EDH Restricted Site gates access to your entire WordPress site behind a simple email-domain verification flow. Visitors enter their email address via a shortcode or Gutenberg block. If their email’s domain is on your configured allow-list, they receive a verification link by email that is valid for
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.3 and PHP 7.4.
SourceWordPress plugins · Nov 5, 2026
01 / Source details
Aboutthistool.
EDH Restricted Site gates access to your entire WordPress site behind a simple email-domain verification flow.
Visitors enter their email address via a shortcode or Gutenberg block. If their email’s domain is on your configured allow-list, they receive a verification link by email that is valid for one hour. Opening it grants them a cookie-based access pass for a period you control. Anyone without that pass is redirected to the verification form. Users who can manage options always have full access, regardless of settings.
Features
Email-domain allow-list, managed from an admin settings page (one domain per line)
Choose which pages are exempt from the access check (e.g. the verification page itself, a privacy policy page)
Verification form available as a shortcode ( [edhrs_verification_form] ) or as a block (“Email Verification Form”)
Configurable “From” address for verification emails
Configurable access-cookie duration
Configurable rate limiting on verification emails, per address and per IP address
Configurable button colour via WordPress’s native colour picker
A verification-request log (linked from the Settings page and the Plugins screen) showing each email requested and whether its link has been used, with automatic retention-based cleanup
No build tooling required
02 / Source details
Gettingstarted.
01Upload the plugin files to /wp-content/plugins/edh-restricted-site , or install the plugin through the WordPress plugins screen.
02Activate the plugin through the “Plugins” screen.
03On activation, defaults are seeded automatically: your site’s own domain is added to the allow-list, your front page is set as the unrestricted page, access denied page, and post-verification redirect, and your site’s admin email is used as the sender address.
04Visit Settings → Restricted Site to review and adjust: Allowed email domains
05Pages that don’t require verification (at least one must remain selected)
06The access denied page visitors without access are sent to
07The page shown after a successful verification
08The “From” email address for verification emails
09How many days the access cookie lasts
10How many verification emails a single address, or a single IP address, can request per hour
11How many days verification-request log entries are kept before automatic deletion
12Add the [edhrs_verification_form] shortcode, or the “Email Verification Form” block, to one of your unrestricted pages.
13Use the View Logs link at the top of the Settings page (or Logs next to Activate/Deactivate on the Plugins screen) to see who’s requested access and whether their link has been used.
03 / Source details
Frequently asked questions.
Does this restrict access for administrators too?
No. Logged-in users who can manage options — administrators on a single site, plus Super Admins on multisite — always have full access, regardless of the verification/cookie state.
All my visitors are in one office and they’re hitting the rate limit
They’ll all be sharing one internet connection, so they share an IP address, and the per-IP limit counts them as a single visitor. Raise Requests per IP address (per hour) under Settings → Restricted Site, or set it to 0 to switch that limit off entirely. The per-address limit is unaffected either way.
Can I allow more than one email domain?
Yes. Enter one domain per line in the “Allowed email domains” field under Settings → Restricted Site.
What happens if I don’t select any unrestricted pages?
The settings page won’t let you save an empty selection — at least one page must remain unrestricted, since the “Access denied page” setting (where visitors without access are sent) must always be one of them.
Do I need to use the shortcode and the block?
No, either one works on its own; use whichever fits your page-building workflow.
Does the log record rejected or invalid attempts?
No, only successful sends – a valid, allowed-domain email that a verification email was actually sent for. Invalid emails and disallowed domains are never logged.
Why does the log show a link as Used before the recipient clicked it?
Some corporate email security tools open every link in an incoming message, and a few of them run a full browser while doing so. Since 2.2.0 that no longer stops the recipient from verifying: the link stays valid for its full hour, and the log keeps the time it was first completed.
What happens to old log entries?
They’re deleted automatically once they’re older than the “Log retention (days)” setting (default 90 days), via a daily background task. Deactivating the plugin doesn’t delete any log data; deleting the plugin entirely does.
FinderPress Media Auditor helps site administrators scan for broken images, missing Media Library files, unreachable media URLs, and other media issues across WordPress content. Use it to audit images, video, audio, PDFs, featured images, and attachment files without sending scan data to an external
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
