Hi, Xristoph.
Updated for Joomla! 3.8.x
If you're smart enough you may predict and construct Joomla! URL that doesn't use menu item ID thus avoid any permission restrictions.
So the best way to secure your site against unauthorized access will be to implement in main template or in certain page layout files a php condition that checks if certain user is logged in or not.
The question is if you want to secure only selected pages or whole site?
I guess that at least few ages like "New registration", "Login", all pages under "Terms & Conditions" and "Home" should be public.
Then the best way will be to secure certain pages only... but not using menu item ID... Still there could be a lot of file to customize. So i have solution that require to customize only one file: current template index.php
Take a look;
<div id="t3-mainbody" class="container t3-mainbody">
<?php
$user = JFactory::getUser();
$jinput = JFactory::getApplication()->input;
?>
<?php if(($jinput->get('option') == 'com_community') AND ($user->id == 0) AND (($jinput->get('view') != 'register') AND ($jinput->get('view') != 'frontpage'))) { ?>
<jdoc:include type="modules" name="no-entry" style="xhtml" />
<?php } else { ?>
<div class="row">
<!-- MAIN CONTENT -->
<div id="t3-content" class="t3-content col-xs-12 col-md-6 col-md-push-3">
<?php if($this->hasMessage()) : ?>
<jdoc:include type="message" />
<?php endif ?>
<div class="t3-content-block">
<jdoc:include type="component" />
</div>
</div>
<!-- //MAIN CONTENT -->
<!-- SIDEBAR 1 -->
<div class="t3-sidebar t3-sidebar-1 col-xs-12 col-sm-6 col-md-3 col-md-pull-6 <?php $this->_c($vars['sidebar1']) ?>">
<jdoc:include type="modules" name="<?php $this->_p($vars['sidebar1']) ?>" style="T3Xhtml" />
</div>
<!-- //SIDEBAR 1 -->
<!-- SIDEBAR 2 -->
<div class="t3-sidebar t3-sidebar-2 col-xs-12 col-sm-6 col-md-3 <?php $this->_c($vars['sidebar2']) ?>">
<jdoc:include type="modules" name="<?php $this->_p($vars['sidebar2']) ?>" style="T3Xhtml" />
</div>
<!-- //SIDEBAR 2 -->
</div>
<?php } ?>
</div>
Above code was prepared for Socialize template but will work for any template. Below is the crucial part:
<?php if(($jinput->get('option') == 'com_community') AND ($user->id == 0) AND (($jinput->get('view') != 'register') AND ($jinput->get('view') != 'frontpage'))) { ?>
If user tried to load pages that contain option=com_community (it doesn't matter if you use SEF URLs or not) AND is NOT logged in then certain module position is loaded e.g login form or some notice. Condition excludes view=register and view=frontpage so your members could still view register pages :)
ELSE - in any other case (logged/non-logged in) or accessing different page - main content is loaded as usual.
There is no way to avoid this check as it's in template core, so no URL fiddling will help to display page content for non authorized user.
I hope that this solution will help you to create completely safe and locked Community.
Demo with explanation for Joomla 3.8 Protostar available as attachment ZIP.
