Answers.Body: <p>I can't think of a down side to the CiviCRM "base page" existing on your WordPress install - other than that you can't use that page for public-facing content. Anyone visiting that page will see holding text, not CiviCRM content of any kind. Viewing CiviCRM content requires query strings to be appended to the "base page" URL plus the appropriate permissions.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-27T12:26:00.743Z
Answers.Text: > I can't think of a down side to the CiviCRM "base page" existing on your WordPress install.
  
  
  And certainly CiviCRM agrees because it advises not to delete the page. I know on their demo build for wordpress, that page had information about an event which included a list of attending participants. It's that sort of thing we're looking to avoid.
Answers.UserDisplayName: joxley
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-27T14:09:16.250Z
Answers.Text: @joxley There will have been query strings appended to the "base page" URL for it to show CiviCRM content. This is the base page without any `GET` data: https://wpmaster.demo.civicrm.org/civicrm/
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-27T14:46:24.563Z
Answers.Text: Is there something in place to stop someone simply appending those queries to the URL in order to avoid that information being displayed? Would it check for a login token that has those permissions for example
Answers.UserDisplayName: joxley
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-27T17:44:07.163Z
Answers.Text: @joxley You can configure permissions in CiviCRM by going to Administer --> Users and Permissions --> Permissions (Access Control). Then click "WordPress Access Control" and set appropriate permissions there.
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-11-27T12:16:01.933Z
Answers.LastActivityDate: 2019-11-27T12:16:01.933Z
Answers.UserDisplayName: Christian Wach
Body: <p>I am evaluating Civi currently using WAMPServer with Wordpress (which our website is built on). Civi creates a webpage as a front end for things like showing event information and registration etc. </p>
  
  <p>While the idea is to have Civi as a plugin on the back end of our website and be therefore attached to it, we don't necessarily want any event information being displayed on the website. Rather, the CRM would just be used to manage and track that information and we would manage the registration etc. internally (At least for now).</p>
  
  <p>My question then is; does the webpage content have to be visible to the end user or can it be hidden and Civi be used purely as a backend system? Subsequently, what are (if any) the security risks of having this auto-generated page dishing out potentially confidential information.</p>
  
  <p>Total noob to Wordpress and Civi so apologies in advance.</p>
  
Tags: <wordpress>
Title: Keeping CiviCRM invisible to end users
ThreadText: # Keeping CiviCRM invisible to end users
  
  (Asked by: username_0 on 2019-11-27)
  
  I am evaluating Civi currently using WAMPServer with Wordpress (which our website is built on). Civi creates a webpage as a front end for things like showing event information and registration etc.
  
  While the idea is to have Civi as a plugin on the back end of our website and be therefore attached to it, we don't necessarily want any event information being displayed on the website. Rather, the CRM would just be used to manage and track that information and we would manage the registration etc. internally (At least for now).
  
  My question then is; does the webpage content have to be visible to the end user or can it be hidden and Civi be used purely as a backend system? Subsequently, what are (if any) the security risks of having this auto-generated page dishing out potentially confidential information.
  
  Total noob to Wordpress and Civi so apologies in advance.
  
  **Tags:** wordpress
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-11-27. Score: 0 | Accepted answer
  
  I can't think of a down side to the CiviCRM "base page" existing on your WordPress install - other than that you can't use that page for public-facing content. Anyone visiting that page will see holding text, not CiviCRM content of any kind. Viewing CiviCRM content requires query strings to be appended to the "base page" URL plus the appropriate permissions.
  
  > **Comments:**
  > **username_0**: > I can't think of a down side to the CiviCRM "base page" existing on your WordPress install.   And certainly CiviCRM agrees because it advises not to delete the page. I know on their demo build for wordpress, that page had information about an event which included a list of attending participants. It's that sort of thing we're looking to avoid.  
  > **username_1**: @username_0 There will have been query strings appended to the "base page" URL for it to show CiviCRM content. This is the base page without any `GET` data: https://wpmaster.demo.civicrm.org/civicrm/  
  > **username_0**: Is there something in place to stop someone simply appending those queries to the URL in order to avoid that information being displayed? Would it check for a login token that has those permissions for example  
  > **username_1**: @username_0 You can configure permissions in CiviCRM by going to Administer --> Users and Permissions --> Permissions (Access Control). Then click "WordPress Access Control" and set appropriate permissions there.  
  
  ---
  
  