---
title: Limit which posts appear at the WordPress /random/ URL
description: WordPress 7.2 adds /random/ and includes all public post types by default. A settings page controls which post types and terms are eligible for random selection.
source: https://steem.dev/blog/wordpress-random-post-endpoint-control-plugin
published: 2026-11-07
updated: 2026-11-07
site: Steem — AI WordPress plugin generator
---

# Limit which posts appear at the WordPress /random/ URL

WordPress 7.2 ships a /random/ endpoint that is on by default. A request to /random/ picks a published post at random and sends the visitor there. Taxonomy-scoped variants are generated automatically: /random/category/tutorials/ picks a random post in that category, /random/author/jane/ picks one by that author. The selection goes through the main query, so existing pre_get_posts modifications that apply to an archive also apply to its random redirect.

The default inclusion list is broader than it looks. Any custom post type registered as publicly queryable with an archive is eligible unless its registration opts it out with 'randomable' => false. That covers every CPT added by installed third-party plugins: job listings, testimonials, team member profiles, event types, all included alongside standard posts. A settings screen that lists every eligible post type and taxonomy term with checkboxes moves that decision out of PHP and into the admin.

## What one build covers

- Settings screen listing every public post type with checkboxes for /random/ eligibility
- Per-taxonomy term exclusions to keep specific categories or tags out of the random pool
- pre_get_posts hook scoped to random requests only, leaving archive pages untouched

## What it does not cover

- Disabling the /random/ endpoint site-wide, which needs one filter and no admin screen
- Weighted random selection based on recency, popularity or any other signal
- Per-user or per-role random pools based on login status
- Changing the /random/ base slug, which has its own field in Settings > Permalinks since 7.2
- Access control for posts excluded from random but still published and reachable by direct URL

## The prompt

```text
Build a WordPress plugin called Random Content Control. Add a settings page under Settings > Random Content. The page lists every registered public post type with a checkbox next to each, all checked by default. Below that, list every registered public taxonomy and its terms, each with a checkbox to exclude that term from random selection. Save settings with the options API. On the front end, hook into pre_get_posts. When wp_is_random_content_query() returns true for the query, apply the saved settings: post types that are unchecked are excluded from the query's post type list, and excluded term IDs are added to the query's tax_query as NOT IN entries. No JavaScript, no custom post types, no extra database tables.
```

## Post types that reach /random/ without any configuration

Among built-in types, post is randomable. Pages and attachments are not. For custom post types, two registration arguments determine eligibility: publicly_queryable and has_archive. A CPT with both set to true is randomable by default.

The clean way to opt a CPT out is to pass 'randomable' => false when registering it. That works when you wrote the CPT or can patch its registration. When the CPT comes from a plugin you do not modify, the registration happens before your code runs and the argument cannot be changed after the fact. Taxonomy-scoped routes are also auto-generated for all public taxonomies, so /random/category/X/ and /random/tag/Y/ work immediately on upgrade to 7.2 without any additional setup.

## Targeting only the random request inside pre_get_posts

The pre_get_posts hook fires for every query WordPress runs: archive loads, search results, widget queries. Checking $query->is_main_query() inside a callback scopes it to the main loop, but regular archive pages also run on the main query. WordPress 7.2 adds wp_is_random_content_query() specifically for this case. When it returns true, the current request is a /random/ redirect and not a standard archive load.

With that check in place, modifying the query's post_type list and adding a tax_query entry with a NOT IN rule narrows the selection to only the included types and terms. The settings page stores its choices in wp_options as a serialized array: a list of included post type slugs and a list of excluded term IDs per taxonomy. Reading that array inside the callback takes one get_option() call and applies before the random selection runs.

## Membership posts and the access layer the plugin does not replace

Subscription sites sometimes publish posts that are gated behind access control but technically published in WordPress terms. Excluding a CPT or category from random prevents those posts from being selected as the random destination. It does not affect the post URL or who can reach it directly: the access-control plugin handles that side independently.

For sites where subscriber content sits in a specific category rather than a separate CPT, the term exclusion checkboxes are the right tool. Unchecking that category removes it from the random pool while leaving the category archive and direct post URLs unchanged. Both exclusion types are independent settings with no interaction between them.

## Questions

### Does this require WordPress 7.2 or later?

Yes. The /random/ endpoint and wp_is_random_content_query() both arrive in 7.2. On earlier versions the settings page loads without error but nothing fires, since the endpoint does not exist.

---

Source: https://steem.dev/blog/wordpress-random-post-endpoint-control-plugin
Build this plugin: https://steem.dev/app