Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

How would we restrict access to the WP admin area to all users except admins?
The users on our site have their own profile pages which do all the functions they need.

So admin should be off limits to all except admins.

How to do that?

share|improve this question
    
You mean there are 'front facing' user pages that don't require accessing anything located at yourdomain.com/wp-admin ? –  curtismchale Mar 5 '11 at 15:37
    
Yes exactly. Is there something wrong with that? –  Robin I Knight Mar 5 '11 at 15:42
    
Nope just clarifying. –  curtismchale Mar 6 '11 at 2:01
add comment

8 Answers

We can hook to the admin_init action and check if the user is an administrator by using the current_user_can() function to see if the current user can manage_options, which is something only an administrator can do.

This code, when pasted into your functions.php file, will display a message when a non-admin tries to access the dashboard:

function wpse_11244_restrict_admin() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( __('You are not allowed to access this part of the site') );
    }
}
add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

If you prefer, you can provide better user experience by redirecting the user to the home page instead (the $_SERVER['PHP_SELF'] check is to ensure we don't redirect on an AJAX request):

function wpse_11244_restrict_admin() {
    if ( ! current_user_can( 'manage_options' )  && $_SERVER['PHP_SELF'] != '/wp-admin/admin-ajax.php' ) {
        wp_redirect( home_url() );
    }
}
add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

If you want to redirect the user to their profile page, replace home_url() in the code above with the link.

share|improve this answer
add comment

You could write a plugin and hook into admin_init.

The codex actually gives an example with the feature you are looking for.

http://codex.wordpress.org/Plugin_API/Action_Reference/admin_init#Example:_Access_control

share|improve this answer
1  
This is not a complete answer - it should be more then a hint and a link –  bungeshea Jan 8 '13 at 4:37
add comment

Try the Adminimize plugin.
You can lock things down pretty well with that.

You could also try setting access up through htaccess file

share|improve this answer
1  
+1 for Adminimize. That's a beast of a plugin. Coupled with some custom role manager plugin, it simply rocks. (If I'm excused a personal opinion) :::: As a last note: please give more information than only links, it makes the Answer more complete. –  brasofilo Oct 20 '12 at 5:02
add comment
function wpse_11244_restrict_admin() {
    if (!current_user_can('update_core')) {
        wp_die(__('You are not allowed to access this part of the site'));
    }
}

add_action('admin_init', 'wpse_11244_restrict_admin', 1);
share|improve this answer
4  
'administrator' is not a capability. It works just to maintain backwards compatibility. Check for 'update_core' or other admin capabilities. –  toscho May 10 '12 at 16:10
add comment

I would use WP Frontend and set it for everybody expect admins.

share|improve this answer
    
Please provide more information then a link - it makes an answer more complete –  bungeshea Jan 8 '13 at 4:42
add comment

Put these lines in your functions.php

function baw_no_admin_access()
{
 if( !current_user_can( 'administrator' ) ) {
     wp_redirect( home_url() );
     die();
  }
}
add_action( 'admin_init', 'baw_no_admin_access', 1 );
share|improve this answer
2  
like @toscho said 'administrator' is not a capability, instead use admin capabilities like 'update_core' –  Peter Dec 27 '12 at 9:33
    
Also, please explain what your code does, and how it works –  bungeshea Jan 8 '13 at 4:42
add comment

Some of the answers given can be fine but I think none of them warranty to do what is asked because none of the answers checkk user roles, just capabilities and capabilities can be assigned to different roles. Also is required to allow access to profile. Here a sample code to allow users to access to profile while only admins will have access (and see) other zones of the wp-admin:

class RestrictAccess {

    public function __construct() {
         add_action( 'wp_before_admin_bar_render', array( $this, 'customize_admin_bar_menus' ) );
         if( is_admin() ){
              add_filter( 'admin_menu', array( $this, 'customize_admin_sidebar_menus' ) );
              add_action( 'admin_init', array( $this, 'restrict_wp_admin_access' ) );
         }
      }

      public function customize_admin_bar_menus() {

           //Remove unwanted menus in admin bar for all users except admins
           $user = wp_get_current_user();

            if( empty( $user ) || !in_array( "administrator", (array) $user->roles ) ) {
        global $wp_admin_bar;
            $wp_admin_bar->remove_menu('site-name');
            $wp_admin_bar->remove_menu('comments');
            $wp_admin_bar->remove_menu('new-content');
    }

}

public function customize_admin_sidebar_menus() {

       //Remove unwanted menus in admin side panel for all users except admins
        $user = wp_get_current_user();

    if( empty( $user ) || !in_array( "administrator", (array) $user->roles ) ) {
        remove_menu_page( 'edit-comments.php' );
        remove_menu_page( 'tools.php' );
        remove_menu_page( 'plugins.php' );
        remove_menu_page( 'users.php' );
        remove_menu_page( 'options-general.php' );
        remove_menu_page( 'upload.php' );
        remove_menu_page( 'themes.php' );
        remove_menu_page( 'index.php' );
    }
}

public function restrict_wp_admin_access() {

    if( defined('DOING_AJAX') && DOING_AJAX ) {
        //We are in an ajax call and should to redirect the user
        return;
    }

    //Allow access only to profile page
    $user = wp_get_current_user();

    if( empty( $user ) || !in_array( "administrator", (array) $user->roles ) ) {
        global $pagenow;
        if( $pagenow != 'profile.php' ) {
            wp_redirect( get_site_url( ) );
            exit;
        }
    }

}   

}

$load = new RestrictAccess;
share|improve this answer
add comment

I used bungeshea's answer:

 function wpse_11244_restrict_admin() {
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( __('You are not allowed to access this part of the site') );
    }
}
add_action( 'admin_init', 'wpse_11244_restrict_admin', 1 );

But I just wanted to hide the dashboard page, not the entire admin backend... now that I have removed the above code from function.php I have this error:

Warning: call_user_func_array() expects parameter 1 to be a valid callback, function 'wpse_11244_restrict_admin' not found or invalid function name in /public_html/myurl.ca/subdirectory/wp-includes/plugin.php on line 429

when I look at the plugin.php file line 429 is:

call_user_func_array($the_['function'], array_slice($args, 0, (int) $the_['accepted_args']));

Any help on fixing this would be greatly appreciated.

share|improve this answer
    
Welcome to SE. If you have an addendum to your question, you should edit your original question rather than posting the new question as an answer. Thanks! :) –  Dan Mar 14 at 19:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.