Notice: I am not security expert, so cannot say any of this methods are secure.
Use this if you want to completely block the access to the Admin panel:
(copy the code to your functions.php theme file)
/*
* Hide the admin bar in the front end
*/
add_filter('show_admin_bar', '__return_false');
/*
* Redirects Authors and Subscribers to the site front page using: get_home_url()
*/
add_action('admin_init','wpse_53675_block_users');
function wpse_53675_block_users()
{
if( !current_user_can( 'delete_pages' ) ) // blocks authors, contributors and subscribers
{
wp_redirect( get_home_url(), 301 );
exit;
}
}
Or use this other one if you want the users to have access only to their profile page:
/*
* Redirect Authors and Subscribers to the site front page
* Except if viewing the Profile page
*/
add_action('admin_init','wpse_53675_block_users');
function wpse_53675_block_users()
{
global $pagenow;
if( 'profile.php' == $pagenow ) return;
if( !current_user_can('delete_pages') )
{
wp_redirect( get_home_url(), 301 );
exit;
}
}
/*
* Hide all menus from the Admin panel
* Except the profile item
*/
add_action('admin_menu', 'wpse_53675_remove_admin_menus', 999);
function wpse_53675_remove_admin_menus() {
if( !current_user_can('delete_pages') )
{
remove_menu_page('index.php');
remove_menu_page('edit.php');
remove_menu_page('upload.php');
remove_menu_page('link-manager.php');
remove_menu_page('edit.php?post_type=page');
remove_menu_page('edit-comments.php');
remove_menu_page('tools.php');
}
}
Plugins of interest
Maybe a more secure way would be manipulating roles and capabilities.
