Does any one knows a valid/standard way to disable drag and upload when accessing the media library in the admin area? In order to make this sense to you, I'm building a multisite and user of sub-site cannot upload media files but they can view.

I can remove their capability 'upload_file' but that would completely remove the media experience.

So far this is what I've got:

function disable_drag_upload() {

    wp_deregister_script( 'wp-plupload' );

.. but that would skip the media library content.

  • 1
    If a user can not upload files, you shouldn't give him/her upload_file capability. I think that is a must, not an option. Then you can create a custom page to display the media files, nothing stop you, but a user with a capability that he/she can not perform is actually a very bad approach; it can give more headache than happiness; who knows when any other piece of code based on capabilities and will cause conflicts with your intention. I hope you understand my point.
    – cybmeta
    Jul 16, 2015 at 7:07
  • @cybmeta Thanks for the great insights! This seems to be the proper way to deal with my situation as it would give the network peace of mind that no-one can bypass uploading files. As long as none of the plugins installed skipped checking the capability. It did also justify the 'upload_file' as it stands by its name.
    – Dbx
    Jul 16, 2015 at 8:18
  • But I wouldn't consider that approach for now as it needs more time in development, considering there are a lot of areas affecting the removal of upload_file, means customizing them all. That's the standard approach but not practical as it would take re-inventing what's already been designed. It's worth suggesting to the core to add something like view_file capability though, but until that time wp_handle_upload_prefilter provides a valid way atm.
    – Dbx
    Jul 16, 2015 at 8:29
  • Sorry, but again I don't agree with you; a view_file capability for media files (similar to read for posts) is worthless. Actually, in WordPress environment, all media files can be read and viewed by any one because the file URL is publicly accessible.
    – cybmeta
    Jul 16, 2015 at 10:38

1 Answer 1


Instead of removing upload script you can make the upload error out if the user does not have admin privileges. Like this-

function tomjn_only_upload_for_admin( $file ) {
    if ( ! current_user_can( 'manage_options' ) ) {
        $file['error'] = 'You can\'t upload images without admin privileges!';
    return $file;
add_filter( 'wp_handle_upload_prefilter', 'tomjn_only_upload_for_admin' );

For other possible way please follow this answer- https://wordpress.stackexchange.com/a/105558/59760

  • That's a fast one and I should have dig deeper in this community's questions. This might not be a direct answer since I could still attempt to drag and an upload progress is shown, which might confuses the user - if ever unintentionally dragged an image into the library. But it fixed the upload restriction. A little relief there that the other question is for Media Libraby popup, in my case it's in the media library page. Though the solution is possible to either interface. Otherwise, my question could be flagged as duplication.
    – Dbx
    Jul 16, 2015 at 6:11
  • We also tried Tom's script, and removed the user-level condition part, and it works great, however it also prevents users from uploading new themes/plugins too. I've asked Tom if he might answer here too in more detail. I don't think removing upload_file capability is appropriate either... in our case, we want users to be able to upload plugins/themes, but not any files to the Media Library, because we are testing this function on staging sites where they are mirroring /uploads/ from the production site on some servers to save disk space. Jul 24, 2022 at 16:51
  • @JesseNickles your problem and this question are not the same, you need to ask a new question, you should stop commenting on questions that are loosely similar. Comments are not a place to ask new questions, they're for clarifying an answer or question
    – Tom J Nowell
    Jul 25, 2022 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.