Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am building a community based WP site at the mo and have blocked anyone bar admins from using the admin section on the site with:

add_action( 'init', 'sw_block_users' );

function sw_block_users() {
    if ( is_admin() && ! current_user_can( 'administrator' ) ) {
        wp_redirect( home_url() );
        exit;
    }
}

However, I'm also using the awesome power of admin-ajax.php to do a few ajaxy things (as outlined here : http://reallywebdesign.com/2011/09/send-dynamic-data-to-javascript-in-wordpress/), which get blocked by the above function.

Is there a different way I can prevent non-admins from getting to wp-admin directory, while maintaining the use of the admin-ajax file? Thanks!

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The following action hook should help:

add_action('admin_init', 'wpse28702_restrictAdminAccess', 1);
function wpse28702_restrictAdminAccess() {
    $isAjax = (defined('DOING_AJAX') && true === DOING_AJAX) ? true : false;

    if(!$isAjax) {
        if(!current_user_can('administrator')) {
            wp_die(__('You are not allowed to access this part of the site'));
        }
    }
}
share|improve this answer
    
Thanks Roman! Didn't know DOING_AJAX. Wonderful. –  Michael Watson Sep 16 '11 at 12:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.