Restrict admin pages for specific user role

Question

I have created new user role "advertiser" and added some capabilities:

function prefix_add_user_role() {
    add_role(
        'advertiser',
        'Advertiser',
        array(
            'switch_themes' => 0,
            'edit_themes' => 0,
            'activate_plugins' => 0,
            'edit_plugins' => 0,
            'edit_users' => 0,
            'edit_files' => 0,
            'manage_options' => 0,
            'moderate_comments' => 0,
            'manage_categories' => 0,
            'manage_links' => 0,
            'upload_files' => 0,
            'import' => 0,
            'unfiltered_html' => 0,
            'edit_posts' => 1,//
            'edit_others_posts' => 0,
            'edit_published_posts' => 1,//
            'publish_posts' => 1,//
            'edit_pages' => 0,
            'read' => 1,
            'edit_others_pages' => 0,
            'edit_published_pages' => 0,
            'publish_pages' => 0,
            'delete_pages' => 0,
            'delete_others_pages' => 0,
            'delete_published_pages' => 0,
            'delete_posts' => 1,
            'delete_others_posts' => 0,
            'delete_published_posts' => 1,
            'delete_private_posts' => 0,
            'edit_private_posts' => 0,
            'read_private_posts' => 0,
            'delete_private_pages' => 0,
            'edit_private_pages' => 0,
            'read_private_pages' => 0,
            'delete_users' => 0,
            'create_users' => 0,
            'unfiltered_upload' => 0,
            'edit_dashboard' => 0,
            'update_plugins' => 0,
            'delete_plugins' => 0,
            'install_plugins' => 0,
            'update_themes' => 0,
            'install_themes' => 0,
            'update_core' => 0,
            'list_users' => 0,
            'remove_users' => 0,
            'promote_users' => 0,
            'edit_theme_options' => 0,
            'delete_themes' => 0,
            'export' => 0,
            'edit_comment' => 0,

            'loco_admin' => 0,
        )
    );
}
add_action( 'init', 'prefix_add_user_role' );

User with role advertiser should not access default admin pages and their subpages, like posts (edit.php but not CPTs pages), pages, comments (edit-comments.php), contact form 7 page (admin.php?page=wpcf7) at all. Most capabilities set to false works perfect. But probably some capabilities not working correctly or I'm doing something wrong. Advertiser should have access only to three custom post types, to their profile, and to dashboard.

Answer 1

You can use the remove_menu_page() hook to remove the menu items, but the pages will still be accessible if the user types in the URL. Source: WPMayor

To find the 'contact' page to remove, grab the slug from the Contact admin page and paste it as the argument as the argument, e.g. remove_menu_page( "[Your admin page's slug]" ). The following ones are also slugs I believe:

add_action( 'admin_init', 'my_remove_menu_pages' );
function my_remove_menu_pages() {

  global $user_ID;

  if ( current_user_can( 'advertiser' ) ) {
    remove_menu_page('tools.php'); // Tools
    remove_menu_page('edit.php'); // Posts
    remove_menu_page('edit-comments.php'); // Comments 
  }
}