Block Non-Admins from the WordPress Dashboard (wp-admin)

This article is a localized edition of the Japanese original. Read the Japanese original

On sites that accept member registrations or are run by several people, users such as subscribers can open the admin area (/wp-admin/) after logging in. This article shows how to send users other than administrators back to the home page when they open the admin area, and how to hide the front-end toolbar for them.

The code and its behavior were checked with WordPress 7.1.3 (PHP 8.3) as of November 2026.

First: what a user can do is decided by the role

Being able to open the admin area and what a user can do there are two different things. What a user can do is decided by their role, and hiding the admin area does not change those permissions. Start by checking that each user has the right role.

Check and change roles under Users → All Users. Look at the Role column; to change a role, check the users and choose from Change role to…, or change Role on the user's edit screen.

With WP-CLI:

# List users and their roles
wp user list --fields=ID,user_login,roles

# Make user sub1 a subscriber
wp user set-role sub1 subscriber

This is also the moment to make sure nobody who does not need it has the Administrator role.

Method 1: Send non-admins from the admin area to the home page (code)

Save the following file as wp-content/mu-plugins/restrict-admin.php (create the mu-plugins folder if it does not exist). PHP files in mu-plugins are always loaded without being activated. You can also put the code in your theme's functions.php, but then it stops working when you switch themes.

<?php
/**
 * Plugin Name: Restrict the admin area to administrators
 * Description: Sends non-admins who open /wp-admin/ to the home page and hides the toolbar.
 */

// Capability required to enter the admin area (manage_options = administrators only)
const MYSITE_ADMIN_CAP = 'manage_options';

add_action( 'admin_init', function () {
	// Do not block Ajax (admin-ajax.php) or admin-post.php, which front-end features use
	if ( wp_doing_ajax() || 'admin-post.php' === ( $GLOBALS['pagenow'] ?? '' ) ) {
		return;
	}
	if ( ! current_user_can( MYSITE_ADMIN_CAP ) ) {
		wp_safe_redirect( home_url( '/' ) );
		exit;
	}
} );

// Do not show the front-end toolbar (admin bar) to non-admins
add_filter( 'show_admin_bar', function ( $show ) {
	return current_user_can( MYSITE_ADMIN_CAP ) ? $show : false;
} );

Key points of the code:

• admin_init is a hook that runs when the admin area loads. The code checks the capability there and, if the user lacks it, sends them to the home page with wp_safe_redirect().
• admin_init also runs for admin-ajax.php and admin-post.php. Plugins and themes sometimes use these for front-end forms or "like" buttons, so they are excluded. Without the exclusion, features used by logged-in users may stop working.
• The show_admin_bar filter keeps the black front-end toolbar hidden from non-admins.

Test results

These are the results of logging in as a subscriber, an editor and an administrator in a test environment.

To test on your own site, create a test subscriber user and log in with another browser or a private window.

If editors or authors should still reach the admin area

Locking out the people who write posts means they can no longer edit them. If you only want to lock out subscribers (or members), change the capability on the first line to edit_posts.

const MYSITE_ADMIN_CAP = 'edit_posts';

edit_posts is held by contributors and above, so contributors, authors, editors and administrators can enter the admin area and only subscribers are sent back to the home page (confirmed in the test environment that an editor can enter).

Looking after the users you lock out

• Subscribers can no longer change their password on the profile screen in the admin. Password reset through Lost your password? on the login screen still works, so link to it somewhere on your site.
• Hiding the admin area does not reduce permissions. What users can do through routes other than the admin area, such as the REST API, is still decided by their role's capabilities.

Method 2: Restrict wp-admin by IP address (.htaccess)

If you only manage the site from fixed places such as your office or home, you can also restrict access to /wp-admin/ by IP address on the web server. This applies regardless of user permissions: even administrators cannot get in from IP addresses that are not allowed.

On Apache 2.4, put the following .htaccess in the wp-admin folder (replace 203.0.113.10 with your own IP address).

# /wp-admin/.htaccess
# Allow the admin area only from the specified IP address (Apache 2.4)
Require ip 203.0.113.10

# Allow the files used by front-end features from anywhere
<FilesMatch "^(admin-ajax\.php|admin-post\.php)$">
    Require all granted
</FilesMatch>

In the test environment, /wp-admin/ returned 403 from an IP address that was not allowed, while admin-ajax.php and admin-post.php responded normally.

Points to note:

• Order deny,allow / Deny from all is Apache 2.2 syntax. Apache 2.4 uses Require.
• The login screen, wp-login.php, sits in the site root, so this setting does not restrict it.
• Behind a CDN or load balancer, the IP address Apache sees may not be the visitor's.
• Nginx does not use .htaccess; write the rule in the server configuration file instead.
• A mistake can lock out administrators too. Deleting the .htaccess file via FTP or the server's file manager restores access.

Which one to choose

Related articles

• How to customize user roles and capabilities
• How to hide the WordPress admin bar on the front end
• How to restrict wp-admin by IP with .htaccess (Apache 2.4, excluding admin-ajax.php)

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)