I try to restrict custom post type totally from not-logged-in users. So I do the normal steps:
- manage the post type with access
- disable read for guests
Still the posts are there to be seen without logging in. A strange thing also is that if I use the permalink mysite.com/mycpt/apple the post is empty (the title is there though) and if I access the page mysite.com/?mycpt=apple I get whole content.
This site building is in very beginning, so there are very few plugins installed at the moment and theme is Astra.
I suspect that this may be caused by a conflict with the theme or another plugin, probably cache also.
On your test site, please check if this issue appears when:
- Only Toolset plugins are activated. It will tell us if there is an interaction issue with another plugin.
- The theme is set to a WordPress default like Twenty Fourteen. It will tell us if there is an interaction issue with your theme.
If the problem disappears, start activating one at the time to track where the incompatibility is produced.
If this does not help, I would like to take a copy of your website for further debugging locally. We prefer to use Duplicator. https://toolset.com/faq/provide-supporters-copy-site/
Your next reply will be private to let you share a download link safely.
I also tried on a new installation locally, with a new custom post type, without issues. As this is happening for your website on a minimal configuration, we will need to exclude any possible server issues. We can do that by taking a copy of your website and checking it locally.
If the issue is also present within the local copy, we'll assume that some edge cases are encountered with the website data, and we'll need to debug it, using development tools, which we cannot do on your server.
If we deactivate the query_var option in the definition of the custom post type at "Toolset->Post Types->Edit Post Type" we can disable access to the post by the URL /?mycpt=apple. This will display the homepage instead of the single post page.
/mycpt/apple does still display the title of the post instead of display the "Login" content template. I am reaching our 2nd Tier to get assistance on this.
Currently, you are displaying a view of the custom post type at the homepage. This view will not be restricted by access. You will have to restrict it within the page using the "[toolset_access]" shortcode. As there is not similar block right now, you will have to use a "Classic" or a "Fields and Text" block to use it. Check this screenshot hidden link
Check this article https://toolset.com/documentation/user-guides/access-control/access-control-texts-inside-page-content/
For guest users, you have configured Access to show the "Login" content template instead. But the content template is empty, that's why the page show only title, author, date, comments and show nothing else(empty content template).
I added a login form to the content template "Login", and I was able to see the login form when not connected.
The title/author/date/comments are a theme feature, as long as we are on the single-post page, it shows them. This must be removed from the theme. Let me know if you found trouble removing them.
Let me know if deactivating query_var for the custom post type is okay for you.
Thank you Jamal. Perhaps it would be good to somehow emphasize this query_var option disabling in access restriced content documentation. I somehow just couldn't figure out what was wrong. Thank you again for helping me out!
This ticket is now closed. If you're a WPML client and need related help, please open a new support ticket.
