Restrict WordPress Author Access in wp-admin: Menus, Own Posts, Media

This article is a localized edition of the Japanese original. Read the Japanese original

When several people run a WordPress site, you often want to "show Authors only the screens they need to write posts" or "keep other people's posts and media out of their lists." This article shows how to narrow what Authors and Contributors can see in the admin area, using code.

The first thing to understand is that hiding a menu and taking away a permission are two different things. Even after you remove a menu item, the screen may still open if someone types its URL directly. If you want to stop the action itself, use the method in "Remove the capability itself" later in this article.

What Authors and Contributors can do by default

With WordPress's default roles, Authors and Contributors have the following permissions (according to Roles and Capabilities).

They cannot edit other users' posts or open the Settings, Plugins or Themes screens to begin with. An Author's admin menu mainly shows Dashboard, Posts, Media, Comments, Profile and Tools. This article is about reducing the items among those that they don't need to see.

Where to put the code

Rather than the theme's functions.php, we recommend putting the code below in a small plugin in wp-content/mu-plugins/. The settings survive a theme change, and the plugin cannot be deactivated from the admin screen.

1. Create the wp-content/mu-plugins/ folder if it doesn't exist
2. Create author-restrict.php inside it, write <?php at the top, then paste the code you need from below
3. Once saved, it is loaded without any activation step

Test by logging in with a test Author account. As an administrator you won't see any change.

Hide menus and block them by URL too

This example hides "Tools" and "Comments" from Authors and Contributors. Editors and above (users with edit_others_posts, the capability to edit other users' posts) are left as they are.

<?php
/**
 * Plugin Name: Tidy up the admin for Authors
 */

// Don't show the "Tools" and "Comments" menus to Authors and Contributors
add_action( 'admin_menu', function () {
    if ( current_user_can( 'edit_others_posts' ) ) {
        return; // Editors and administrators keep everything
    }
    remove_menu_page( 'tools.php' );         // Tools
    remove_menu_page( 'edit-comments.php' ); // Comments
}, 999 );

// Also refuse to show the hidden screens when opened directly by URL
function kw_block_screen_for_authors() {
    if ( ! current_user_can( 'edit_others_posts' ) ) {
        wp_die( 'You do not have permission to view this screen.', '', array( 'response' => 403 ) );
    }
}
add_action( 'load-tools.php', 'kw_block_screen_for_authors' );
add_action( 'load-edit-comments.php', 'kw_block_screen_for_authors' );

• What you pass to remove_menu_page() is the file name in the menu's URL (such as tools.php).
• remove_menu_page() only removes the menu item. Opening /wp-admin/tools.php directly would still show the screen, so the load-{file name} hook stops it. This hook runs just before each admin screen is loaded.
• For Authors, the "Users" menu is not users.php but profile.php (Profile). Leave Profile in place, since it is used to change passwords.

Show only their own posts and media

Authors cannot edit other users' published posts, but those posts still appear in the Posts list. This example limits the list and the Media Library to the user's own items.

<?php
// Limit the Posts list (edit.php) and the Media list view (upload.php) to the user's own items
add_action( 'pre_get_posts', function ( $query ) {
    if ( ! is_admin() || ! $query->is_main_query() ) {
        return;
    }
    if ( current_user_can( 'edit_others_posts' ) ) {
        return;
    }
    global $pagenow;
    if ( in_array( $pagenow, array( 'edit.php', 'upload.php' ), true ) ) {
        $query->set( 'author', get_current_user_id() );
    }
} );

// Also limit the Media grid view and the "Add Media" dialog in the post editor
add_filter( 'ajax_query_attachments_args', function ( $query ) {
    if ( ! current_user_can( 'edit_others_posts' ) ) {
        $query['author'] = get_current_user_id();
    }
    return $query;
} );

// The counts above the list ("All (12) | Published (10)") are site-wide, so hide them
add_filter( 'views_edit-post', function ( $views ) {
    if ( current_user_can( 'edit_others_posts' ) ) {
        return $views;
    }
    return array();
} );

• The Media Library has a list view (upload.php?mode=list) and a grid view, and the grid view and the media picker in the post editor are loaded via Ajax. To cover both, the code uses pre_get_posts and ajax_query_attachments_args.
• views_edit-post is the filter for the status links shown above the Posts list. Their counts include other users' posts, so this code removes them entirely.
• All of this only narrows what is displayed. Anyone who knows the URL of another user's published post can still read it on the front end.

