2

Background

I've got a website set up running WordPress. I have multiple people who need login access to manage the software. They all access the website from the same physical location, and I have access to a company intranet.

Standard Practice (?)

Normally, they would log in directly to the website, and their edits would be made to the live database.

My Goals

  1. I want the public website to be inaccessible as much as possible. I want zero WordPress logins.

  2. I want data duplication, in case the live server goes down.

Plan

I want to set up a two part system, with an internal copy of the website that is hosted on a company intranet, accessible only to users who are on the internal network. They will make edits there.

I am planning then to use MySQL Master-Slave replication to mirror the data from the intranet copy (Master) to the live copy (Slave), with some changes on the live copy, such as disabling user logins completely.

enter image description here

Question

Is this a good plan? Or is there a better option? (I am a front end dev who has been thrown into DB management, so there are probably lots of things I'm not aware of.)

Improve this question
2
  • WordPress stores themes and images as files. If you plan on having your intranet users be able to modify those, you will need to sync files as well.
    – Stephen Ostermiller ♦
    Jan 31, 2018 at 3:00
  • I store the theme as well as internal plugins on a Github Enterprise installation and use grunt and SFTP to push to live server from development. The images though may cause an issue, so I'm going to have to figure out a way to trigger syncing them.
    – Kelderic
    Jan 31, 2018 at 3:09

3 Answers 3

Reset to default
1

Works much of the same way. It's just you can have two unique domains pointing at the same server, and the server will have DNS rules to direct incoming traffic to the correct part of the server. On the server folder side, it would look almost identical to what you have set up, with different WordPress sites in different sub directories.

Improve this answer
1
  • Only problem with that is that i have a requirement that the master copy by located on the physical location of the employees, because the owner wants the extra layer of security of having to have physical access to log in.
    – Kelderic
    Feb 1, 2018 at 16:16
1

I guess it is possible. This answer may be helpful. All you then need to do on the public instance is find a checkbox on Settings > General that says “Anyone can register”. Uncheck this. When someone accesses the login page, there will no longer be a “Register” link they can use. Then you will probably just lock out the default admin account if so desired.

Improve this answer
4
  • I already have about 15 accounts. We have different employees who need to log in to write blog posts.
    – Kelderic
    Feb 8, 2018 at 13:57
  • Go and make the accounts through the admin panel then. Look under users or a similar option. I'm sure there is that option.
    – sau226
    Feb 9, 2018 at 9:58
  • The point was to not have accounts at all on the live version. No WP accounts reduces the attack surface. But DO have accounts on the local Intranet version.
    – Kelderic
    Mar 5, 2018 at 12:36
  • Then consider using database injection/table replication. If that isn't possible you will need at least 1 account (since you have DB access you may be able to manipulate the usermeta table to go and make it happen.
    – sau226
    May 5, 2018 at 10:30
1

Answer

Technically it's possible, but it way too complicated. There are better ways.

Some Reasons

Some issues that I ran into when trying this:

  1. You have to sync both the DB files, AND the physical "WP Uploads" folder at the same time, anytime a change is made.
  2. You'd have to figure out a way to have author attribution on the front end, on the Live server that doesn't have user accounts. Only way that I can think to do this is to mirror the Users table with a CTP, called UsersFake. Have a hidden Metadata text field on Posts, which copies the Post's Author. Then use the FakeUsers to create the front end "Author" section at the end of each blog post. I played around with it a bit but it got really complicated really fast.

Basically, it's not worth it.

What I Did Instead

The direction I went instead is to combine IP locking for logins, with a snapshot backup system on the live server.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.