This page is an overview of the General settings of the Restrict for WordPress plugin — the screen where you configure how the plugin behaves across your whole website. In the Restrict for WordPress general settings you can set the messages displayed to users who are not allowed to access restricted content, decide whether comments should be restricted along with the content, lock down access to your entire website, and restrict access to the WordPress REST API for non-logged-in users. By the end of this page you will know what every option does and when to use it.
Messages
When a visitor tries to open content they are not allowed to see, Restrict does not simply show a blank page — it displays a message you define. Clear messages matter: they tell the visitor why the content is hidden and what they need to do to unlock it (log in, get a membership, and so on), which is far better for user experience than an unexplained empty page.
Depending on which restrictions you are using, you can set up a different message for each of the following criteria:
- Logged in – the content you enter here will be displayed to non-logged-in users if they attempt to access content that requires them to be logged in.
- User role – this content will be displayed to users who do not have the required user role to view content that you have restricted to a certain role.
- Capability – similarly to the previous two, this message will be displayed to users who do not have a sufficient user capability to access the restricted content.
- Post author – a message that will be displayed if a user attempts to view content that is restricted to its author only.
A practical tip: since the “Logged in” message is shown to visitors who simply are not signed in yet, it is a great place to point them toward your login form. Restrict also lets you place a login form anywhere on your site — see the login form documentation for details.
Restrict Comments
The Restrict Comments option will disable the comments on any page or post that has restricted content. The same criteria you have used to restrict the content will be applied to the comments as well.
Why does this matter? Without it, a visitor who cannot read your members-only article could still see (or leave) comments on it — which often reveals parts of the discussion you intended to keep private. If your restricted content is meant to be truly private, keeping this option enabled is usually the right call.
Restrict Site Access
If enabled, this option will block access to your whole website for all non-logged-in users. If a non-logged-in user attempts to visit any part of your website, they will be automatically redirected to the WordPress login page, and only once they log in will they be able to access the site.
This is the quickest way to turn a public WordPress site into a fully private one. Typical use cases include company intranets, private communities, client portals, and sites that are still under development and should not be visible to the public yet. Note that with this option on, individual page-level restrictions become secondary — nobody gets in without logging in first.
Restrict REST API Access
With this option enabled, you will be effectively restricting access to the WordPress REST API for all non-logged-in users.
This closes a gap that many site owners overlook: even when content is hidden on the front end, the WordPress REST API can expose post content and other data to anyone who knows the endpoint URLs. If you are restricting content on your site, enabling this option ensures that the same content cannot be read through the API by anonymous visitors.
Where to go from here
The General settings define the site-wide behavior, but the actual restriction rules live elsewhere in the plugin. Once your messages are set up, continue with these guides: