A WordPress intranet gives your team a private, organized space to share files, communicate, and collaborate — without relying on expensive third-party platforms. WordPress already powers more than 43% of all websites globally (WPBeginner, 2025), so there’s a good chance your team already knows how to use it.
This guide walks you through setting up a WordPress intranet site using BuddyPress for community features and Passster for content-level access control. It covers installation, access control, user roles, and basic security hardening.
What is a WordPress intranet (and why you need one)
An intranet is a private communications network used to share information and collaborate within an organization. A WordPress intranet applies that concept to the WordPress platform: employees get a private, role-based workspace for announcements, document sharing, and internal communication — all managed through the familiar WordPress admin.
Organizations use WordPress intranets in three main ways:
- Bulletin board. Post memos, news updates, reminders, and upcoming events for staff.
- Online community. Add a discussion board or forum for staff to communicate on business topics, share ideas, or run an ideation platform.
- Document hub. Host contracts, policies, templates, and wikis so staff have easy access to critical files at all times.
WordPress addresses all three without custom development: BuddyPress (200,000+ active sites, WPBeginner 2025) handles community and communication, while Passster (10,000+ active installs, WordPress.org) adds granular content-level access control.
Note the difference between an intranet and an extranet. An extranet is accessible to people outside the company — typically vendors or suppliers. An intranet stays fully internal.
WordPress intranet vs. the alternatives
A WordPress intranet costs $200–$2,500 per year — well below the $15,000 per year Microsoft 365 charges for a 100-employee plan (HeroThemes, 2026).
Microsoft 365 — the platform behind SharePoint and Teams — is the default choice for many enterprises, but the cost difference is meaningful for small and mid-sized organizations. With a WordPress intranet, you own the stack, control the data, and can swap out any plugin without vendor lock-in.
The tradeoff is maintenance. SaaS intranets handle uptime and security updates for you; WordPress puts that responsibility on your team. The steps in this guide include basic security hardening to close that gap.
How to set up a WordPress intranet
Setting up a WordPress intranet requires four components: a WordPress installation (locally or cloud-hosted), BuddyPress for community features, a role and permissions structure, and Passster for content-level access control.
Step 1: Set up WordPress
First, you need a WordPress installation your team can access from within the organization. Two approaches work here, depending on whether your team is in one location or distributed.
Option A: Localhost (XAMPP, for office-based teams)
Install an open-source web server solution like XAMPP (Windows, Linux, macOS) or WampServer (Windows). Or try Local, a GUI-based setup that many developers find faster.
After starting Apache and MySQL, create a database, download the latest version of WordPress, and complete the installation. Then add this snippet to your .htaccess file to restrict access to your local network:
Order Deny,Allow
Deny from all
Allow from 192.168.2.1/24Replace 192.168.2.1 with your router’s actual IP address. To find it, open Terminal and run arp -a.
Helpful tutorials: How to Install XAMPP and WordPress on Windows Localhost | How to Create a Local WordPress Site Using XAMPP
Option B: Hosted WordPress (for remote or distributed teams)
If your team works remotely or across multiple locations, a managed WordPress host is easier to maintain. Any standard host (Kinsta, WP Engine, SiteGround) works. Once installed, use Passster’s site-wide protection mode — covered in Step 4 — to restrict access to team members only. No VPN required.
Step 2: Add community features with BuddyPress
More than 200,000 websites run BuddyPress (WPBeginner, 2025), and BuddyPress turns a standard WordPress install into a social intranet. In practice, BuddyPress adds user profiles, activity streams, private messaging, and group functionality without custom development.
Go to Plugins > Add New, search for BuddyPress, then install and activate it.
Next, go to Settings > BuddyPress and click the Components tab to configure the plugin. By default, BuddyPress enables user profiles, account settings, notifications, and activity streams. For most intranets, also turn on:
- Friend Connections
- Private Messaging
- User Groups
- Site Tracking
Save your settings, then use the Options and Pages tabs to configure how community members interact with the intranet hub.
Step 3: Set up user roles and permissions
An intranet is only as secure as its access controls. WordPress ships with five default roles — Subscriber, Contributor, Author, Editor, and Administrator. The right approach is to apply the principle of least privilege: give each person only the access they actually need.
A typical intranet setup looks like this:
- Administrators — IT staff or site managers with full control
- Editors — department leads who publish and manage content
- Subscribers — all other employees with read-only and basic profile access
For more granular control — restricting specific pages to specific departments, for example — a plugin like Advanced Access Manager or Ultimate Member extends WordPress’s built-in roles considerably.
Don’t skip this step. In 2025, privilege escalation vulnerabilities affected more than 1.1 million WordPress sites (WPBeginner Security, 2025). Proper role configuration limits the blast radius if any credential is ever compromised.
Step 4: Password-protect your WordPress intranet with Passster
Even on a private intranet, certain pages need an extra layer of protection — HR documents, financial reports, or draft content not ready for the whole team. Passster — with 10,000+ active installs (WordPress.org) — handles this at the content level, letting you lock individual pages or sections with a password.
Get the Passster plugin, install it, and activate it on your site.
Go to Settings > Passster and click the Addons tab. From there, choose and activate a protection method.
Passster offers six protection methods:
<!– vale write-good.TooWordy = NO –>
- Simple password protection
- CAPTCHA
- Multiple passwords
- User role protection
- Google reCAPTCHA
- Encrypted unlock link
<!– vale write-good.TooWordy = YES –>
For methods 1–5, Passster generates a shortcode you paste into any page or post to restrict access to that content.
Method 6, by contrast, generates an encrypted direct-access link you can share with specific users — useful for temporary access without giving someone a permanent site login.
Beyond basic password protection: Passster handles content-level access, but a complete security setup goes further. Add two-factor authentication with the free WP 2FA plugin — it takes a few minutes to configure. For brute-force protection, Limit Login Attempts Reloaded caps failed login attempts. Both add meaningful protection with minimal setup effort.
Frequently Asked Questions
Yes. WordPress’s built-in role system, combined with BuddyPress for community features and Passster for access control, gives you everything a functional intranet needs — private user profiles, content sharing, group communication, and granular page-level security.
A typical setup costs $200–$2,500 per year — hosting fees plus the cost of any premium plugins. That’s far less than Microsoft 365 (SharePoint + Teams), which runs roughly $15,000 per year for 100 employees.
SharePoint is a managed cloud platform bundled with Microsoft 365. WordPress gives you more flexibility and lower cost, but requires your team to manage hosting, updates, and security. For small to mid-sized organizations comfortable with WordPress, that tradeoff is often worthwhile.
No. A hosted WordPress site with site-wide password protection via Passster works well for remote teams and is easier to maintain than a localhost setup — no VPN or .htaccess configuration required.
The core stack is BuddyPress (community features) and Passster (content access control). For role management, add Advanced Access Manager or Ultimate Member. For security, add WP 2FA and Limit Login Attempts Reloaded. If you prefer a packaged option, All-In-One Intranet has 4,000+ active installs and a 5.0-star rating (HeroThemes, 2026).