PublishPress Capabilities vs. Kakapo Roles

Permissions plugins look alike on the surface: a matrix with roles in columns and capabilities in rows. It gets interesting to the left and right of it — in what you can control beyond the capabilities themselves, and in whether a rule still applies when nobody is clicking around in the backend.

The short answer

PublishPress Capabilities is a solid tool for roles and capabilities that's free to start with, with good handling of custom post types and a clear matrix. Additional features come via other plugins from the same family.

Kakapo Roles also covers the matrix and additionally includes what add-ons otherwise take care of: admin menu, Media Library, widgets, navigation menus, shortcodes, redirect after login — plus a change log, a trash for roles, and export/import.

Where the two differ

The test that takes one minute

Protect a post for a specific role. Log out. Open /wp-json/wp/v2/posts?search= with a word from the post. If the content shows up in the response, the rule only changes the view — the data is out in the open.

This test works for any plugin of this kind, including the one you're using right now. Kakapo Roles enforces the rule in the REST API as well; with other tools it's worth asking, because “hiding” and “locking” are two different things.

Also check your page builder. Some deliver content via their own endpoints, which bypass the role plugin's capability check.

What matters besides capabilities

The capability matrix answers what someone may do. For a backend that a client uses every day, the second question is just as important: what do they see? An editor with twelve menu items, ten of which are locked, doesn't have a secure backend — just a confusing one.

• Trim the admin menu per role instead of just locking items
• Limit the Media Library to each user's own files — otherwise every author sees every client file
• Hide widgets and navigation menus when they're none of the user's concern
• Allow shortcodes per role, so not everyone can embed everything
• After login, redirect to where the work begins

With Kakapo Roles, that's included. With most tools of this kind, it takes separate add-on plugins or code snippets in functions.php — which works, but turns into an open question again at the next theme change.

Document capabilities, don't just set them

Capabilities are changed rarely and usually under time pressure: someone joins the team, someone leaves, a client briefly needs more. Six months later, the question comes up of why a role is allowed to do something — and without a log, every answer is a guess.

Kakapo Roles keeps a change log and a trash for deleted roles. Both sound like minor details until the first time someone deletes a role that twenty users depend on.

Export your capability structure as soon as it's in place. Then it's a file — back it up, version it, import it on the next website. Without export, you build the same structure for the fifth time on your fifth project, a little differently each time.

When PublishPress Capabilities is the better choice

• You need the matrix and little else
• Your budget is zero
• You already use other plugins from the same family

When Kakapo Roles is the better choice

• You want to tidy up a backend for clients, not just set capabilities
• You need a log of capability changes
• You want to build a structure once and transfer it to other sites
• You already use other Kakapo plugins

Frequently asked questions