Restricting Client Access

To prevent end-users from having access to critical site configuration screens, these permissions are handled by the ‘Advanced Access Manager’ (AAM) plugin. It is recommended to leave all default WordPress Roles intact, and make a new role when a specific user needs permissions changed.

While editing a role, use the Capabilities tab to manage which actions a user can (and can not) execute. The WordPress system has a pre-defined level scale to indicate for different hierarchical roles. To restrict access to administrator-related features, it is recommended to remove access to Level 10, 9 and 8. All other rules can be individually managed depending on the needs of the user.

To de-clutter the CMS for end-users, the Backend Menu. Admin Toolbar and Metaboxes tabs can be used. Here we can specify which items are visible for a client inside the WordPress backend. However, do note this does not prevent a client from performing the tasks on these pages. This can be handled inside the Capabilities tab.

By default, a client would need these essential tabs:

• Dashboard (can’t be removed)
• Posts
• Media
• Pages
• Comments
• Users

Any additional menu items are handled by plugins or the theme. It is recommended to keep plugin configuration tabs and theme options hidden from the user, unless otherwise needed. For example, when on-page content is handled by an external page (such as a contact-form).