Remove dashboard widgets

This example removes unused widgets from an Author's Dashboard.

<?php
add_action( 'wp_dashboard_setup', function () {
    if ( current_user_can( 'edit_others_posts' ) ) {
        return;
    }
    remove_meta_box( 'dashboard_primary', 'dashboard', 'side' );       // WordPress Events and News
    remove_meta_box( 'dashboard_quick_press', 'dashboard', 'side' );   // Quick Draft
    remove_meta_box( 'dashboard_right_now', 'dashboard', 'normal' );   // At a Glance
    remove_meta_box( 'dashboard_activity', 'dashboard', 'normal' );    // Activity
} );

To find the ID of a widget added by a plugin, look at the widget's container (<div id="...">) in your browser's developer tools.

Keep Subscribers out of the admin area

On a membership site, for example, you may want to send Subscribers, who don't write posts, back to the front end instead of showing them the admin. Authors and Contributors need the admin to write posts, so this targets only users without edit_posts.

<?php
// Send users who cannot write posts (Subscribers etc.) from the admin back to the home page
add_action( 'admin_init', function () {
    if ( current_user_can( 'edit_posts' ) || wp_doing_ajax() ) {
        return;
    }
    global $pagenow;
    if ( 'admin-post.php' === $pagenow ) {
        return; // Used as a form submission endpoint, so don't block it
    }
    wp_safe_redirect( home_url( '/' ) );
    exit;
} );

// For the same users, also hide the toolbar shown at the top of the front end
add_filter( 'show_admin_bar', function ( $show ) {
    return current_user_can( 'edit_posts' ) ? $show : false;
} );

• admin_init also runs on admin-ajax.php and admin-post.php. Redirecting there would break front-end Ajax features and form submissions, so they are excluded.
• With this in place, Subscribers can no longer open their Profile screen either. They change their password through "Lost your password?" on the login screen instead.

Remove the capability itself

If you want to make an action impossible rather than just hide a menu, remove the capability from the role. Where WP-CLI is available, do it like this.

# Check which capabilities the Author role has
wp cap list author

# Remove the media upload capability from Authors
wp cap remove author upload_files

# Restore it
wp cap add author upload_files

• Role capabilities are stored in the database, so running this once is enough. Unlike code, it doesn't need to be loaded on every request.
• If you remove publish_posts, Authors can no longer publish and can only "Submit for Review" (the same as Contributors).
• Before changing a default role, save the output of wp cap list author so you know exactly what to restore.

Creating custom roles is covered in "How to customize user roles and capabilities", and the WP-CLI side in "How to check, add and remove roles and capabilities with WP-CLI".

Things to watch out for

• Pass a capability name (such as edit_others_posts) to current_user_can(), not a role name (such as author). Checking by role name drifts from your intent once you adjust capabilities.
• If you combine this with a plugin that restricts the admin or manages members, it becomes hard to tell which setting is in effect. Keep it in one place.
• After any change, log in with test accounts for Author, Contributor and Subscriber, and confirm they can still create a post, insert an image and edit their profile.

Summary

• Authors and Contributors already cannot edit other users' posts or open the Settings screens
• Hide menus with remove_menu_page(), and block direct URLs with the load-{file name} hook
• Limit the Posts list and Media to the user's own items with pre_get_posts and ajax_query_attachments_args
• Redirect Subscribers in admin_init, excluding admin-ajax.php and admin-post.php
• To stop an action itself, remove the capability from the role with wp cap remove

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)