Restricting the WordPress dashboard
Keep members out of /wp-admin and on your own pages — a small setting with a large blast radius.
- Intermediate
- 4 min read
- Applies to 2.0
Before you touch this
This setting decides who may reach /wp-admin. Set wrongly, it shuts people out
of the administration — including you, if your own role is on the wrong side of
it. Have your
emergency access link
saved outside the site first.
Turn it on
User Access → User, in the back-office access panel. Enable the restriction, then tick the roles that are still allowed in.
You cannot lock yourself out with this setting. Administrators keep access whether or not their role is ticked — the check returns early for them before it ever looks at the allowed list. Ticking the box changes nothing; the guarantee is in the code.
The toolbar goes with it
A restricted member also stops seeing the WordPress admin toolbar on the front
end. That is deliberate, and it is the same decision: a bar whose links all lead
to /wp-admin would offer the door and then close it — the member clicks
Dashboard and lands back on the home page with no explanation.
If your theme or another plugin has already hidden the toolbar, that stays as it is. This rule only ever takes the bar away, never puts it back.
The back-office restriction panel, with the list of allowed roles.
- You have opened
/wp-adminas a restricted member, in a private window, and seen where they land - Any role that needs the dashboard for a plugin you use is allowed
- Your emergency access link is saved outside the site
Why sites do this
A member with a Subscriber account can reach /wp-admin by default. There is
little there for them, and that is exactly the problem: a bare dashboard with a
profile screen looks like a mistake to a member, and looks like an invitation to
someone probing the site.
Restricting it keeps members on the pages you built for them — account, profile, settings — and keeps the administration for people who administer.
What to check afterwards
Some plugins put member-facing features inside /wp-admin — a shop's order
history, a course platform's progress page. Restricting the dashboard takes
those away too, silently, for the roles you excluded.
Go through the plugins your members actually use before switching this on.
Related articles
Something missing or out of date? Tell support.