WP User Profile Restriction

FAQ

Does this plugin require any configuration?

No! The plugin works immediately upon activation with secure defaults (Subscribers and Contributors are restricted). However, you can customize the behavior from Settings > Profile Restriction.

Which user roles are restricted by default?

By default, Subscribers and Contributors are restricted from editing their profiles. This provides security while maintaining backward compatibility with version 1.0.6.

Can I choose which roles to restrict?

Yes! Version 2.0 introduces a settings page where you can select exactly which user roles should be restricted using simple checkboxes.

Can administrators still edit profiles?

Yes, administrators always have full access to edit any profile, regardless of plugin settings.

What happens when a restricted user tries to access their profile?

By default, they see an error message. Optionally, you can enable custom redirect to send them to a specific page (like the homepage or a custom access denied page).

Will restricted users see the Profile menu?

No, the Profile link is automatically hidden from both the admin bar and the dashboard sidebar menu for all restricted users.

Can I redirect restricted users to a custom page?

Yes! In the settings page, you can enable custom redirect and specify any URL where restricted users should be redirected.

Is this plugin compatible with the latest WordPress version?

Yes, the plugin is regularly tested and updated to ensure compatibility with the latest WordPress releases.

Will this affect my existing users?

If you’re upgrading from version 1.0.6, the plugin maintains the same default behavior (restricting Subscribers and Contributors). Your existing security settings remain intact.

Can restricted users still edit their profile through the REST API?

No. Since version 2.0.1 the plugin also blocks write requests (POST, PUT, PATCH and DELETE) to /wp-json/wp/v2/users/me and to the user’s own /wp-json/wp/v2/users/<id> endpoint, returning HTTP 403. This closes a real bypass in which the profile.php screen was blocked but the API endpoint was not. The protection is enabled by default and can be toggled from the settings page.

Which additional wp-admin pages can I restrict?

This version provides checkboxes for the four user management screens: Profile (profile.php), Users list (users.php), Add New User (user-new.php) and Edit User (user-edit.php). The Profile page is selected by default. Further screens such as Tools, Export, Import, General Settings, Themes, Plugins, Comments and Media Library, along with free-form custom page slugs, are listed on the settings page as options planned for the Pro version.

Could I accidentally lock myself out of the plugin settings?

No. The plugin’s own settings screen is always exempt from page restrictions, and administrators are only affected if you explicitly add the Administrator role to the restricted roles list.

Can I restrict Editors or Authors?

Yes, you can select any combination of user roles to restrict from the settings page.

Does this work with custom user roles?

Yes, the plugin automatically detects all user roles on your site, including custom roles created by other plugins.

How do I contact the developer about a question or a feature idea?

Use the contact form in the sidebar of the settings page. Fill in your name, email address and the details of your question, then press Submit. The message is emailed to the plugin author with your address as the reply-to, so any answer comes straight back to you. Only administrators can see and use the form.

The contact form says the message could not be sent. What now?

That message means your WordPress site could not hand the email to a mail server, which is common on hosts without a configured mailer. Installing an SMTP plugin usually resolves it. In the meantime you can email theinnovs@gmail.com directly.

Does the contact form send any of my site data automatically?

No. Nothing leaves your site unless an administrator fills in the form and presses Submit. When that happens the message includes your site URL, plugin version and WordPress version so we can reproduce the issue you are describing.