Client Access to the Backend: Which Capabilities Are Really Needed

A client needs to be able to maintain texts. The fastest route is an administrator account — and the most expensive one. Not because anyone does something malicious, but because one wrong click in the plugins area costs more than the ten minutes a clean role would have taken.

What WordPress ships with

In most cases, Editor is the right answer. It fully covers content and leaves the technical side out of it.

Where Editor still falls short

An editor regularly lacks three things, and for each one there's a better answer than “then just make them an administrator”:

• Editing menus — requires a capability that usually sits with the administrator and can be granted selectively
• Using page builders — many come with their own capabilities that can be assigned individually
• Managing forms or a store — those same plugins define their own capabilities for this

The approach is always the same: add the one missing capability instead of switching the role. That's exactly what a capability matrix is for.

Cleaning up matters more than locking

A backend with twelve menu items, ten of which are locked, isn't secure — it's confusing. The client searches, clicks the wrong thing, and calls you. Capabilities define what someone may do; just as important is what they see in the first place.

• Trim the admin menu down to what's needed
• Limit the Media Library to each user's own files when several clients share the same installation
• Hide widgets and navigation menus when they're none of the user's concern
• After login, redirect to where the work begins — not to the dashboard with five notice boxes

The test that takes one minute

Capabilities can't be judged on the screen where you set them. Create a test user for each role and log in as that user — in a second browser, so your own session stays open.

And for protected content there's a second test: log out and open /wp-json/wp/v2/posts?search= with a word from the protected post. If the content shows up in the response, your rule only changes the view — the data is out in the open.

This test applies to any permissions plugin. “Hiding” and “locking” are two different things, and only one of them holds.

Two traps when several people manage a site

The first: anyone who's allowed to grant capabilities can give themselves more. WordPress has a safeguard for this — get_editable_roles() — and a plugin that bypasses it opens exactly the door it's supposed to close.

The second concerns multisite networks: there, some roles are network-wide. Anyone who overwrites them from a subsite changes them for all sites — including the ones that don't belong to them.

When someone leaves

1. Deactivate the account, don't delete it right away — otherwise the posts lose their author.
2. Transfer the posts to another account before deleting.
3. Revoke this account's application passwords; they survive a password change.
4. End active sessions.
5. Record in the change log when and why.

Frequently asked questions