if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';

If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are not logged in, should you be able to see the echo?

  • 1
    There's an error (') in your code.
    – Amit Kosti
    Jan 14, 2013 at 14:57
  • Should be the following: <?php if ( ! is_admin() ) return; echo "You should not see this if you're not logged in!"; ?> You need to use double quotes if you are going to include special characters inside the echo
    – Fraggy
    Jan 14, 2013 at 15:01
  • You can use is_user_logged_in() to check if user is logged in or not
    – Amit Kosti
    Jan 14, 2013 at 15:43

2 Answers 2


You're misinterpreting the is_admin() function. It's not a tag to check whether or not the user is an admin, it's a template tag to check if you're on an admin page.

From the Codex:

This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it returns either TRUE or FALSE.

You're facing a couple of issued here though.

  1. If you attempt to go to /wp-admin while you're not logged in, WordPress will automatically redirect the page. A request to /wp-admin is really a request to /wp-admin/index.php, a page non-logged-in users don't have permission to see in the first place. So you'll be redirected to /wp-admin/wp-login.php which doesn't necessarily load your plugin code.
  2. I say "doesn't necessarily load your plugin code" because I'm not sure. From the looks of things you're echo/return exists in the global scope. Really, this code should be wrapped in a function and hooked to a WordPress action.

Now, if you go to the /wp-admin page while you're logged in, is_admin() will evaluate to true you should be able to see the content of your echo statement just fine, assuming a couple of things:

  1. No errors in your code (as both @amit and @Fraggy have pointed out, you have a typo - an unescaped ' character.
  2. That you're hooking things in at the right place. You shouldn't just echo and return in the global scope because, really, there's no way to control where that echo/return will be happening. You should place this code in a function.

Important Note

If you ever do find a security hole or security-related bug in WordPress, you should report it to [email protected] rather than posting in a public forum like this. This kind of responsible disclosure gives the team the chance to address and patch the issue before malicious hackers can read about it and exploit it.

  • Thanks for the info. I'm aware that I need to hook in the right places, and test user capabilities. But the Codex is somewhat misleading in it's assertion Dashboard or the administration panel is being displayed. WP redirected me to login page once out of about ten times that I tried this. All other times showed the echo. Re: your note about reporting, I agree and normally wouldn't throw something out willy-nilly; I wanted to get guidance on this before posting to Trac. I didn't want to look stupid with something that is possibly a misunderstanding on my part.
    – akTed
    Jan 14, 2013 at 15:35
  • One more note, I wasn't assuming that is_admin() meant Administrator. I was assuming it meant what the Codex said, the part in your quote: Dashboard or the administration panel is being displayed.
    – akTed
    Jan 14, 2013 at 15:39
  • Yes, and index.php is the Dashboard. But if you're not logged in, you should be redirected to wp-login.php, which is not the Dashboard or an administrative panel.
    – EAMann
    Jan 14, 2013 at 15:56
  • Should be redirected. But that is not the case. :(
    – akTed
    Jan 14, 2013 at 16:10
  • If you're not being redirected to the login page when you're not logged in, then something else is going on. Either due to this plugin or another you have on the site. In either case, that's beyond the scope of this particular question. Perhaps open a new one - "Why are not-logged in users failing to be redirected to wp-login.php?"
    – EAMann
    Jan 14, 2013 at 16:14

The is_admin() only checks for if current visitor is on admin page or not.

To block any non admin user from visting any admin page use current_user_can(); function. Here's an example to check if current user is not a admin.

if ( ! current_user_can( 'manage_options' ) ) {
    echo 'You should not see this if you\'re not logged in!';

#1 Update -

is_user_logged_in() - There's a function to check if current visiting user is logged in or not, You can use that. Here's an updated example -

if ( ! is_user_logged_in() ) {
   echo 'You should not see this if you\'re not logged in';
  • But, according to is_admin() in the Codex "This Conditional Tag checks if the Dashboard or the administration panel is being displayed"
    – akTed
    Jan 14, 2013 at 15:16
  • refer to other answer by @EAMann to know more about is_admin()
    – Amit Kosti
    Jan 14, 2013 at 15:17
  • @AKTed yep, is_admin() checks for current page type not the visiting user's.
    – Amit Kosti
    Jan 14, 2013 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.