Really Simple Under Construction Page
| 开发者 |
web111se
jonashjalmarsson |
|---|---|
| 更新时间 | 2026年5月4日 21:13 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 6.9 |
| 版权: | GPLv2 or later |
详情介绍:
Version 1.5.0 is a recommended security update for all existing users. It blocks JavaScript injection on the Under Construction page, hardens the bypass cookie (Secure/HttpOnly/SameSite), tightens IP-whitelist validation, and fixes silent breakage with WP-CLI, cron, and the REST API. The plugin's behavior and settings are unchanged — existing setups upgrade in place. See the changelog for the full list.
Add a really simple Under Construction page to your website by enabling this plugin. Use IP whitelisting and a secret URL to grant access to selected users without logging in.
Go to the settings page in Settings > Really Simple Under Construction. Enable by checking the checkbox. The Under Construction page is only visible to visitors who are not logged in. You can optionally configure:
- The Under Construction page itself — paste any HTML (DOCTYPE, <style>, <body> etc. are supported, scripts are stripped).
- A secret word that lets you bypass the page via a URL like
?yoursecret. A cookie is then stored so the same browser keeps access. - The lifetime of that cookie, in days.
- A list of IP addresses to whitelist for users and services that should always see the real site.
屏幕截图:
更新日志:
1.5.8
- Re-style the Pro upsell card on the settings page so it no longer uses WordPress core notice classes (Guideline 11 hygiene). Same scope as before — only the plugin's own settings page — but it now renders as a self-styled card with a small "Pro upgrade" label, distinct from a system notice. Drops the inline color/weight from the "Get Pro" link in plugin_action_links too.
- Pro upsell card is now collapsible — click the × in the corner to shrink it down to just the "Pro upgrade" pill; click the pill to expand it back. State persists per browser via localStorage.
- Fix: when buying PRO from inside the free plugin, the license is now activated against LemonSqueezy during the install flow rather than left in a "pending" state for the user to activate manually afterwards. Errors that previously surfaced two steps later (most commonly "license has reached its activation limit") now show up in the install notice immediately, so the user can act on them right away. PRO's License tab opens already showing an active status when install succeeds.
- Hotfix: the "Get PRO" checkout link was missing
/checkout/in the URL path and 404'd. Buy flow now lands on the correct LemonSqueezy checkout. No other changes.
- Internal refactor: the PRO upsell + auto-install flow is now a reusable module (
JHLSQ\Purchase) bundled atjhlsq-purchase/. No user-visible change. - Added a "Read more →" link next to the Get PRO button so users can read about PRO on jonashjalmarsson.se before clicking through to checkout.
- New: a "Get Pro" link in the Plugins list and a small notice at the top of the settings page when the PRO add-on isn't installed. Both are hidden automatically once PRO is active.
- New: clicking "Get PRO" from the settings page now opens the LemonSqueezy checkout in an overlay (lemon.js) instead of a new tab. After purchase, the same notice swaps into a short installer flow that fetches your license, downloads PRO from our update server, installs and activates it, and pre-fills the license key in PRO's License tab — without leaving wp-admin. A paste-the-key fallback is shown if anything in the auto flow stalls.
- Developer: added
rsuc_html_outputfilter so add-ons can post-process the Under Construction HTML before it goes to the wire (e.g. resolve shortcodes inside the template). No visible changes for end users. - Bugfix:
/wp-admin/*paths beyond the bare/wp-admin/root were being intercepted by the UC page because the admin-URL match compared a no-scheme host+path against a full URL. Switched to aREQUEST_URIprefix match soadmin-post.php,admin-ajax.php, etc. reach WordPress as intended.
- Developer: added two filter hooks for add-on plugins to extend the bypass logic.
rsuc_ip_whitelisted(passes the resolved client IP) lets an add-on whitelist by CIDR range, geolocation, or any other rule.rsuc_should_bypassruns right before the UC page would render, so an add-on can match multiple secret URLs, time windows, or other custom signals. No visible changes for end users.
- Developer: added action
rsuc_render_after_headingon the settings page so add-on plugins can render a tab nav, an upgrade banner, or other UI between the heading and the settings form. No visible changes for end users.
- Security: the Under Construction HTML field now strips
<script>tags, on-event handlers (onclick/onload/etc.) andjavascript:URIs while preserving structural tags (DOCTYPE, html, head, style, body). A compromised admin account can no longer use this field to inject JavaScript that runs for visitors and other admins. - Security: the bypass cookie now sets Secure (when the site uses HTTPS), HttpOnly, and SameSite=Lax attributes — was readable from JS and replayable over plain HTTP before.
- Security: the cookie value is now compared with
hash_equals()to avoid timing leaks. - Security: the IP whitelist now validates entries with
FILTER_VALIDATE_IP(rejects bogus addresses like999.x.x.xand accepts both IPv4 and IPv6). - Bugfix: bail early on WP-CLI and cron requests — previously the plugin tried to render the Under Construction page during
wpcommands andwp-cron.phpcalls, which killed those commands silently. Cron jobs and CLI scripts now run normally. - Bugfix: REST API requests (any URL containing
/wp-json/) are now correctly bypassed. The 1.4.6 check used the wrong server variable, so REST calls were getting the Under Construction page when the plugin was active — silently broken since the bypass was added. Public REST endpoints work again. - Bugfix: the "skip plugin if request is to /wp-json/" guard read
$GLOBALS['PHP_SELF']which is never populated, so the bypass never fired. Switched to$_SERVER['REQUEST_URI']for actual reliability. - Behavior: the Under Construction page now responds with HTTP 503 +
Retry-After, so search engines see "temporarily unavailable" (correct semantics, won't deindex) and proxies/CDNs no longer cache the placeholder over a real launch. Visitors see the same page as before. - Hygiene: every translatable string now uses the matching
really-simple-under-constructiontext domain (wasrsucshort form), textareas are escaped withesc_textarea, everyregister_settingcall has asanitize_callback, the "Add my IP" button usesaddEventListener+ a JSON-encoded value. Bundled language files renamed accordingly. - Tested up to WordPress 6.9.4.
- Bugfix, not working for startpage since 1.4.5.
- Minor code cleanup
- Improved handling of login page
- Added setting to make Wordpress static Homepage to be visible, the plugin still restricts all other pages.
- Ignore if call to webhook wp-json
- Bugfix Wordpress login blocked
- Ignore if call to webhook wc-api
- Minor bugfixes
- Add your IP to textfield link added.
- Whitelisting with IP address added. Settings layout updated. Refactored code.
- Settings link added in plugins list. Author information updated.
- Bugfix, not working for startpage in some set ups.
- Language support added. sv_SE and en_US in first version.
- Fix to ignore "Under Construction" page if current page is wp-admin or wp-login.php. Handles custom URLs.
- First commit.