Adminimize Alternative: Cleaning Up the Backend the Right Way

Adminimize served many agencies well for years: hide menu items and meta boxes per role, done. If you're looking for an alternative today, though, you should bring along a question that was asked less often back then — whether hiding is enough.

Hiding isn't locking

A hidden menu item disappears from the menu. The page behind it remains reachable if you know its address — and the data even more so, for example via the REST API.

For tidiness, hiding is perfectly sufficient: a client shouldn't have to see twelve items when they need two. For protection, it isn't enough. That distinction is at the heart of every choice in this area.

The test takes one minute: protect a post, log out, open /wp-json/wp/v2/posts?search= with a word from it. If the content shows up in the response, it was hiding, not locking.

What an alternative should be able to do

The second question: is it maintained?

Tools that reach deep into the backend age badly. They depend on menu structures and internal names that WordPress changes over the years. A plugin that hasn't had an update in a long time will eventually hide items that no longer exist — and miss the new ones.

So for every alternative, check the date of the last update and the WordPress version it states. With tools of this kind, that matters more than with most others.

What you should do when switching

1. Record what's currently hidden for which role — one screenshot per role is enough.
2. Create a backup; roles and capabilities live in the database.
3. Recreate the visibility settings in the new tool.
4. Log in with a test user for each role and compare.
5. Run the REST test for everything that really needs to be protected.
6. Deactivate the old plugin instead of deleting it — for two weeks.

Three role setups that have proven themselves

Instead of rethinking it for every website, you can get surprisingly far with three roles. They cover what clients do in practice and can be set up in a few minutes.

What none of the three includes: plugins, themes, users, tools, settings. That's not distrust but division of labor — those items belong to maintenance, and maintenance has its own access.

The most common mistake

A client reports that they can't edit something anymore. The quick fix would be to give them administrator privileges “until this is sorted out.” After two weeks nobody remembers, and six months later the website has three administrators, two of whom nobody can account for anymore.

The slightly slower route is the only one that holds: check which capability is really missing, and add exactly that one. A change log helps more than it first sounds — later on, it answers the question of who unlocked what and when, without anyone having to remember.

Once a year, look at the user list and filter by administrators. If someone is listed there whose job you can't explain in one sentence, that's the point where you clean up.

Frequently asked questions