I've recently installed Woocommerce. I have realized that the administrator can access the back-end through the same login form presented to the customers. This, to me, presents a huge security risk.

I thought of a couple of solutions, but I do not know the code that would help me implement them:

  • How can I prevent the administrators from logging in through the customer login page? (if statement on login from the customer login form that would check the role of the user and prevent login if the user is an admin)

  • How can I present a login form so that only the customers can login through? (use a default or native login form set only for customers)

  • 3
    Could you explain why you think this is a huge security risk? – TheDeadMedic May 8 '14 at 16:33
  • I've always read that you should keep the admin login page hidden from the users. Giving the administrator account the ability to be logged in from the front page would be a huge security risk. – yaharga May 8 '14 at 21:06

Although users have access to go to /wp-admin/, they will not have access to do anything on there. There is no security risk involved to being able to have access /wp-admin/ for WooCommerce users.

If you'd like however, you can setup an Apache protected directory with a password to /wp-admin/ that requires an additional user and pass to get to that URL.

  • This is quite a good workaround; however, just to make sure, is there no way in which I could prevent the admin from logging in from the front end? I'll naturally block the wp-admin link from the users, but the admin will certainly be able to still login from the front end customer login. I'm sure there would be a workaround to access the backend once the admin successfully logs in. – yaharga May 8 '14 at 21:03
  • Still though, I don't understand. There is no security risk by allowing /wp-admin/ accessible to users that don't have access to any information within that section. bbPress for example has the same ability as does other user registration WordPress plugins. – Michael May 9 '14 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.