So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile page (wp-admin).

This isn't a problem except for the fact that there's nothing stopping the users from logging in and disabling the two factor authentication which is an issue.

I've looked around at a few issues and none have seemed to work, essentially i want restrict backend access to only a select few (myself and few others).

I've tried stealth login and a few some htaccess solutions and none have seemed to work.

Any ideas?

3 Answers 3


You could make it a mu-plugin ('Must Use' plugin). Any PHP file you put into /wp-content/mu-plugins/ will automatically get included in WordPress. You can't deactivate the plugin (unless you have ftp access to the server). If you go with a mu-plugin, make sure to put the functionality into a subdirectory and bootstrap it with a php file in the mu-plugins directory.


After reading the comment, I think I understand the problem better. It sounds like you want to be able to lock people out of the admin altogether. That's not so difficult. Try this:

function my_awesome_admin_lockout(){
  if( is_admin() && !current_user_can( 'manage_options' ) ) {
    wp_redirect( home_url() );

add_action( 'init', 'my_awesome_admin_lockout' );

Basically, that locks everybody but admins out of the admin area.

  • It's not so much disabling the plugin, they can log in and configure it in a way which disables it. So i can enforce the activation of the plugin but i don't want them to change the options of the plug-in.
    – aprea
    Commented Oct 5, 2010 at 3:43

How about you revoke mysql write permissions on the table of the plugin

Anyone who would want to modify any value , will get an error.

If you want to update - you have to change permissions back,update the records,deny permissions again.


I havn't tried it. But it may work for you.

  1. Restrict complete access to wp-admin using .htaccess.
  2. Now Make an alias php file outside of wp-admin or in some other folder.
  3. Include wp-admin.php or necessary php file into alias PHP file.
  4. restrict search engines to look into folder which contains your alias file using robots.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.