1

This is probably a common problem with multiple possibilities to solve. However I am asking for an easy solution as I guess I am not the first one to have this problem.

Assume we have a huge company with employees coming and going. Some of them are blog authors in the company blog multisite network, some of them are even super administrators such as blog network maintainers.

Now when they leave the company their access should be revoked. However the users should still exist e.g. in the author card of blog articles. They may also come back to the company in a later time. I do not want to go through all their permissions and change them - just disable their login (for a certain time or permanently) for the whole multisite network.

I have already thought about using something like this (from https://stackoverflow.com/questions/43223557/disable-specific-user-in-wordpress-and-prevent-that-user-to-login-without-using):

add_filter( 'authenticate', 'chk_active_user',100,2);

function chk_active_user ($user,$username) {
     $user_data = $user->data;
     $user_id = $user_data->ID;
     $user_sts = get_user_meta($user_id,"user_active_status",true);

     if ($user_sts==="no") {
           return new WP_Error( 'disabled_account','this account is disabled');

      } else {
           return $user;
      }
      return $user;
}

And adding a custom meta field to the network admin user edit screen where i can deactivate. However not sure if this is secure?

How would you solve this problem?

  • Can't you just change their password to something they don't know? – Jacob Peattie Jan 30 at 13:29
  • No because they can recover it by email. I could of course change all their emails but then I need a large amount of random emails this is just quite an ugly solution. – Blackbam Jan 30 at 13:29
  • Shouldn't the accounts use their company email? That they should also not be able to access? – Jacob Peattie Jan 30 at 13:30
  • Lets assume not all of them are doing this. Furthermore there should be an additional security check just in case the mail deparment makes mistakes right? – Blackbam Jan 30 at 13:32
  • Maybe not the answer you're looking for but I run Two Factor on our WordPress and make it mandatory or their account gets locked out unless I manually reset it/generate new codes for them, if I want to lock them out I just disable their Two Factor but the plugin will still ask for it because of their perms and they get stuck with no option other than contact me to get access again. – Dustin Snider Jan 30 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.