Is there a way to prevent "subscribers" from editing specific fields in their profile, like email?

I thought it would be simple enough, but I've read though quite a few posts about it around the web (including this one prevent users from changing their email address and this How do you make the email field on the profile page read only for subscribers?) and I have yet to find a solution that doesn't involve hacking the core code (not desirable imo) or just hiding/disabling the field by JS (which means someone could technically get past it in a number of ways).

But since most, if not all, posts I've found are a few years old so I'm thinking maybe something has happened since?

If it's not possible to prevent in a "pretty" way, are there any good alternatives? Can I prevent the "subscriber" user from accessing the profile at all and rather build a new form to let them change password?

The reason for this is that the email address (and possibly one or two other fields) will identify the users in a third party system, so it must only be changed by an administrator who can change it in both places.

2 Answers 2


You can try using the profile_update hook.

Codex link here.

It fires after updating, but supplies a copy of the old user data, so you can get the current email address, compare it with the old one and change back if necessary.

  • This could work as a safety net after disabling the field by jQuery. Thanks.
    – Linda H
    Dec 20, 2013 at 8:59

Your approach is wrong, users should be able to change their email when they stop using it and move to another. What you actually should do is generate a notification that an email address was changed so the admin can act on it and sync the other system, or better write some code that automatically does it.

  • In general, this isn't a bad idea at all, however it's not really suitable for this client. I'll definitely keep the idea in mind for future use though!
    – Linda H
    Dec 19, 2013 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.