0

I have created a special role in WP admin and now I would like to allow to login to certain frontend page only people with this role. How to do that? I still want be able to login for all people for other areas.

2
  • certain page in the backend or in the frontend?
    – gmazzap
    Aug 20 '13 at 14:28
  • @G.M. in the frontend
    – Derfder
    Aug 20 '13 at 14:29
1

Elaborate plugins exist to restrict page access based on a user role or other settings. However, I guess the following code is as simple as it’s gets for checking a user role.

<?php
global $current_user;
if ( is_page( 'some-page' ) && in_array( 'some-role', $current_user->roles ) ) {
    // Show the page
} else {
    // Howdy, stranger! Nothing to see here.
}
?>

Note: this code could go into your theme’s template files such as index.php or page.php. Be aware that switching themes would remove the user role access restriction. Solution? Move this functionality to a plugin. Update: G. M. provided a plugin version in his answer.

1

You want to use user_can to check the user role.

$current_user = wp_get_current_user();
if (user_can( $current_user, 'specialrole' )) {
  // user is in your role
}

It is hard to tell exactly what you are trying to do. Your question is very minimal and there is no such thing as "login to a page" (leaving aside password protected pages, which do not operate based on role).

You may just want to edit the above into a template and print a "You do not have access message" for people without the correct role. Perhaps you want to redirect to somewhere:

function redir_wrong_role() {
  if (is_page('Sample Page')) {
    if (!user_can( $current_user, 'specialrole' )) {
      wp_safe_redirect(home_url());
    }
  }
}
add_action('template_redirect','redir_wrong_role');

See also:
http://codex.wordpress.org/Function_Reference/wp_get_current_user
http://codex.wordpress.org/Function_Reference/is_page
http://codex.wordpress.org/Function_Reference/wp_safe_redirect

2
  • Passing role names to user_can() is not recommended. The only reason it usually still does work is because role names are mangled up with capability names. See: core.trac.wordpress.org/ticket/20824
    – Geert
    Aug 20 '13 at 14:47
  • My solution avoid redirect and allow administrators access. @s_ha_dum
    – gmazzap
    Aug 20 '13 at 15:06
1

First problem is how to recognize if the page is one of the restricted.

If the page is only one you can hardcoding it (i.e. write by yourself the ID or the slug) form me this is not good but is acceptable for one page. If the page are more than one you have probably to find a different solution.

What I suggest is create a page template named 'Restriced Page' and assign it to all pages you want to restrict.

So create a file called page-restriced.php, save it in your theme root and inside write something like:

<?php
/**
 * Template Name: Restricted Page
 */
?>

<?php get_template_part('page'); ?>

Now assign 'Restricted Page' template to all the page you want to resctrict.

You don't say what you want to do if a not allowed user try to access to a resticted page.

A solution is to change the content of the page hooking into the_content filter:

add_filter('the_content', 'change_content_by_role');

function change_content_by_role( $content ) {
  remove_filter('the_content', 'change_content_by_role');
  if ( is_page_template('page-restriced.php') ) {
    // I suggest to allow access to administrator or probably you cannot access
    $allowed_roles = array('administrator', 'your_special_role'); 
    $the_user = wp_get_current_user();
    if ( empty( array_intersect($allowed_roles, $the_user->roles ) ) ) {
      return __('You are not allowed to view this page.');
    }
  }
  return $content ;
}

This solution is pretty but can bring problems in some particular cases: if in the page there is a secondary query that runs before the main one.

Another problems-free solution is create a file called 'not-allowed.php' and put it in your theme folder, hook into template_include filter and show that file if the user is not allowed.

add_filter('template_include', 'restrict_page_by_role');

function restrict_page_by_role( $template ) {
  if ( is_page_template('page-restriced.php') ) {
    // I suggest to allow access to administrator or probably you cannot access
    $allowed_roles = array('administrator', 'your_special_role'); 
    $the_user = wp_get_current_user();
    if ( empty( array_intersect($allowed_roles, $the_user->roles ) ) ) {
      return get_stylesheet_directory() . '/not-allowed.php';
    }
  }
  return $template;
}
2
  • Is the above code outdated for WordPress >v4.4 or is it still valid? If we were to use it for a custom role would that be: $allowed_roles = array('administrator', 'students'); How would search engines react to the code? Will they be able to read the restricted pages? We actually want to restrict them. Can we use the code for posts or cusom types as well and how? Apr 10 '16 at 15:50
  • @marikamitsos should work on 4.4+ and yes, you can use custom roles. Search engines can't access the content. Posts and CPT have no page template, so you can't use is_page_template but as long as you able to distinguish the post you want to restrict, the rest of code is fine.
    – gmazzap
    Apr 10 '16 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.