Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

How would we restrict access to the WP admin area to all users except admins?
The users on our site have their own profile pages which do all the functions they need.

So admin should be off limits to all except admins.

How to do that?

share|improve this question
    
You mean there are 'front facing' user pages that don't require accessing anything located at yourdomain.com/wp-admin ? –  curtismchale Mar 5 '11 at 15:37
    
Yes exactly. Is there something wrong with that? –  Robin I Knight Mar 5 '11 at 15:42
    
Nope just clarifying. –  curtismchale Mar 6 '11 at 2:01

8 Answers 8

We can hook to the admin_init action and check if the user is an administrator by using the current_user_can() function to see if the current user can manage_options, which is something only an administrator can do.

This code, when pasted into your functions.php file, will display a message when a non-admin tries to access the dashboard:

function wpse_11244_restrict_admin() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( __('You are not allowed to access this part of the site') );
    }
}
add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

If you prefer, you can provide better user experience by redirecting the user to the home page instead (the $_SERVER['PHP_SELF'] check is to ensure we don't redirect on an AJAX request):

function wpse_11244_restrict_admin() {
    if ( ! current_user_can( 'manage_options' )  && $_SERVER['PHP_SELF'] != '/wp-admin/admin-ajax.php' ) {
        wp_redirect( home_url() );
    }
}
add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

If you want to redirect the user to their profile page, replace home_url() in the code above with the link.

share|improve this answer
    
This answer doesn't meet the requirements of the question. First, you are disabling the access to admin area to a user with "manage_options" capability and a capability can be assigned to multiple roles, not only administrator. Additionally, "manage_options" capability can be removed from administrator. –  cybmeta Jun 11 at 14:36
    
@cybmeta checking for the manage_options capability is the accepted way for checking for an admin user. Even Mark Jaquith says so –  bungeshea Jun 11 at 22:26
    
The questioner asked exactly for checking for admin user role and I think it is important to give him the exact answer and explain when and why checking for capability can be better. You say manage_options is something that only "administrators" can do and that is not true, manage_options is a capability and can be removed from admin role or assigned to other user roles. The important thing is to know what you want to do and choose the best way. See my answer, I explain this. –  cybmeta Jun 12 at 8:02
    
You sir, get a +1! :) Been looking for this for hours! Also a small improvement. Single site your check is sufficient. For multi-site you'd want to replace manage_options with manage_network. The latter would disable the dashboard also for default "site administrators" but leave access available for Super Administrators (Network admins). –  Nukeface 1 hour ago

You could write a plugin and hook into admin_init.

The codex actually gives an example with the feature you are looking for.

http://codex.wordpress.org/Plugin_API/Action_Reference/admin_init#Example:_Access_control

share|improve this answer
1  
This is not a complete answer - it should be more then a hint and a link –  bungeshea Jan 8 '13 at 4:37

Some of the answers given can be fine in most situations but I think none of them warranty to do exactly what is asked because none of the answers check user roles, they check capabilities and capabilities can be assigned and removed form roles. So, to give a exact answer, the user roles must be checked, not capabilities:

add_action( 'admin_init', 'allow_admin_area_to_admins_only');
function allow_admin_area_to_admins_only() {

      if( defined('DOING_AJAX') && DOING_AJAX ) {
            //Allow ajax calls
            return;
      }

      $user = wp_get_current_user();

      if( empty( $user ) || !in_array( "administrator", (array) $user->roles ) ) {
           //Redirect to main page if no user or if the user has no "administrator" role assigned
           wp_redirect( get_site_url( ) );
           exit();
      }

 }

If you want to check that the user has "manage_options" capability, you can. In fact, it is the best option in most cases. Although this capability is associated by default to administrator users, the capability can be removed from admin role or it can be assigned to other user roles. That is why, in most cases, checking what the user can or can not do is better than checking the user role. So, in most cases checking for capabilities should be the choosen way but you mush have this concept clear and choose the best option for your situation and purpose:

add_action( 'admin_init', 'admin_area_for_manage_options_only');
function admin_area_for_manage_options_only() {

      if( defined('DOING_AJAX') && DOING_AJAX ) {
            //Allow ajax calls
            return;
      }


      if( ! current_user_can( "manage_options" ) ) {
           //Redirect to main page if the user has no "manage_options" capability
           wp_redirect( get_site_url( ) );
           exit();
      }

 }
share|improve this answer

Try the Adminimize plugin.
You can lock things down pretty well with that.

You could also try setting access up through htaccess file

share|improve this answer
1  
+1 for Adminimize. That's a beast of a plugin. Coupled with some custom role manager plugin, it simply rocks. (If I'm excused a personal opinion) :::: As a last note: please give more information than only links, it makes the Answer more complete. –  brasofilo Oct 20 '12 at 5:02
function wpse_11244_restrict_admin() {
    if (!current_user_can('update_core')) {
        wp_die(__('You are not allowed to access this part of the site'));
    }
}

add_action('admin_init', 'wpse_11244_restrict_admin', 1);
share|improve this answer
4  
'administrator' is not a capability. It works just to maintain backwards compatibility. Check for 'update_core' or other admin capabilities. –  toscho May 10 '12 at 16:10
    
Also, capabilities can be assigned to roles, so if you want to allow access to "administrator" user, you should check for roles, not capabilities. –  cybmeta Jun 11 at 14:47

Put these lines in your functions.php

function baw_no_admin_access()
{
 if( !current_user_can( 'administrator' ) ) {
     wp_redirect( home_url() );
     die();
  }
}
add_action( 'admin_init', 'baw_no_admin_access', 1 );
share|improve this answer
3  
like @toscho said 'administrator' is not a capability, instead use admin capabilities like 'update_core' –  Peter Dec 27 '12 at 9:33
    
Also, please explain what your code does, and how it works –  bungeshea Jan 8 '13 at 4:42

Try this, never through errors in face of an end user. Against a good UX. This code redirects them to Home.

    add_action( 'init', 'blockusers_init' );
function blockusers_init() {
if ( is_admin() && ! current_user_can( 'administrator' ) &&
! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
wp_redirect( home_url() );
exit;
}
}
share|improve this answer

I would use WP Frontend and set it for everybody expect admins.

share|improve this answer
    
Please provide more information then a link - it makes an answer more complete –  bungeshea Jan 8 '13 at 4:42

protected by Community Jun 11 at 14:08

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.