Keep Logged in Users out of Admin Panel

Question

So I'm creating user registration. Just simply <?php wp_register(); ?> but then it gives them a link to the admin panel, which in my situation they really don't need. How do I remove the "Site Admin" link and redirect a subscriber if they try to access the admin panel? I guess once they log in I will need to redirect them to a certain page also.

Answer 1

You can remove the read capability from subscribers, which is what gives them access to the dashboard. This is best done with an activation hook on a plugin -- it only needs to be done once.

<?php
register_activation_hook( __FILE__, 'wpse43054_activation' );
function wpse43054_activation() 
{
    $role = get_role( 'subscriber' );
    if( $role ) $role->remove_cap( 'read' );
}

And, of course, you probably want to give that capability back on plugin deactivation.

<?php
register_deactivation_hook( __FILE__, 'wpse43054_deactivation' );
function wpse43054_deactivation() 
{
    $role = get_role( 'subscriber' );
    if( $role ) $role->add_cap( 'read' );
}

Finally, you can hook into init and redirect folks if they are logged in, try to access the admin area and don't have the read capability.

<?php
add_action( 'init', 'wpse43054_maybe_redirect' );
function wpse43054_maybe_redirect() 
{
    if( is_admin() && ! current_user_can( 'read' ) )
    {
        wp_redirect( home_url(), 302 );
        exit();
    }
}

You'll also probably want to remove the admin bar for users with a read capability. You can do that by hooking into get_user_metadata and hijacking the check for the user meta value for show_admin_bar_front.

<?php
add_filter( 'get_user_metadata', 'wpse43054_hijack_admin_bar', 10, 3 );
function wpse43054_hijack_admin_bar( $null, $user_id, $key )
{
    if( 'show_admin_bar_front' != $key ) return null;
    if( ! current_user_can( 'read' ) ) return 0;
    return null;
}

All that as a plugin.

Answer 2

So I found the answer and thought it might be useful for later viewers. Adding the code below will redirect all users that are not admin to the homepage.

function prevent_admin_access() {
    if (strpos(strtolower($_SERVER['REQUEST_URI']), '/wp-admin') !== false && !current_user_can('administrator')) {
        wp_redirect(get_option('siteurl'));
    }
}

add_action('init', 'prevent_admin_access', 0);

The only problem with this code is that the registration needs to be changed so the user can pick their own password.