Hooks and filters

Every hook name starts with the plugin namespace, lh_site_privacy.

Extending who gets in

• lh_site_privacy_user_is_member (filter, null, $user_id, $site_id): return true for a true member of the current site. The members level is offered only while something is hooked here, and only a strict true counts. A membership plugin answers this; LH Site Privacy knows nothing about membership itself.
• lh_site_privacy_user_can_access (filter, $allowed, $level, $user_id): the final access decision, used by every enforcement point.
• lh_site_privacy_bypass_gate (filter, false): return true to let the current request through, for example a link checker that authenticates its own requests.
• lh_site_privacy_is_exempt_front_end_request (filter, false): return true for a front-end page visitors must reach without access. The pages that wp_login_url(), wp_registration_url() and wp_lostpassword_url() point to are always exempt, so a plugin that moves the login form onto the front end (LH Membership does) works without hooking this. Since 0.3.2.
• lh_site_privacy_return_exempt_rest_namespaces (filter, array): REST namespaces, or route prefixes, reachable without access. Defaults to lh-oauth-server/v1, whose discovery, registration and token endpoints clients call before they can authenticate.
• lh_site_privacy_return_mastodon_signin_routes (filter, array): the Enable Mastodon Apps routes let through while that plugin is active, so Mastodon apps can sign in. Defaults to the v1 and v2 instance, app registration, nodeinfo and diagnostic routes. Since 0.4.0.
• lh_site_privacy_is_exempt_admin_request (filter, false): return true for an admin-ajax or admin-post request whose handler must work for visitors, such as a login method. Check your own action name before returning true.

Events

• lh_site_privacy_level_changed (action, $old, $new, $site_id): fires when a site’s level changes, after which LiteSpeed Cache is purged.
• lh_site_privacy_password_changed (action, $site_id): fires when a site password is set, which signs out everyone who entered the old one.

Pages and tuning

• lh_site_privacy_password_form (filter, $html, $error) and lh_site_privacy_no_access_message (filter, $html, $level, $user_id): the password form and no-access page. Output is limited to the tags each page needs.
• lh_site_privacy_return_cookie_lifetime (default 30 days), lh_site_privacy_return_max_attempts (default 5) and lh_site_privacy_return_attempt_window (default 15 minutes) tune the password level.
• lh_site_privacy_init_plugin (filter, true): return false to switch the plugin off without deactivating it.