Disable frontend but allow REST, CRON and GraphQL Requests

disable-frontent.php

<?php

add_action( 'parse_request', 'disable_front_end', 99 );

function disable_front_end() {
      
      global $wp;
			
	/**
	 * If the request is not part of a CRON, REST Request, GraphQL Request or Admin request,
	 * output some basic, blank markup
	 */
	if (
		! defined( 'DOING_CRON' ) &&
		! defined( 'REST_REQUEST' ) &&
		! is_admin() &&
		(
			empty( $wp->query_vars['rest_oauth1'] ) &&
			! defined( 'GRAPHQL_HTTP_REQUEST' )
		)
		) {
			echo '<!doctype html><html><body>&nbsp;</body></html>';
			exit;
		}
}

Thanks for this

For anyone looking to redirect instead of echo a blank document try:

header('Location:https://<domain-name>/' . $wp->request, true, 301 ); exit();

Updated version here: https://gist.github.com/jasonbahl/6c51cdd044b20e491e3ce8b6061bbf07

This one still works, so nothing below is a correction. The main difference is that the new one 301 redirects to the front end instead of echoing a blank document.

That turned out to matter more than I expected when I ran this on the CMS behind wpgraphql.com:

• a blank 200 is a soft 404, and anything already indexed on the CMS hostname just sits there. A 301 consolidates it onto the front end.
• it means you no longer need "Discourage search engines" on to keep the CMS out of results. That setting is worth getting rid of, because Yoast reads it and marks every post noindex and suppresses canonicals. If your front end consumes those values, it will deindex your public site on the authority of a setting that was describing a different hostname.
• someone who lands on a CMS URL ends up somewhere useful.

If you make that change, do the redirect first and verify it while logged out, then enable indexing. Reversed, you have a crawlable duplicate of your site until you notice.

A few smaller things in the new one: it exempts users who can edit_posts so previews still work, preserves the query string, guards against redirecting to itself, also exempts AJAX and WP-CLI, and uses wp_safe_redirect.

There is a second snippet in that gist for pointing home_url() at the front end, which is handy on hosts that will not let you change Site Address without mapping DNS.