7

I did try using the plugin Front End Users but this clashes with something as it prevents access to some front end pages. So I need to manually just set it so that anyone who isn't one of two usernames (or roles) can't access wp-admin.

15

Plugin

It's basically just a user capability check, followed by a redirect in an exit call. It then redirects to the site the request came from.

<?php
! defined( 'ABSPATH' ) AND exit;
/* Plugin Name: (#66093) »kaiser« Deny Admin-UI access for certain roles */


function wpse66093_no_admin_access()
{
    // Do not run if the user is logged in and trying to log out
    // This might need one or two more checks.
    // Especially if you have custom login/logout/reset password/etc rules and routes set up.
    if ( 
        ! is_admin()
        || (
            is_user_logged_in()
            && isset( $GLOBALS['pagenow'] ) AND 'wp-login.php' === $GLOBALS['pagenow']
        )
    ) {
        return;
    }

    $redirect = isset( $_SERVER['HTTP_REFERER'] ) ? $_SERVER['HTTP_REFERER'] : home_url( '/' );
    if ( 
        current_user_can( 'CAPABILITY_NAME_HERE' )
        OR current_user_can( 'CAPABILITY_NAME_HERE' )
    )
        exit( wp_redirect( $redirect ) );
}
add_action( 'admin_init', 'wpse66093_no_admin_access', 100 );

Keep in mind that should only work with defaults (see comments in code). Custom login, logout, register, password reset logic might breaks this.

Roles vs. Capabilities: As role names can change and as roles are just groups of capabilities, it's best to check against a capability, not a role name. You can find a list of built in roles and capabilities here. Just look at what the most restrictive access is and search for a matching capability. Then assign it above. That's easier to maintain, in case a role name changes. Yes, you can use a role name as well, which will work in WordPress, but it's a concept that will bring along a hard to track down bug when a role name changes.

Note: Do not think about roles in a hierarchical manner. Think about the accountant whose email address you enter in some SaaS backend to receive the invoice. Most developers will not have access to billing details and neither will the accountant have access to deployment settings or security credentials. They have differently named roles with equally "high" capabilities, but for completely different parts. Keep this example in mind, when you write capability checks or add custom capabilities to a system.

  • so I put this at the top of my functions.php file? – Claire Sep 24 '12 at 12:54
  • 1
    Either somewhere in your functions.php, or in your plugin or mu-plugins folder. As this isn't something about displaying stuff, it belongs imho in a plugin, hence the plugin header. This has the benfit that this functionality doesn't get lost, when you're changing your theme. Just change the user role names, upload it and you're done. – kaiser Sep 24 '12 at 12:59
  • It doesn't work. I changed the user role names to my two roles than can access it. Then I changed it to a capability e.g. Add users and I am still able to access the backend as another user role – Claire Sep 24 '12 at 15:28
  • 1
    @Nicola There's a huge difference between a label in the UI (for e.g.: "Add users") and a real Role or Capability - in your case add_users. – kaiser Sep 24 '12 at 17:07
  • ok thanks, I tried the above code with add_users instead and it still doesn't work...if I log in as a user without that capability, I can then navigate to wp-admin – Claire Sep 26 '12 at 11:44
2

The accepted answer mentions User Role but actually uses the function for User Capability

Here's the solution for User Roles

 function wpse66094_no_admin_access() {
    $redirect = isset( $_SERVER['HTTP_REFERER'] ) ? $_SERVER['HTTP_REFERER'] : home_url( '/' );
    global $current_user;
    $user_roles = $current_user->roles;
    $user_role = array_shift($user_roles);
    if($user_role === 'YOUR_USER_ROLE_HERE'){
        exit( wp_redirect( $redirect ) );
    }
 }

add_action( 'admin_init', 'wpse66094_no_admin_access', 100 );
2

Based on the answer provided by @kaiser (thank you btw), this is my working code, just in any case someone needs it. It is placed in functions.php file.

The condition used is, if the user can't manage_options or edit_posts.

function wpse66093_no_admin_access() {
    $redirect = home_url( '/' );
    if ( ! ( current_user_can( 'manage_options' ) || current_user_can( 'edit_posts' ) ) )
        exit( wp_redirect( $redirect ) );
}
add_action( 'admin_init', 'wpse66093_no_admin_access', 100 );
0

With @kaiser's answer I found you'll need to utilize admin_menu hook over admin_init as it fires before the !user_can_access_admin_page() check in wp-admin/includes/menu.php otherwise if the user doesn't have 'read' access to the dashboard they'll just get the 'You do not have sufficient permissions to access this page.' page rather than being redirected.

0

If you remove the read Capability from the Role the user will not be able to access the dashboard. They will get the following error:

You do not have sufficient permissions to access this admin page.

Reason: The current user doesn't have the "read" capability that is required to access the "Dashboard" menu item.

Ref: https://codex.wordpress.org/Roles_and_Capabilities#read

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.