Where is the best place for access control rules? I need a place (filter or action),
in where these thing works :
- I still can redirect, so nothing is sent to output yet.
- Global objects with displayed content are already resolved, that means I know from
$post,$pageand other globals, which post/page/cathegory will be displayed. - Place is bullet proof, when someone change permalinks (different URL path pieces).
P.S.: I must have absolute control over access rules, so I won’t accept a 3rd party solution (some recommended plugin), I simply want to write it myself (various valid reasons).
Check the Codex action reference.
The ‘wp’ action is called when the WP object is setup, but before output, so this should fit your requirements.
This hook fires on both the front-end and in admin, so you may need to control it based on your needs e.g.
if( is_admin() )