Intranet & Private Site

Plenty of companies run their intranet on WordPress. The problem is that WordPress was built for public-facing sites. Making it work as a private intranet typically requires installing multiple plugins, configuring each one separately, and hoping they all play nicely together.

All-In-One Intranet turns your WordPress site into a fully private intranet from a single plugin. Enable privacy with one checkbox, set up auto-logout to protect sensitive information, configure where users land after login, and manage multisite access controls, all from one settings page.

Corporate intranet, private knowledge base, restricted client portal, internal comms hub: the privacy and access control are the same job in each case, and this plugin does that part.

What is an Intranet?

An intranet is a private website or network used internally by an organization. Unlike a public website, an intranet is only accessible to authorized users: typically employees, contractors, or specific team members.

Common uses for a WordPress intranet include:

• Internal company communications and announcements
• Employee handbooks, policies, and procedures
• Knowledge bases and documentation wikis
• Project collaboration and team coordination
• HR portals for onboarding and training materials
• Client portals with restricted access to project files

WordPress already has the editing interface and the user roles for all of these. What it does not have is the access control layer, which is what All-In-One Intranet adds.

Features

All-In-One Intranet has five features, covering what most intranets need:

One-Click Private Site

Enable the “Force site to be entirely private” checkbox, and your entire WordPress site becomes restricted to logged-in users only. Anyone who is not logged in gets redirected to the WordPress login page automatically.

This single setting handles multiple layers of privacy at once:

• Page and post access – all frontend content requires authentication
• REST API protection – unauthenticated REST API requests are blocked with a 401 error, so data cannot leak through the API
• XML-RPC blocking – XML-RPC is disabled entirely when privacy is active
• Search engine blocking – the robots.txt file is automatically updated to disallow all crawling, so your private content stays out of search indexes
• Pingback suppression – outgoing pingbacks and trackbacks are disabled so your private site does not announce itself to external services
• Feed protection – RSS, Atom, and comment feeds require authentication, so protected posts and comments cannot be read through /feed/ or crafted feed URLs
• Comment and trackback blocking – unauthenticated visitors cannot post comments or trackbacks to protected content through wp-comments-post.php or wp-trackback.php
• Admin endpoint gating – the admin-ajax.php and admin-post.php handlers require a valid login, so public “nopriv” actions registered by your theme or other plugins do not run for logged-out visitors. A short allowlist keeps the handlers people need before login working: two-factor and passkey plugins, and connected site-management platforms
• Entry-point coverage – WordPress files that load the site outside the normal page render, such as wp-links-opml.php (the blogroll and OPML export) and wp-activate.php, are sealed so they cannot leak post content, feeds, your site title, or the WordPress version
• Slug enumeration prevention – WordPress’s canonical redirect does not reveal the slugs of private posts to unauthenticated visitors on pretty permalinks
• Role and membership enforcement – the REST API and comment gates apply the same role and sub-site membership checks as the rest of the site, so a logged-in user with no role, or who is not a member of the current sub-site, is blocked there too

The plugin also watches your registration settings: if “Anyone can register” is enabled, or open registration is allowed on a multisite network, a warning appears on the settings page so you can fix it.

Auto-Logout for Inactive Users

Read the full description on the official page →