Community subscriber getting WP subscriber access.
When someone purchases a subscription or signs up to my community, WordPress automatically assigns them a WP user role giving them access to my WP dashboard. This is a huge problem for me. It’s an awful UX experience and they should absolutely not have access to my WP dashboard. How can I solve this?
Hey Patricia use this snippet, add the snippet in any snippet plugin you use, or download fluent snippets and paste this snippet codes into it and save.
Your worries would be over, I'm using it as well.
add_filter('show_admin_bar', '__return_false');
if (!current_user_can('administrator')) {
add_filter('show_admin_bar', '__return_false');
}
WiLson Eberechi what does it do?
David Scurlock to restrict unauthorized access of non admins, from accessing your wp-admin dashboard, like your WP settings, plugins, media, themes, user, etc. If a member signs into your fluent community site, WP dashboard toolbars shows, and they'll have access to your WP admin, which is bad, so that snippets blocks all non admins from accessing your WP
WiLson Eberechi I may have done something wrong but it did not work for me. My standard account still can access wp-admin. How do I run this? Php, php html, css or js?
David Scurlock which snippet are you using? Are you using fluent snippets ?
David Scurlock don't add any ?Php as the fluent snippets already has that, just paste the codes I provided above just the way it is, update and activate . Make sure it's activated
WiLson Eberechi I copy and pasted exactly and activated, still able to log into wp-admin.
David Scurlock wait no, that snippets hides WP admin toolbar on top of your fluent community site or any site sharing that snippet.
You(admin) can always login from the WP at the left side menu close to fluent community settings.
Look at the toolbar in this picture (+, 🖋️, )
WiLson Eberechi so it does not prevent a standard member from accessing wp-admin? To be honest, never seen any tool bar before or after the snippet.
David Scurlock you are seeing the WP in the left side menu close to settings on your fluent community site because you are an admin.
That toolbar will show for non admins sooner or later, and you might not know. So to be on a safer side, we all use that snippets
WiLson Eberechi Amazing. Thank you!
JF you are welcome
You’re a lifesaver! Thank you!
Interesting. I was also trying to prevent non-admins from getting into the back end of wordpress as well and redirect them to the portal login. So spent the last 30min with Grok "vibe" coding because I'm not a coder and got the following working to
- Allow access to /wp-admin if not logged in (so admins can login)
- Prevent access to /wp-admin if non-admin logged in and redirect them to the community portal
- Allow admin and non-admin to logout fine
- Allow admins to access /wp-admin and backend like normal
I'm not a coder just bold enough to mess with AI - so am sure real coders here will prob identify risks with this. But here it is if anyone wants it - just swap out https://yoursite.com/portal with the login url you want. I just put the community url.
function na_block_non_admins_but_allow_login_screen() {
// 1. Let administrators do anything (logged-in or not)
if ( current_user_can( 'administrator' ) ) {
return;
}
// 2. If the user is NOT logged in at all → allow them to see wp-login.php / wp-admin so they can log in
if ( ! is_user_logged_in() ) {
return;
}
// 3. At this point we know: user is logged in AND is NOT an administrator
// → block them from everything in the backend
// Allow AJAX, REST, cron, etc.
if ( defined( 'DOING_AJAX' ) && DOING_AJAX ) return;
if ( defined( 'DOING_CRON' ) && DOING_CRON ) return;
if ( defined( 'REST_REQUEST' ) && REST_REQUEST ) return;
if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST ) return;
// Allow the logout link to work
if ( isset( $_GET['action'] ) && $_GET['action'] === 'logout' ) {
return;
}
global $pagenow;
if (
is_admin() ||
$pagenow === 'wp-login.php' ||
$pagenow === 'wp-register.php' ||
( isset( $_SERVER['REQUEST_URI'] ) && strpos( $_SERVER['REQUEST_URI'], '/wp-admin' ) !== false )
) {
wp_safe_redirect( 'https://yoursite.com/portal' );
exit;
}
}
add_action( 'init', 'na_block_non_admins_but_allow_login_screen', 1 );
I believe fluentauth plugin has option to disable it with a click of a button.
Cointacter, thank you. I've just tested and yes - FluentAuth really does has this functionality.
The Members plugin - https://wordpress.org/plugins/members/ - can do this and lots of other useful things.
I'm using FluentAuth to prevent this. It also has the ability to redirect specific roles to specific pages on login ad logout, plus you can customise the WP system emails which are UUUUGLY by default.