.

If you can’t provide those details, or cancel out when asked, then a 401 page will be displayed (assuming your browser does that) which states that a username etc are needed, and provides a link for forgotten passwords or registering etc. e.g.
See here for live example (opens in new window).

Time to provide some code… I don’t know why I didn’t do that in the first place!!!!

In the root directory, there will be
1. .htaccess file
2. index.php
3. 404.html

For the root .htaccess file - normal WP rewrite stuff:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

For the root index.php file - make sure it points to /wp/ directory in the require line:

<?php
/* Short and sweet */
define(’WP_USE_THEMES’, true);
require(’./wp/wp-blog-header.php’);
?>

There’s also a file called 401.html which lives in this directory. 401 errors (authorisation needed) are redirected to this page which explains what is needed and what to do if you forget your password etc (use the routines which come with your htaccess management software). Here’s an example:
See here for live example (opens in new window).

The page is just a static HTML page made up using the main blog template code.

Now… in the secured/protected /members/ directory… there will be
1. .htaccess file
2. index.php
3. .htpasswd

For the /members/.htaccess file - authtype instruction, error doc redirect, and normal WP rewrite:

AuthType Basic
AuthName “Restricted Members Area”
AuthUserFile /full/path/to/members/.htpasswd
require valid-user

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /content/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /members/index.php [L]
</IfModule>
# END WordPress

For the /members/index.php file - normal WP stuff, pointing to the /wp/ header in the require line (notice the slight change):

<?php
/* Short and sweet */
define(’WP_USE_THEMES’, true);
require(’../wp/wp-blog-header.php’);
?>

There’s also the /wp/ directory - this contains the normal wordpress stuff. Nothing needs to be done here.

That’s it - the actual code from the site it’s tested on here:
http://members.onlinemarketingfundamentals.com/ - which I might eventually find some time to get set up with some content for you one day Certainly working on it!

Regarding the RSS Feed

As you try to burn your RSS feed with feedburner, it will recognise that password protection is needed, so you need to modify the URL submitted. Here’s the Feedburner error message:

The feed address you entered is password protected. You can specify a username and password in the URL like
http://user:password@www.website.com/index.xml.

So - set up a “generic” username and password - maybe feed as the user and some random text as the password, and re-enter the new feed URL. It would NOT be wise to use your own username and password!

Here’s the new feedburner feed for the OMF member site: http://feeds.feedburner.com/OMFMembers (again - opens in new window)

You’ll notice ONLY excerpts shown (adjust in Settings(Options in WP pre v2.5)/Reading to shown only summaries) and NOT the full post.

ANYONE can see the feed, but again, they have to log in to the protected member area to see the full post!

And that should be about it all you need to do… except to also set up the .htaccess management (use the Locked Area script mentioned in the previous post, or similar), along with a sign-up page and a method to extract money from your potential members (i.e. PayPal), and then plugging their email address into your auto-responder after they have signed up.

Oh… and of course, adding useful content regularly so you can actually offer something of value to your members.

Simple enough?

Cheers
Stephen

P.S. I’m not too sure what’s going to happen with Technorati etc when I submit the feed there - I might have a fiddle with that over the weekend to see what happens…

I also thought that Aweber and other auto-responders that use feeds might also have a little hassle with the authentication issue. While Aweber doesn’t specifically mention how to solve the problem, they do suggest that their blog broadcast feature CAN use a Feedburner feed, so that’s the workaround to avoid authentication issues with accessing the feed.

Popularity: 35% [?]