How to Restrict Access to all wp-admin pages for subscriber users

Question

Here is summary of the problem and required solution:

• Access to mywebsite.com/wp-admin is blocked for subscribers [which is good]

• However, if i enter the link manually on the browser as follows: https://mywebsite.com/wp-admin/user-edit.php?user_id=113 then the user has access to his user settings

• Problem with that is that they can then create an API key (through application passwords plugin which is accessible from that page). This is undesirable as I dont want the users to have API keys where they can fetch/post data to server.

• Hence, I want to block access of subscribers to all wp-admin menus/plugin pages including this link https://mywebsite.com/wp-admin/user-edit.php?user_id=113

Any suggestions?

Answer 1

Hence, I want to block access of subscribers to all wp-admin menus/plugin pages including this link https://mywebsite.com/wp-admin/user-edit.php?user_id=113

This isn't a bulletproof solution, but it should work in that non-admin users would no longer be able to access any admin pages when they're logged-in:

add_action( 'admin_init', function () {
    if ( wp_doing_ajax() || ! is_user_logged_in() ) {
        return;
    }

    $roles = (array) wp_get_current_user()->roles;
    if ( ! in_array( 'administrator', $roles ) ) { // allows only the Administrator role
        wp_die( 'Sorry, you are not allowed to access this page.' );
        // or you can redirect the user to somewhere, if you want to
    }
} );

But then, you might want to change the login and registration redirect URL so that it doesn't send the user to an admin page upon successful login/registration — see the documentation for login_redirect and registration_redirect.

Problem with that is that they can then create an API key (through application passwords plugin which is accessible from that page).

I can't help you with that plugin, but unless if you're still using WordPress prior to v5.6.0, then you should not need to use a plugin anymore because application passwords has been a core feature in WordPress since v5.6.0. And there's actually a hook named wp_is_application_passwords_available_for_user that you could use to disable the feature for certain users.

This is undesirable as I dont want the users to have API keys where they can fetch/post data to server.

If so, and since you said in your comment, "The rest api is restricted for authenticated users", then how about using the rest_authentication_errors hook to ensure only Administrators allowed to access the REST API?

Working example:

add_filter( 'rest_authentication_errors', function ( $errors ) {
    if ( ! is_wp_error( $errors ) ) { // do nothing if there's already an error
        if ( $can_access = is_user_logged_in() ) {
            $roles      = (array) wp_get_current_user()->roles;
            $can_access = in_array( 'administrator', $roles ); // allows only the Administrator role
        }

        if ( ! $can_access ) {
            return new WP_Error( 'user_not_allowed',
                'Sorry, you are not allowed to access the REST API.',
                array( 'status' => rest_authorization_required_code() )
            );
        }
    }

    return $errors;
} );

Answer 2

Add this code to your theme’s functions.php file or in a site-specific plugin:

function restrict_access_admin_panel(){
    global $current_user;
    get_currentuserinfo();
 
    if ($current_user->user_level <  4) {
        wp_redirect( get_bloginfo('url') );
        exit;
    }
}
add_action('admin_init', 'restrict_access_admin_panel', 1);

source: https://www.isitwp.com/restrict-wp-admin-access-to-subscribers/