0

So I'm creating user registration. Just simply <?php wp_register(); ?> but then it gives them a link to the admin panel, which in my situation they really don't need. How do I remove the "Site Admin" link and redirect a subscriber if they try to access the admin panel? I guess once they log in I will need to redirect them to a certain page also.

3
  • If the users don't need to access anything in the admin, why do they even need to be registered? Feb 21, 2012 at 15:44
  • Because everything they need to be logged in for will accessible from the front end. This is going to be more website based than blog based. It's mostly just going to be logged in user can visit a page that guests cannot. So really I don't want them to realize there's a "Backend" to this website since they do not need to if this makes sense.
    – Howdy_McGee
    Feb 21, 2012 at 15:46
  • Let me rephrase: what is it that the logged-in users will need to access? Feb 21, 2012 at 15:47

2 Answers 2

2

You can remove the read capability from subscribers, which is what gives them access to the dashboard. This is best done with an activation hook on a plugin -- it only needs to be done once.

<?php
register_activation_hook( __FILE__, 'wpse43054_activation' );
function wpse43054_activation() 
{
    $role = get_role( 'subscriber' );
    if( $role ) $role->remove_cap( 'read' );
}

And, of course, you probably want to give that capability back on plugin deactivation.

<?php
register_deactivation_hook( __FILE__, 'wpse43054_deactivation' );
function wpse43054_deactivation() 
{
    $role = get_role( 'subscriber' );
    if( $role ) $role->add_cap( 'read' );
}

Finally, you can hook into init and redirect folks if they are logged in, try to access the admin area and don't have the read capability.

<?php
add_action( 'init', 'wpse43054_maybe_redirect' );
function wpse43054_maybe_redirect() 
{
    if( is_admin() && ! current_user_can( 'read' ) )
    {
        wp_redirect( home_url(), 302 );
        exit();
    }
}

You'll also probably want to remove the admin bar for users with a read capability. You can do that by hooking into get_user_metadata and hijacking the check for the user meta value for show_admin_bar_front.

<?php
add_filter( 'get_user_metadata', 'wpse43054_hijack_admin_bar', 10, 3 );
function wpse43054_hijack_admin_bar( $null, $user_id, $key )
{
    if( 'show_admin_bar_front' != $key ) return null;
    if( ! current_user_can( 'read' ) ) return 0;
    return null;
}

All that as a plugin.

2

So I found the answer and thought it might be useful for later viewers. Adding the code below will redirect all users that are not admin to the homepage.

function prevent_admin_access() {
    if (strpos(strtolower($_SERVER['REQUEST_URI']), '/wp-admin') !== false && !current_user_can('administrator')) {
        wp_redirect(get_option('siteurl'));
    }
}

add_action('init', 'prevent_admin_access', 0);

The only problem with this code is that the registration needs to be changed so the user can pick their own password.

1
  • Not a good solution. User levels are deprecated. You're better off removing the read capability from subscribers -- which will restrict their admin access. Feb 21, 2012 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.