So I'm creating user registration. Just simply <?php wp_register(); ?>
but then it gives them a link to the admin panel, which in my situation they really don't need. How do I remove the "Site Admin" link and redirect a subscriber if they try to access the admin panel? I guess once they log in I will need to redirect them to a certain page also.
-
If the users don't need to access anything in the admin, why do they even need to be registered?– Chip BennettFeb 21, 2012 at 15:44
-
Because everything they need to be logged in for will accessible from the front end. This is going to be more website based than blog based. It's mostly just going to be logged in user can visit a page that guests cannot. So really I don't want them to realize there's a "Backend" to this website since they do not need to if this makes sense.– Howdy_McGee ♦Feb 21, 2012 at 15:46
-
Let me rephrase: what is it that the logged-in users will need to access?– Chip BennettFeb 21, 2012 at 15:47
2 Answers
You can remove the read
capability from subscribers, which is what gives them access to the dashboard. This is best done with an activation hook on a plugin -- it only needs to be done once.
<?php
register_activation_hook( __FILE__, 'wpse43054_activation' );
function wpse43054_activation()
{
$role = get_role( 'subscriber' );
if( $role ) $role->remove_cap( 'read' );
}
And, of course, you probably want to give that capability back on plugin deactivation.
<?php
register_deactivation_hook( __FILE__, 'wpse43054_deactivation' );
function wpse43054_deactivation()
{
$role = get_role( 'subscriber' );
if( $role ) $role->add_cap( 'read' );
}
Finally, you can hook into init
and redirect folks if they are logged in, try to access the admin area and don't have the read capability.
<?php
add_action( 'init', 'wpse43054_maybe_redirect' );
function wpse43054_maybe_redirect()
{
if( is_admin() && ! current_user_can( 'read' ) )
{
wp_redirect( home_url(), 302 );
exit();
}
}
You'll also probably want to remove the admin bar for users with a read
capability. You can do that by hooking into get_user_metadata
and hijacking the check for the user meta value for show_admin_bar_front
.
<?php
add_filter( 'get_user_metadata', 'wpse43054_hijack_admin_bar', 10, 3 );
function wpse43054_hijack_admin_bar( $null, $user_id, $key )
{
if( 'show_admin_bar_front' != $key ) return null;
if( ! current_user_can( 'read' ) ) return 0;
return null;
}
All that as a plugin.
So I found the answer and thought it might be useful for later viewers. Adding the code below will redirect all users that are not admin to the homepage.
function prevent_admin_access() {
if (strpos(strtolower($_SERVER['REQUEST_URI']), '/wp-admin') !== false && !current_user_can('administrator')) {
wp_redirect(get_option('siteurl'));
}
}
add_action('init', 'prevent_admin_access', 0);
The only problem with this code is that the registration needs to be changed so the user can pick their own password.
-
Not a good solution. User levels are deprecated. You're better off removing the read capability from subscribers -- which will restrict their admin access. Feb 21, 2012 at 16:50