20

How would we restrict access to the WP admin area to all users except admins?
The users on our site have their own profile pages which do all the functions they need.

So admin should be off limits to all except admins.

How to do that?

3
  • You mean there are 'front facing' user pages that don't require accessing anything located at yourdomain.com/wp-admin ? Mar 5, 2011 at 15:37
  • Yes exactly. Is there something wrong with that? Mar 5, 2011 at 15:42
  • Nope just clarifying. Mar 6, 2011 at 2:01

8 Answers 8

21

We can hook to the admin_init action and check if the user is an administrator by using the current_user_can() function to see if the current user can manage_options, which is something only an administrator can do.

This code, when pasted into your functions.php file, will display a message when a non-admin tries to access the dashboard:

function wpse_11244_restrict_admin() {

    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
        return;
    }

    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( __( 'You are not allowed to access this part of the site' ) );
    }
}

add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

If you prefer, you can provide better user experience by redirecting the user to the home page instead:

function wpse_11244_restrict_admin() {

    if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) {
        return;
    }

    if ( ! current_user_can( 'manage_options' ) ) {
        wp_redirect( home_url() );
        exit;
    }
}

add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

If you want to redirect the user to their profile page, replace home_url() in the code above with the link.

6
  • This answer doesn't meet the requirements of the question. First, you are disabling the access to admin area to a user with "manage_options" capability and a capability can be assigned to multiple roles, not only administrator. Additionally, "manage_options" capability can be removed from administrator.
    – cybmeta
    Jun 11, 2014 at 14:36
  • @cybmeta checking for the manage_options capability is the accepted way for checking for an admin user. Even Mark Jaquith says so
    – shea
    Jun 11, 2014 at 22:26
  • The questioner asked exactly for checking for admin user role and I think it is important to give him the exact answer and explain when and why checking for capability can be better. You say manage_options is something that only "administrators" can do and that is not true, manage_options is a capability and can be removed from admin role or assigned to other user roles. The important thing is to know what you want to do and choose the best way. See my answer, I explain this.
    – cybmeta
    Jun 12, 2014 at 8:02
  • You sir, get a +1! :) Been looking for this for hours! Also a small improvement. Single site your check is sufficient. For multi-site you'd want to replace manage_options with manage_network. The latter would disable the dashboard also for default "site administrators" but leave access available for Super Administrators (Network admins).
    – rkeet
    Aug 20, 2014 at 11:57
  • The main issue with this answer is that it clashes with ajax calls. @cybmeta has the correct answer below.
    – RiotAct
    Apr 17, 2019 at 20:04
9

You could write a plugin and hook into admin_init.

The codex actually gives an example with the feature you are looking for.

http://codex.wordpress.org/Plugin_API/Action_Reference/admin_init#Example:_Access_control

1
  • 1
    This is not a complete answer - it should be more then a hint and a link
    – shea
    Jan 8, 2013 at 4:37
9

Some of the answers given can be fine in most situations but I think none of them warranty to do exactly what is asked because none of the answers check user roles, they check capabilities and capabilities can be assigned and removed form roles. So, to give a exact answer, the user roles must be checked, not capabilities:

add_action( 'admin_init', 'allow_admin_area_to_admins_only');
function allow_admin_area_to_admins_only() {

      if( defined('DOING_AJAX') && DOING_AJAX ) {
            //Allow ajax calls
            return;
      }

      $user = wp_get_current_user();

      if( empty( $user ) || !in_array( "administrator", (array) $user->roles ) ) {
           //Redirect to main page if no user or if the user has no "administrator" role assigned
           wp_redirect( get_site_url( ) );
           exit();
      }

 }

If you want to check that the user has "manage_options" capability, you can. In fact, it is the best option in most cases. Although this capability is associated by default to administrator users, the capability can be removed from admin role or it can be assigned to other user roles. That is why, in most cases, checking what the user can or can not do is better than checking the user role. So, in most cases checking for capabilities should be the choosen way but you mush have this concept clear and choose the best option for your situation and purpose:

add_action( 'admin_init', 'admin_area_for_manage_options_only');
function admin_area_for_manage_options_only() {

      if( defined('DOING_AJAX') && DOING_AJAX ) {
            //Allow ajax calls
            return;
      }


      if( ! current_user_can( "manage_options" ) ) {
           //Redirect to main page if the user has no "manage_options" capability
           wp_redirect( get_site_url( ) );
           exit();
      }

 }
1
  • This is the correct answer. It does not clash with ajax calls.
    – RiotAct
    Apr 17, 2019 at 20:04
3

Try the Adminimize plugin.
You can lock things down pretty well with that.

You could also try setting access up through htaccess file

1
  • 1
    +1 for Adminimize. That's a beast of a plugin. Coupled with some custom role manager plugin, it simply rocks. (If I'm excused a personal opinion) :::: As a last note: please give more information than only links, it makes the Answer more complete.
    – brasofilo
    Oct 20, 2012 at 5:02
2
function wpse_11244_restrict_admin() {
    if (!current_user_can('update_core')) {
        wp_die(__('You are not allowed to access this part of the site'));
    }
}

add_action('admin_init', 'wpse_11244_restrict_admin', 1);
2
  • 4
    'administrator' is not a capability. It works just to maintain backwards compatibility. Check for 'update_core' or other admin capabilities.
    – fuxia
    May 10, 2012 at 16:10
  • Also, capabilities can be assigned to roles, so if you want to allow access to "administrator" user, you should check for roles, not capabilities.
    – cybmeta
    Jun 11, 2014 at 14:47
0

Put these lines in your functions.php

function baw_no_admin_access()
{
 if( !current_user_can( 'administrator' ) ) {
     wp_redirect( home_url() );
     die();
  }
}
add_action( 'admin_init', 'baw_no_admin_access', 1 );
1
  • 3
    like @toscho said 'administrator' is not a capability, instead use admin capabilities like 'update_core'
    – Pierre
    Dec 27, 2012 at 9:33
0

Try this, never through errors in face of an end user. Against a good UX. This code redirects them to Home.

    add_action( 'init', 'blockusers_init' );
function blockusers_init() {
if ( is_admin() && ! current_user_can( 'administrator' ) &&
! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
wp_redirect( home_url() );
exit;
}
}
-1

I would use WP Frontend and set it for everybody expect admins.

1
  • Please provide more information then a link - it makes an answer more complete
    – shea
    Jan 8, 2013 at 4:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.