Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile page (wp-admin).

This isn't a problem except for the fact that there's nothing stopping the users from logging in and disabling the two factor authentication which is an issue.

I've looked around at a few issues and none have seemed to work, essentially i want restrict backend access to only a select few (myself and few others).

I've tried stealth login and a few some htaccess solutions and none have seemed to work.

Any ideas?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

You could make it a mu-plugin ('Must Use' plugin). Any PHP file you put into /wp-content/mu-plugins/ will automatically get included in WordPress. You can't deactivate the plugin (unless you have ftp access to the server). If you go with a mu-plugin, make sure to put the functionality into a subdirectory and bootstrap it with a php file in the mu-plugins directory.

EDIT

After reading the comment, I think I understand the problem better. It sounds like you want to be able to lock people out of the admin altogether. That's not so difficult. Try this:

function my_awesome_admin_lockout(){
  if( is_admin() && !current_user_can( 'manage_options' ) ) {
    wp_redirect( home_url() );
    die();
  }
}

add_action( 'init', 'my_awesome_admin_lockout' );

Basically, that locks everybody but admins out of the admin area.

share|improve this answer
    
It's not so much disabling the plugin, they can log in and configure it in a way which disables it. So i can enforce the activation of the plugin but i don't want them to change the options of the plug-in. –  aprea Oct 5 '10 at 3:43
add comment

How about you revoke mysql write permissions on the table of the plugin

Anyone who would want to modify any value , will get an error.

If you want to update - you have to change permissions back,update the records,deny permissions again.

share|improve this answer
add comment

I havn't tried it. But it may work for you.

  1. Restrict complete access to wp-admin using .htaccess.
  2. Now Make an alias php file outside of wp-admin or in some other folder.
  3. Include wp-admin.php or necessary php file into alias PHP file.
  4. restrict search engines to look into folder which contains your alias file using robots.txt
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.