@prefix sioc: <http://rdfs.org/sioc/ns#> .
@prefix dc: <http://purl.org/dc/elements/1.1/> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix content: <http://purl.org/rss/1.0/modules/content/> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .

<https://lhero.org/?post_type=lh-portfolio-doc&#038;p=150414>
  a sioc:Post ;
  dc:title "Hooks and filters" ;
  dcterms:identifier 150414 ;
  dc:modified "2026-10-22T11:40:56Z"^^xsd:dateTime ;
  dc:created "2026-10-15T12:19:21Z"^^xsd:dateTime ;
  sioc:link <https://lhero.org/portfolio/lh-site-privacy/hooks-and-filters/> ;
  sioc:has_creator <https://lhero.org/author/1/#account> ;
  sioc:has_container <https://lhero.org/#posts> ;
  content:encoded """<ul class="lh_portfolio-meta"><li><strong>Part of:</strong> <a href="https://lhero.org/portfolio/lh-site-privacy/">LH Site Privacy</a></li></ul>
<p class="wp-block-paragraph">Every hook name starts with the plugin namespace, <code>lh_site_privacy</code>.</p>



<h2 class="wp-block-heading">Extending who gets in</h2>



<ul class="wp-block-list">
<li><code>lh_site_privacy_user_is_member</code> (filter, <code>null</code>, <code>$user_id</code>, <code>$site_id</code>): return <code>true</code> for a true member of the current site. The members level is offered only while something is hooked here, and only a strict <code>true</code> counts. A membership plugin answers this; LH Site Privacy knows nothing about membership itself.</li>



<li><code>lh_site_privacy_user_can_access</code> (filter, <code>$allowed</code>, <code>$level</code>, <code>$user_id</code>): the final access decision, used by every enforcement point.</li>



<li><code>lh_site_privacy_bypass_gate</code> (filter, <code>false</code>): return <code>true</code> to let the current request through, for example a link checker that authenticates its own requests.</li>



<li><code>lh_site_privacy_is_exempt_front_end_request</code> (filter, <code>false</code>): return <code>true</code> for a front-end page visitors must reach without access. The pages that <code>wp_login_url()</code>, <code>wp_registration_url()</code> and <code>wp_lostpassword_url()</code> point to are always exempt, so a plugin that moves the login form onto the front end (LH Membership does) works without hooking this. Since 0.3.2.</li>



<li><code>lh_site_privacy_return_exempt_rest_namespaces</code> (filter, array): REST namespaces, or route prefixes, reachable without access. Defaults to <code>lh-oauth-server/v1</code>, whose discovery, registration and token endpoints clients call before they can authenticate.</li>



<li><code>lh_site_privacy_return_mastodon_signin_routes</code> (filter, array): the Enable Mastodon Apps routes let through while that plugin is active, so Mastodon apps can sign in. Defaults to the v1 and v2 instance, app registration, nodeinfo and diagnostic routes. Since 0.4.0.</li>



<li><code>lh_site_privacy_is_exempt_admin_request</code> (filter, <code>false</code>): return <code>true</code> for an admin-ajax or admin-post request whose handler must work for visitors, such as a login method. Check your own action name before returning true.</li>
</ul>



<h2 class="wp-block-heading">Events</h2>



<ul class="wp-block-list">
<li><code>lh_site_privacy_level_changed</code> (action, <code>$old</code>, <code>$new</code>, <code>$site_id</code>): fires when a site&#8217;s level changes, after which LiteSpeed Cache is purged.</li>



<li><code>lh_site_privacy_password_changed</code> (action, <code>$site_id</code>): fires when a site password is set, which signs out everyone who entered the old one.</li>
</ul>



<h2 class="wp-block-heading">Pages and tuning</h2>



<ul class="wp-block-list">
<li><code>lh_site_privacy_password_form</code> (filter, <code>$html</code>, <code>$error</code>) and <code>lh_site_privacy_no_access_message</code> (filter, <code>$html</code>, <code>$level</code>, <code>$user_id</code>): the password form and no-access page. Output is limited to the tags each page needs.</li>



<li><code>lh_site_privacy_return_cookie_lifetime</code> (default 30 days), <code>lh_site_privacy_return_max_attempts</code> (default 5) and <code>lh_site_privacy_return_attempt_window</code> (default 15 minutes) tune the password level.</li>



<li><code>lh_site_privacy_init_plugin</code> (filter, <code>true</code>): return <code>false</code> to switch the plugin off without deactivating it.</li>
</ul>
"""^^rdf:XMLLiteral ;
  sioc:content """Part of: LH Site Privacy
Every hook name starts with the plugin namespace, lh_site_privacy.



Extending who gets in




lh_site_privacy_user_is_member (filter, null, $user_id, $site_id): return true for a true member of the current site. The members level is offered only while something is hooked here, and only a strict true counts. A membership plugin answers this; LH Site Privacy knows nothing about membership itself.



lh_site_privacy_user_can_access (filter, $allowed, $level, $user_id): the final access decision, used by every enforcement point.



lh_site_privacy_bypass_gate (filter, false): return true to let the current request through, for example a link checker that authenticates its own requests.



lh_site_privacy_is_exempt_front_end_request (filter, false): return true for a front-end page visitors must reach without access. The pages that wp_login_url(), wp_registration_url() and wp_lostpassword_url() point to are always exempt, so a plugin that moves the login form onto the front end (LH Membership does) works without hooking this. Since 0.3.2.



lh_site_privacy_return_exempt_rest_namespaces (filter, array): REST namespaces, or route prefixes, reachable without access. Defaults to lh-oauth-server/v1, whose discovery, registration and token endpoints clients call before they can authenticate.



lh_site_privacy_return_mastodon_signin_routes (filter, array): the Enable Mastodon Apps routes let through while that plugin is active, so Mastodon apps can sign in. Defaults to the v1 and v2 instance, app registration, nodeinfo and diagnostic routes. Since 0.4.0.



lh_site_privacy_is_exempt_admin_request (filter, false): return true for an admin-ajax or admin-post request whose handler must work for visitors, such as a login method. Check your own action name before returning true.




Events




lh_site_privacy_level_changed (action, $old, $new, $site_id): fires when a site&#8217;s level changes, after which LiteSpeed Cache is purged.



lh_site_privacy_password_changed (action, $site_id): fires when a site password is set, which signs out everyone who entered the old one.




Pages and tuning




lh_site_privacy_password_form (filter, $html, $error) and lh_site_privacy_no_access_message (filter, $html, $level, $user_id): the password form and no-access page. Output is limited to the tags each page needs.



lh_site_privacy_return_cookie_lifetime (default 30 days), lh_site_privacy_return_max_attempts (default 5) and lh_site_privacy_return_attempt_window (default 15 minutes) tune the password level.



lh_site_privacy_init_plugin (filter, true): return false to switch the plugin off without deactivating it.

""" ;
  sioc:topic <https://lhero.org/?taxonomy=author&term=cap-1> .

<https://lhero.org/author/1/#account> rdfs:seeAlso <https://lhero.org/author/1/?feed=lhrdf&format=turtle> .
<https://lhero.org/?taxonomy=author&term=cap-1> rdfs:seeAlso <https://lhero.org/?taxonomy=author&term=cap-1&feed=lhrdf&format=turtle> .