How to hide admin account in BuddyPress? (for security reasons)

Question

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress.

I would like to hide the admin account completely from BuddyPress for security reasons. For example with a regular WordPress blog I would have two separate accounts (one with admin privileges that remains hidden, and another one with only an Editor role to publish all the articles). That way the admin account would be hidden from the public and anyone trying to break in would have to guess both the password AND username. In BuddyPress this is not so easy, since the admin account is very much exposed to the public.

One thing I managed to do is exclude the admin profile from the members directory by editing the /bp-themes/bp-default/members/member_loop.php file. (Yes I know I shouldn't edit the default theme and make a child theme or a stand alone theme instead! I will get to it once I get this resolved.) I added the &exclude=1 parameter (1 being the user ID of the admin account) as such:

<?php if ( bp_has_members( bp_ajax_querystring( 'members' ).'&exclude=1' ) ) : ?>

But I would need some help with the following:

1. Hiding the admin profile (i.e. making it only visible to themselves, but not to anyone else).

2. Preventing the admin's activity from appearing publicly on the site.

3. Or did I miss something else as well?

PS. I am thinking of installing BuddyPress in a MultiSite network so it is very important for me to not expose the super-admin account in such a manner.

EDIT: So here is what I came up with for #1 (it goes into the theme's functions.php page):

// Hide admin profile pages
add_action( 'wp', 'hide_profile_template', 1 );
function hide_profile_template() {
global $bp; 
    if(bp_is_profile && $bp->displayed_user->id == 1 && $bp->loggedin_user->id != 1) :
        global $wp_query;
        $wp_query->set_404();
        status_header(404);
        include(locate_template('404.php'));
        exit;
    endif;
}

So now I still need help with hiding admin activity (#2).

Answer 1

I found this:

Exclude Users from Members directory on a BuddyPress based social network

We will need to hook to 'bp_ajax_querystring' filter.

The following code will allow to exclude the users from the members directory. They will be still listed in the friends list of other users with whom they are friends with.

add_action('bp_ajax_querystring','bpdev_exclude_users',20,2);
function bpdev_exclude_users($qs=false,$object=false){
 //list of users to exclude

 $excluded_user='1,2,3';//comma separated ids of users whom you want to exclude

 if($object!='members')//hide for members only
 return $qs;

 $args=wp_parse_args($qs);

 //check if we are listing friends?, do not exclude in this case
 if(!empty($args['user_id']))
 return $qs;

 if(!empty($args['exclude']))
 $args['exclude']=$args['exclude'].','.$excluded_user;
 else
 $args['exclude']=$excluded_user;

 $qs=build_query($args);

 return $qs;

}

Source

And in BP foruns:

how to hide admin activity on Buddypress activity?

Put this code in bp-custom.php and None of the site admin activity will be recorded nor will you appear in the Who is Online/ recently active members widget.

add_action("plugins_loaded","bpdev_init_sm_mode");
function bpdev_init_sm_mode(){
if(is_site_admin())
remove_action("wp_head","bp_core_record_activity"); //id SM is on, remove the record activity hook
}

Source

I think you can merge both filters and hide Admin Once and for all :)

UPDATE

Because these hacks aren't working in 1.6 this topic suggest it may work by using the old admin bar in BuddyPress. Is that so?

Answer 2

Found out how to do this. Its a combo of buddypress ninja and reverting the admin bar. The ninja plugin works but can not be toggled in the new admin bar, currently. So you temporarily activate the old bar toggle the stealth mode then reactivate the new bar.

More info here:

• How to hide admin activity on Buddypress activity?
• How can i use old buddypress admin bar if i dont want to use this new one in 1.6.

Answer 3

// http://wordpress.org/extend/plugins/bp-ninja/
add_action('bp_init', function() {
    global $bp;

    if (is_super_admin()) {
            //first remove the action that record the last activity
            remove_action('wp_head', 'bp_core_record_activity');

            //then remove the last activity, if present
            delete_usermeta($bp->loggedin_user->id, 'last_activity');
    }
});

// "Not recently active" yazısını super admin için kaldır
add_filter( 'bp_core_get_last_activity', function($last_active){
    global $bp;
    if ( bp_is_active( 'xprofile' ) ){
        $last_active_bp_string = __( 'Not recently active', 'buddypress' );
        if( ($last_active_bp_string == $last_active) && is_super_admin($bp->displayed_user->id)) {
            $last_active = __('Network Admin');
        }
    }
    return $last_active;
});

Answer 4

Just removed the admin user from buddypress 1.9.2

here's how I did it :

my admin user id 2

at the file : buddypress\bp-members\bp-members-template.php

look for line 292 'exclude' => false,

and change false to ur user id my case 2 :

 // type: active ( default ) | random | newest | popular | online | alphabetical
$defaults = array(
    'type'            => $type,
    'page'            => $page,
    'per_page'        => 20,
    'max'             => false,

    'page_arg'        => 'upage',       // See https://buddypress.trac.wordpress.org/ticket/3679

    'include'         => false,         // Pass a user_id or a list (comma-separated or array) of user_ids to only show these users
    'exclude'         => 2,         // Pass a user_id or a list (comma-separated or array) of user_ids to exclude these users

    'user_id'         => $user_id,      // Pass a user_id to only show friends of this user
    'search_terms'    => $search_terms, // Pass search_terms to filter users by their profile data

    'meta_key'        => false,         // Only return users with this usermeta
    'meta_value'      => false,         // Only return users where the usermeta value matches. Requires meta_key

    'populate_extras' => true           // Fetch usermeta? Friend count, last active etc.
);

Answer 5

<?php
add_action('bp_ajax_querystring','bpdev_exclude_users',20,2);
function bpdev_exclude_users($qs=false,$object=false){
    //list of users to exclude

    $excluded_user=join(',',bpdev_get_administrator_user_ids());//comma separated ids of users whom you want to exclude

    if($object!='members')//hide for members only
        return $qs;

    $args=wp_parse_args($qs);

    //check if we are searching for friends list etc?, do not exclude in this case
    if(!empty($args['user_id']))
        return $qs;

    if(!empty($args['exclude']))
        $args['exclude']=$args['exclude'].','.$excluded_user;
    else 
        $args['exclude']=$excluded_user;

    $qs=build_query($args);


   return $qs;

}

function bpdev_get_administrator_user_ids(){
    $users=array();
    $administrators= get_users( array( 'role' => 'administrator' ) );
   if(!empty($administrators)){
       foreach((array)$subscribers as $administrators)
           $users[]=$administrators->ID;

   }
   return $users;
}
?>

Answer 6

I found this neat little code on buddydev. Originally used to hide the current user. But it is easily changed to hide the admin;

add_action( 'pre_user_query', 'devb_exclude_loggedin_user', 201 );

function devb_exclude_loggedin_user( $query ) {

    //do not hide users inside the admin
    if ( is_admin() && !defined('DOING_AJAX') )
        return;
    $qv = $query->query_vars;

    global $wpdb;
    //hide in my case user_id: 1
    $query->query_where .= $wpdb->prepare(" AND {$wpdb->users}.ID !=%d ", 1);
}

source