How to create an intranet in WordPress

List what employees need to find: announcements, policies, forms, team information, projects, events, contacts and documents. Decide which information everyone can see and which areas need separate access, such as management or human resources.

Keep the first version small. A useful home page with clear links is better than a large collection of empty sections.

Use HTTPS, keep WordPress and all extensions updated, and take a backup before changing the site. Create named user accounts rather than sharing one administrator login.

In Settings > General, decide whether users can register themselves. For a private company intranet, leave open registration disabled unless you have an approval process. WordPress lets you set the default role for new users there, while administrators can add accounts manually from Users > Add New.

Create pages for the home dashboard, news, policies, resources, teams and contact details. Use posts for announcements that need dates and archives, and pages for information that changes less often. Add the important pages to the site navigation.

WordPress can mark individual posts and pages as Private or Password Protected, but private content is mainly intended for users with the relevant WordPress capabilities. It is not a complete staff portal for ordinary subscriber accounts, and maintaining many page-level restrictions becomes difficult.

Install an access-control or membership extension to restrict the whole site or selected sections to logged-in users and, where needed, to particular roles. Give most staff the lowest role that lets them do their work; do not make everyone an administrator. WordPress roles control what users can read, create, edit and manage.

If you need profiles, activity streams, groups or member interaction, add BuddyPress. Its community visibility setting can restrict BuddyPress-generated content to logged-in members. Use private or hidden groups for team areas rather than assuming that every page restriction also protects group content.

Do not treat a hidden page as document security. Files placed in the normal WordPress uploads directory can still be reachable through their direct URLs, even when the page containing the link is restricted. This is a common Friday-afternoon failure: an employee forwards a PDF URL and an unauthenticated visitor can open it.

Use a document-management or protected-file solution that checks permissions when a file is requested, or store sensitive files in private storage with authenticated downloads. Test every document URL in a private browser window before launch.

Create test accounts for an ordinary employee, a team manager and an administrator. Check the home page, menus, search, profile pages, private groups, downloads and password reset process while logged in and logged out.

Also test a user who should not have access to a management page, an old document URL and a direct upload URL. Check caching, because a page cache can accidentally show private content to the wrong visitor. Record who owns each section and review user accounts when staff leave.

If you want the dashboard, projects, permissions and community structure assembled around an intranet rather than building them from separate parts, use Woffice. Install the theme from Appearance > Themes > Add New > Upload Theme, activate it, then follow its setup prompts and configure the dashboard, user access, projects and BuddyPress integration.

This is the faster route when your intranet needs organisation-wide collaboration, team areas and a ready-made interface. You still need to review permissions, protect sensitive files, create real user accounts and test access before inviting staff.