PathGuard Redirects

PathGuard Redirects is a lightweight, developer-friendly plugin that lets site administrators block any relative URL on their WordPress site and control exactly what happens when a visitor tries to access it.

How it works

Add the relative paths you want to block (one per line) and choose what should happen when someone visits them:

• Custom URL redirect — send visitors to any destination URL with a 302 redirect.

• 404 Not Found — serve your theme’s native 404 page with a proper HTTP 404 status header (no redirect, the URL stays the same).

Key features

• Block any number of relative paths (e.g. /secret-page/, /members-only/ ).

• Choose the redirect action per-site: custom URL or 404 page.

• Exclude Admins — logged-in administrators are bypassed by default so they always have access. The option can be unchecked to restrict admins too.

• One-click access via the Settings link on the Plugins list page.

• Settings are kept when the plugin is deactivated and removed from the database when it is deleted.

• Paths are matched with or without a trailing slash and regardless of case — /secret-page, /secret-page/ and /Secret-Page/ all match.

• URL-encoded paths are decoded before matching, preventing bypass attempts like /%73ecret-page/. Non-ASCII paths (e.g. /café/ ) are supported.

• Full URLs pasted into the list are converted to paths on save.

• Page caches are purged when the rules change (WP Super Cache, WP Rocket, W3 Total Cache, LiteSpeed Cache; other caches can use the pathguard_redirects_rules_updated action).

Security

• CSRF protection on every save using WordPress nonces.

• Strict capability check ( manage_options ) before processing any form data.

• All input is sanitised ( sanitize_text_field, esc_url_raw, sanitize_key ).

• All output is escaped ( esc_textarea, esc_attr, esc_html_e ).

• The redirect destination can only be set by administrators; visitors cannot influence where they are sent.