Managing user access to your WordPress dashboard is one of those security fundamentals that many site owners overlook until it becomes a problem. Think about it – you wouldn’t hand out copies of your house key to everyone who asks, yet many WordPress sites give dashboard access far too liberally.
The reality is that every additional user with backend access represents a potential security risk. Whether it’s a well-meaning contributor who accidentally deletes important content, or a compromised account that gets exploited by bad actors, unrestricted dashboard access can lead to serious headaches down the road.
The good news is that WordPress gives you several effective ways to control who can access what areas of your site. You can set this up through built-in user roles, add custom code to your functions.php file, or use specialized plugins that give you more granular control.
Manage dashboard access with user roles and permissions
If you are the owner of the website, you can assign user roles that control users’ access to the dashboard. WordPress roles have different capabilities and actions that users are allowed to perform, such as editing posts and texts, moderating comments, creating pages, etc.
One of the easiest ways to restrict access is to set up a new user as a subscriber. The subscriber role is very limited and only allows the user to read content in the front end of the website and manage their profile. This can be done in the administration area of your WordPress website.
To restrict access, go to Settings > General. Then set the default role “Subscriber” for each new user. You can also change the roles of all users who have access to your website at any time. For example, all existing user roles can be changed under Users > All users.
Then click on the checkbox of the user whose role you want to change, or select multiple users in a group.
What is the difference between roles in WordPress?
Here are some of the WordPress role options.
- Admin/Superadmin – It allows access to the site network administration features and all other functions of a single website. The Superadmin role is only available with Multisite.
- Editor – Users who can manage and publish posts, including the posts of other WordPress users.
- Author – Users who can manage and publish their posts.
- Contributor – Allows a user to write and manage their posts, but not to publish them.
- Subscriber – As mentioned above, this function is very limited. It only allows users to manage their profiles.
Each role has its own options, and you can easily adjust and change the roles as needed.
Use code to restrict access
Another way to manage and control user access is code. You can use the following code in the functions.php file of your child theme.
function restrict_admin_access() {
if (is_admin() && !current_user_can('administrator') && !(defined('DOING_AJAX') && DOING_AJAX)) {
wp_redirect(home_url());
exit;
}
}
add_action('init', 'restrict_admin_access');
This will block access to the backend of your WordPress website for non-administrators. Only administrators will be able to access it and all other users will be redirected to the home page.
This code only works when a user logs in to the WordPress dashboard. The code does not apply to users who are not logged in, as they do not have access to the WordPress dashboard.
Block users from accessing the dashboard with plugins
WordPress plugins have some advantages over the other options for restricting users, as plugins are easier to use.
For example, you can restrict access to user roles or users with certain rights and redirect others to a specific page. This way, only trusted users can gain access to the dashboard.
Here is a brief overview of a well-known WordPress plugin that can restrict access to your WordPress dashboard.
Remove Dashboard Access
The Remove Dashboard Access plugin is an easy way to restrict user access to your WordPress dashboard. With thousands of downloads and 5-star reviews, it’s a high-quality and popular option for many WordPress users.
Once you’ve downloaded and installed this plugin, it’s just a click of a button to restrict users access to the admin area.
In the Dashboard Access Control section, you have the option to allow access to the dashboard only for administrators, editors and administrators or authors, editors and administrators.
With this plugin, you can also enter a redirect URL for unauthorized users and allow all users to edit their profile and add a custom login message.
So if you want to quickly restrict the possibilities of your users in the dashboard, this plugin offers all the important features for this.
WordPress plugins for extending user roles and functions
Here are the two best WordPress plugins for customizing user roles and capabilities.
User Role Editor
User Role Editor is a WordPress plugin for managing the different user roles and capabilities on your website. With this plugin, you can change your capabilities with just a few clicks. You can also add new roles and provide selected capabilities for your users.
After installing and activating the plugin, you will find a new “Capabilities” link when you hover over a user profile. To change the capabilities of a profile, click on this link. You will then be redirected to the user management screen.
The user’s current role is displayed in the “Primary role” drop-down area on the right-hand side. You can also change the user’s default role by selecting one from the list and assign additional roles by checking the appropriate roles in the “Other roles” section.
All capabilities are listed on the left-hand side. Activate the “Show capabilities in human-readable form” checkbox to make the capabilities easier to understand. The user’s currently permitted capabilities are automatically checked and displayed in highlighted form.
To specify additional capabilities, check the corresponding box. To find relevant capabilities, enter the keyword in the “Quick filter” field. Here you will also find separate buttons with which you can select or deselect all capabilities and cancel your selection. Once you have made the changes, click on “Update.”
If you want to change the default capabilities for any role in WordPress, go to Users > User Role Editor in your WordPress dashboard. Then, select the role for which you want to change the capabilities. Once you have selected the capabilities for the role, click “Update.”
You can also add new roles and new capabilities on this page. To do this, click on the corresponding buttons and follow the instructions. It is also possible to rename new and existing roles. To do this, click on “Rename role,” enter the new name and then click on “Rename role.”
Members
Members is a very popular plugin for user and role management. By extending the standard user management features of this plugin, you can control users exactly as you wish.
This plugin will create two new submenus under the “Users” menu in your website dashboard after installation and activation. The “Roles” menu will display all available roles along with the number of users and their capabilities.
If you hover over a role, some additional links will appear – Delete, Edit, View user. When you edit a role, you can customize the capabilities of the role and add new capabilities. When you have made all the necessary changes, click on “Update role.”
If you want to add a new role, go to Users > Add new role and enter the role name and role description. The role name should only contain letters and underscores. In the role description, enter the name that should be displayed in the role list. Then, select the capabilities you want to assign to this role.
Once you have made all the changes, click on the “Add role” button. You can edit the roles at any time on the Users > Roles page.
The Members plugin also has some handy shortcodes. You can use the shortcodes to restrict content, check whether the user is logged in or not, and set subscriber-only content for subscribers. For more details on how to use the shortcodes, please refer to the file “plugins/members/docs/readme.html” in your “wp-content” directory.
Conclusion
Hopefully this article helps you to manage and restrict access to your WordPress website’s dashboard more effectively. You have several options, from a code snippet, directly from the admin area, or using a plugin like Remove Dashboard Access.
The truth is that most website owners don’t think about dashboard security until it becomes a problem. By then, you might have users accessing areas they shouldn’t, or worse, making changes that could break your site.
The most important thing is that you take control of your WordPress website and keep an eye on who can do what if you allow user access. Managing and controlling user activity on your website starts with restricting user access to your WordPress dashboard today.
