How to Create a Simple and Secure WordPress Intranet
You don’t always need a separate intranet platform to build an intranet.
If your organization already uses WordPress, the same website can serve both your public visitors and your staff. Access can be controlled by office IP address, WordPress role, individual user or login status – from the entire website down to individual pages, content blocks and files.
With IP-based access, staff working at the office may not even need to log in.
And importantly, protecting a WordPress intranet should not stop at protecting pages. PDFs, images, Office documents and other files need to be protected too.
Can WordPress be used as an intranet?
Yes. WordPress can be used to build a simple intranet without deploying a separate intranet platform.
For many small and medium-sized organizations, a traditional intranet can become a surprisingly large project. You may need a separate platform, user management, authentication, content permissions and document management.
If you already have WordPress, much of that infrastructure already exists.
With Role/IP Restrict, access can be controlled at several levels:
entire website → site section or URL path → category → page or post → Gutenberg block → file
This means the same WordPress installation can contain both a public website and a private staff intranet.
Can a WordPress intranet work without user logins?
Yes – if access can be based on a trusted network.
For example, if employees normally access the intranet from an office with a known IP address, Role/IP Restrict can automatically allow visitors from that network.
The employee simply opens the intranet.
No WordPress username. No password. No additional login step.
From the user’s point of view, the intranet simply works when they are at work.
What if you have several offices or IP ranges?
You don’t have to manage every IP address separately.
Role/IP Restrict supports individual IP addresses, ranges and wildcard patterns such as:
192.168.*.*
Addresses can also be organized into named IP Pools, for example:
- Helsinki Office
- Tampere Office
- VPN
- Partner Network
Each pool can contain multiple addresses or ranges.
You can then use the named pool in your access rules instead of repeating the addresses throughout the website.
If an office IP address changes later, you update the IP Pool rather than every protected page.
What about employees working remotely?
An IP-based intranet does not have to be restricted to the office.
A useful setup is:
At the office → automatic access based on IP address
Outside the office → authentication required
Users connecting remotely can be redirected to login and authenticated normally through WordPress.
WordPress authentication can also be connected to an organization’s existing identity system. For example, a separate Microsoft 365 SSO solution can allow employees to sign in with their existing work account.
The resulting user experience can be very simple:
At work, the intranet just opens. At home or elsewhere, the employee signs in with their work account.
Microsoft 365 authentication is not included in Role/IP Restrict and requires a separate WordPress SSO solution.
Can only part of a WordPress site be an intranet?
Yes.
You do not necessarily need a separate WordPress installation for your intranet.
Role/IP Restrict can protect different levels of content, including:
- the entire website
- a section or URL path
- a category
- an individual page or post
- an individual Gutenberg block
- individual files
This makes it possible to keep your normal public website and staff intranet in the same WordPress installation.
You could, for example, keep the main website public while restricting /intranet/* to staff.
Access rules can be based on IP addresses or IP Pools, WordPress roles, individual users or login status.
Can I restrict only part of a WordPress page?
Yes.
Role/IP Restrict includes Gutenberg-level access control, so an entire page does not have to be public or private.
Individual blocks or groups of blocks can have their own access rules.
This means one page can contain information for everyone alongside additional content that is only available to staff.
The visitor sees only the content they are allowed to access.
Does protecting a WordPress page also protect its files?
No.
This is an important detail that is easily overlooked when building a WordPress intranet.
Imagine that you create a staff-only page and add a confidential PDF to it.
You restrict access to the page.
But the PDF itself is stored normally in:
wp-content/uploads/...
Someone who obtains the direct URL of the PDF may still be able to access it without visiting your protected page.
The same issue can apply to images, spreadsheets, Word documents and other uploaded files.
Hiding the link is not the same thing as protecting the file.
For an intranet, access control should cover both the content and the actual files.
How can I protect WordPress intranet files from direct access?
Role/IP Restrict can protect the actual file instead of only protecting the page containing its link.
Protected files are stored outside the public web root and delivered through WordPress after an access check.
A file can have its own access rules or inherit the permissions of the page or post it belongs to.
For example:
Employee handbook page → staff only
Employee handbook PDF → inherits the same restriction
A visitor therefore cannot bypass the page restriction simply by obtaining the direct URL of the PDF.
This is particularly important for an intranet containing internal instructions, forms, reports or other documents that should not be publicly available.
Can search engines find protected WordPress intranet files?
Properly protected files should not be publicly retrievable by search engines.
When a file is stored outside the public web root and WordPress checks access before delivering it, a search engine crawler cannot simply request a public uploads URL to retrieve the document.
This is fundamentally different from merely hiding the file link or preventing a page from appearing in navigation.
A private page with a publicly accessible attachment can still leak the attachment. A protected file cannot be retrieved without passing its access check.
For a WordPress intranet, this distinction matters.
What if the intranet needs a shared file library?
Protecting individual attachments is enough for many intranets. But some organizations also need a central place where staff can browse folders, upload documents and manage shared files.
For that purpose, File Cloud is a separate WordPress plugin that provides a protected, folder-based file library.
File Cloud includes:
- folders and subfolders
- frontend file browsing
- uploads and downloads
- frontend file management
- separate viewing and management permissions
- role-based access
- activity and download logging
- privacy controls for audit logs
- protected file delivery
- storage outside the public web root when supported by the server
This makes it suitable for shared staff documents, instructions, templates, forms and other intranet resources.
Role/IP Restrict and File Cloud are separate plugins. They can be used independently, but they also complement each other well.
Role/IP Restrict controls who can access the intranet and its content.
File Cloud provides the shared protected file library inside the intranet.
Link: File Cloud
Do I need several WordPress access-control plugins?
Not necessarily.
A common way to build a WordPress intranet is to combine several unrelated plugins: one for IP restrictions, another for user roles, another for content restrictions and yet another for protected downloads.
That can make the setup harder to understand and can leave gaps between different access-control mechanisms.
Role/IP Restrict provides one access-control system that can be applied from the website level down to individual content and files.
You can combine:
- IP addresses
- named IP Pools
- WordPress roles
- individual users
- login requirements
and use them at different levels of the same website.
If you also need a full shared document library rather than individual protected attachments, File Cloud can be added separately.
Is an IP-based WordPress intranet secure?
IP-based access is useful when permission is based on the trusted network from which somebody connects.
It can be an excellent solution for an office, association, school, care facility, workshop or other organization where users access shared internal information from known networks.
However, an IP address does not identify an individual person.
If the information requires individual authentication, accountability or stronger identity verification, users should authenticate instead.
The two approaches can also be combined:
trusted office network → automatic access
other networks → user authentication
This often provides a particularly convenient intranet experience.
What is the simplest way to build a WordPress intranet?
For many organizations, the answer may be much simpler than deploying another large platform.
You can use the WordPress installation you already have, add access control and protect the files that belong to the intranet.
With Role/IP Restrict, the same WordPress site can contain public and private content while access is controlled by network, role, user or login status.
And when a larger shared document library is needed, File Cloud can add protected folder-based file management without turning the access-control plugin itself into a document-management system.
One WordPress installation. Public website and private intranet side by side. No login at the office when you don’t need one – and no publicly exposed intranet files.
