2

We want to provide owners of their site, administrator role, but we don't want them to delete user 1. We also don't want a cheap solution which stops their admin account from being able to delete users in general, they need full user permissions to add/edit/delete users, just not the user 1 account or a role above them.

In Drupal there is a module called: "Protect user 1" which allows creation of multiple admin accounts, but none of them can edit/delete user 1. Does the WP ecosystem have anything like this?

-2
  1. Install User Role Editor Plugin
  2. Create a Role for them assign everything except removing admin.
  • 1
    Funny enough, this worked flawlessly. Thanks a bunch. Curated the roles with Membership, then once URE was enabled it simply removed the admin users from the users page for the other admin role. Still allows create/edit/delete of all users except admin role. – JohnDoe Apr 11 '18 at 22:20
  • 2
    If the new role has the delete_plugins capability they can just delete the plugin and then delete the user. – Nathan Johnson Apr 11 '18 at 22:53
4

It's a bit different in WP than in Drupal. First, the admin role is specifically designed to be the role that can do everything. Rather than try to restrict the admin role, it's best practice to create whatever custom roles you need - you would set up an almost-admin type role that has all the capabilities except the one you want to restrict. This is typically best for the site owners anyway since you can strip away a few of the more technical capabilities that only a developer would really need, and by having the owners' logins a bit more restricted, you don't have quite as many admin-level users floating around to where it becomes more and more likely that the site could be hacked. If the site is hacked but they've obtained a lower-level user login, you may be able to prevent some damage.

The other problem is that the WP roles and capabilities system isn't set up to allow users to have partial access to capabilities. So, you can't allow any role to have delete_users capability for some roles and not others, even if you use popular user management plugins. But perhaps the other roles would suffice: if you deny them the ability to delete_users across the board you can still give them the ability to add_users, edit_users, and promote_users if those are what you really need to restrict.

2

This is a perfect use for the map_meta_cap filter.

function my_map_meta_cap( $caps, $cap, $user_id, $args ) {
  if( 'delete_user' !== $cap ) {
    return $caps;
  }
  if( isset( $args[0] ) && 1 === $args[0] ) {
    $caps[] = 'cant_do_this';
  }
  return $caps;
}
add_filter( 'map_meta_cap', 'my_map_meta_cap', 10, 4 );

This code requires that anyone trying to delete the user with a user_id of 1 must have the cant_do_this capability. Since no one has that capability, then nobody can delete this user.

Of course, if your administrators can edit plugins then they can just disable the plugin and delete the user anyway. Probably best to use it as a must-use plugin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.