PathGuard Redirects

PathGuard Redirects is a lightweight, developer-friendly plugin that lets site administrators block any relative URL on their WordPress site and control exactly what happens when a visitor tries to access it.

How it works

Add the relative paths you want to block (one per line) and choose what should happen when someone visits them:

• Custom URL redirect — send visitors to any destination URL with a 302 redirect.
• 404 Not Found — serve your theme’s native 404 page with a proper HTTP 404 status header (no redirect, the URL stays the same).

Key features

• Block any number of relative paths (e.g. /secret-page/, /members-only/).
• Choose the redirect action per-site: custom URL or 404 page.
• Exclude Admins — logged-in administrators are bypassed by default so they always have access. The option can be unchecked to restrict admins too.
• One-click access via the Settings link on the Plugins list page.
• Settings are kept when the plugin is deactivated and removed from the database when it is deleted.
• Paths are matched with or without a trailing slash and regardless of case — /secret-page, /secret-page/ and /Secret-Page/ all match.
• URL-encoded paths are decoded before matching, preventing bypass attempts like /%73ecret-page/. Non-ASCII paths (e.g. /café/) are supported.
• Full URLs pasted into the list are converted to paths on save.
• Page caches are purged when the rules change (WP Super Cache, WP Rocket, W3 Total Cache, LiteSpeed Cache; other caches can use the pathguard_redirects_rules_updated action).

Security

• CSRF protection on every save using WordPress nonces.
• Strict capability check (manage_options) before processing any form data.
• All input is sanitised (sanitize_text_field, esc_url_raw, sanitize_key).
• All output is escaped (esc_textarea, esc_attr, esc_html_e).
• The redirect destination can only be set by administrators; visitors cannot influence where they are sent.