Prevent subscribers to changing certain profile fields

Question

Is there a way to prevent "subscribers" from editing specific fields in their profile, like email?

I thought it would be simple enough, but I've read though quite a few posts about it around the web (including this one prevent users from changing their email address and this How do you make the email field on the profile page read only for subscribers?) and I have yet to find a solution that doesn't involve hacking the core code (not desirable imo) or just hiding/disabling the field by JS (which means someone could technically get past it in a number of ways).

But since most, if not all, posts I've found are a few years old so I'm thinking maybe something has happened since?

If it's not possible to prevent in a "pretty" way, are there any good alternatives? Can I prevent the "subscriber" user from accessing the profile at all and rather build a new form to let them change password?

The reason for this is that the email address (and possibly one or two other fields) will identify the users in a third party system, so it must only be changed by an administrator who can change it in both places.

Answer 1

You can try using the profile_update hook.

Codex link here.

It fires after updating, but supplies a copy of the old user data, so you can get the current email address, compare it with the old one and change back if necessary.

Answer 2

Your approach is wrong, users should be able to change their email when they stop using it and move to another. What you actually should do is generate a notification that an email address was changed so the admin can act on it and sync the other system, or better write some code that automatically does it.