0

I am building a community based WP site at the mo and have blocked anyone bar admins from using the admin section on the site with:

add_action( 'init', 'sw_block_users' );

function sw_block_users() {
    if ( is_admin() && ! current_user_can( 'administrator' ) ) {
        wp_redirect( home_url() );
        exit;
    }
}

However, I'm also using the awesome power of admin-ajax.php to do a few ajaxy things (as outlined here : http://reallywebdesign.com/2011/09/send-dynamic-data-to-javascript-in-wordpress/), which get blocked by the above function.

Is there a different way I can prevent non-admins from getting to wp-admin directory, while maintaining the use of the admin-ajax file? Thanks!

1

The following action hook should help:

add_action('admin_init', 'wpse28702_restrictAdminAccess', 1);
function wpse28702_restrictAdminAccess() {
    $isAjax = (defined('DOING_AJAX') && true === DOING_AJAX) ? true : false;

    if(!$isAjax) {
        if(!current_user_can('administrator')) {
            wp_die(__('You are not allowed to access this part of the site'));
        }
    }
}
  • Thanks Roman! Didn't know DOING_AJAX. Wonderful. – Michael Watson Sep 16 '11 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.