Title says it all. We have a front end form on our site where users submit content via front end (also they are logged in while doing this)

Because these short codes add them self to the content box of the page editor so in turn they are adding themselves to the front end form page editor.

My question is, how can I best remove these short code buttons from showing on the page editor for anyone else's role who is not an admin?

I don't know if I could use a conditional to check the current users role and if it is anything other than admin then use the remove_shortcode() function?

Does that sound right or is there a better way?

  • How do the shortcodes "add themselves"?
    – s_ha_dum
    Feb 20, 2014 at 16:54
  • That was loosely worded, they don't actually add themselves -- Using the 'add_action('init', 'my-function');' and 'array_push' with '$buttons' will add it to the tinymce editor on the page editor. I know I can go in the plugins and search for this function and change the 'if ( current_user_can('edit_posts')'… part but I didn't know if I could do it without modify core plugins and just run a conditional in the functions file checking if the user is admin and if not then remove the plugin. I found my answer though and will update when I'm allowed. Thx
    – Derek
    Feb 20, 2014 at 17:23

3 Answers 3


Shortcodes are content, equivalent to any other text in the content. There is no way to allow one user to add a shortcode while disallowing another.

The only thing that is possible to do is to try to remove any UI the shortcodes have to "hide" it, but in the end the only true solution is to manually approve every content submitted by a non trusted user, and not to give them the option of editing it after it is approved.

The other alternative is to filter out shortcodes from the content on save. This is probably more robust, but will require some identification of the post as being one that needs the filtering, and will limit the ability of an editor user to insert shortcodes into that content when editing it.


I was not able to use remove_shortcode when checking if the current user was admin but it looks like my best bet is to change this line in the plugins themselves:

if ( current_user_can('edit_posts') &&  current_user_can('edit_pages') )  {
//do stuff

Here is along the lines of what this may look like for anyone else looking:

add_action('init', 'add_button');  
function add_button() {  
   if ( current_user_can('edit_posts') &&  current_user_can('edit_pages') )  
     add_filter('mce_external_plugins', 'add_plugin');  
     add_filter('mce_buttons_3', 'register_button');  

function register_button($buttons) {  
   array_push($buttons, "one-fourth", "one-fourth-last" ); //keep adding buttons as needed 
   return $buttons;  

function add_plugin($plugin_array) {  
   $plugin_array['quote'] = get_bloginfo('template_url').'/library/widgets/shortcode-support.js';  //the javascript support for appending the short code to content box when clicking icon
   return $plugin_array;  

Add this code to your functions.php in your child theme

/*    FLUFFYTECH: HIDE shortcodes ultimate button --------------------------- */

function fluffytech_hide_shortcodes_ultimate_button() {
?><style type="text/css">.su-generator-button {display:none !important;}</style><?php
add_action( 'admin_head', 'fluffytech_hide_shortcodes_ultimate_button' );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.