0

Restrict backend.

add_action( 'init', 'blockusers_init' );
function blockusers_init() {
    if ( is_admin() && ! current_user_can( 'administrator' ) && !( defined( 'DOING_AJAX' ) && DOING_AJAX ) ) {
        wp_redirect( home_url() );
        exit;
    }
}

This code will restrict backend for all users roles except for admin which is what I want. However, I want to allow Authors to delete their posts from front-end using http://localhost:8888/wordpress/wp-admin/post.php?action=delete&post=63&_wpnonce=c67eff49b7 link on Delete button.

Is it possible to exclude that link for the redirect? So authors can delete their posts from front-end?

0

This will allow you to access post.php and still restrict the back-end. You need have action, action name as delete, post key and value, and wpnonce kay and value. Otherwise, it will redirect you to homepage.

function disable_wp_admin() {

    if ( ! is_admin() )
        return;

    if ( current_user_can( 'manage_options' ) )
        return;

    if (( current_user_can( 'edit_posts' ) && defined( 'DOING_AJAX' ) && DOING_AJAX ) )
        return;

    if ( 'post.php' == isset( $_REQUEST['action'] ) && 'delete' == $_REQUEST['action'] && isset( $_REQUEST['post'] ) && isset( $_REQUEST['_wpnonce'] ) )
        return;

    $redirect_to = home_url();
    wp_redirect( $redirect_to );
    exit;
}
add_action( 'init', 'disable_wp_admin' );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.