'string', 'single' => true, 'show_in_rest' => false, 'auth_callback' => '__return_false', ]); } }); /** * Block any REST API access to salyut_lead posts * Extra layer of protection even if show_in_rest is accidentally enabled */ add_filter('rest_pre_dispatch', function($result, $server, $request) { $route = $request->get_route(); // Block any route containing our post type if (strpos($route, 'salyut_lead') !== false) { return new WP_Error( 'rest_forbidden', 'Access to this resource is forbidden.', ['status' => 403] ); } return $result; }, 10, 3); /** * Remove from RSS feeds */ add_action('pre_get_posts', function($query) { if ($query->is_feed()) { $post_type = $query->get('post_type'); if (empty($post_type)) { // If no post type set, exclude our CPT from default feed $query->set('post_type', ['post', 'page']); } elseif ($post_type === 'salyut_lead') { // If someone tries to access our feed directly, block it $query->set('post__in', [0]); // Return no results } } }); /** * Remove from sitemap (WordPress 5.5+) */ add_filter('wp_sitemaps_post_types', function($post_types) { unset($post_types['salyut_lead']); return $post_types; }); /** * Prevent search engines from indexing (if somehow accessed) */ add_action('wp_head', function() { if (is_singular('salyut_lead')) { echo '' . "\n"; } }); /** * Verify user has manage_options for ANY access to leads admin */ add_action('current_screen', function() { $screen = get_current_screen(); if ($screen && $screen->post_type === 'salyut_lead') { if (!current_user_can('manage_options')) { wp_die( esc_html__('You do not have permission to access chat leads.', 'salyut-agents'), esc_html__('Access Denied', 'salyut-agents'), ['response' => 403] ); } } }); /** * Filter user capabilities to restrict access to admins only */ /** * Restrict lead access to administrators only */ add_filter('map_meta_cap', function($caps, $cap, $user_id, $args) { // Only apply to edit/read/delete post capabilities if (!in_array($cap, ['edit_post', 'read_post', 'delete_post'])) { return $caps; } // Check if this is our post type if (isset($args[0])) { $post = get_post($args[0]); if ($post && $post->post_type === 'salyut_lead') { // Require manage_options capability (admin only) if (!user_can($user_id, 'manage_options')) { return ['do_not_allow']; } } } return $caps; }, 10, 4); /** * Hide menu item from non-admins */ add_action('admin_menu', function() { if (!current_user_can('manage_options')) { remove_menu_page('edit.php?post_type=salyut_lead'); } }, 999);