Admin Extension Access Control

Admin Extension Access Control allows you to control access to plugin features and menus based on user roles, keeping your WordPress dashboard secure and clean.

🚀 Description

Provide essential security and access control for your WordPress site by locking down the plugins area. Easily restrict access to plugin activation, deactivation, deletion, and settings pages based on user roles.

Keep your WordPress dashboard clean and prevent unauthorized users or clients from accidentally breaking your site by modifying critical plugins.

✨ Key Features

• Global Lockdown: Restrict access to the plugins page for specific user roles.
• Exempt Users Whitelist: Designate trusted administrators who bypass all lockdown rules. Only exempt users can see and configure Admin Extension Access Control settings.
• Restrict Access: Remove the plugins page for specific user roles.
• Restrict Add Plugins: Remove the ability to add plugins for specific user roles.
• Restrict Delete Plugins: Remove the ability to delete plugins for specific user roles.
• Restrict Activate Plugins: Remove the ability to activate plugins for specific user roles.
• Restrict Deactivate Plugins: Remove the ability to deactivate plugins for specific user roles.
• Restrict Install Plugins: Remove the ability to install plugins for specific user roles.
• Role-Based Access Control: Choose exactly which roles can see and manage plugins.
• Dashboard Cleanup: Hide the plugins menu item from unauthorized users.
• Simple Configuration: Easy-to-use settings panel.

🔮 Upcoming Advanced Features

• 🔌 Individual Plugin Selection: Choose exactly which plugins are hidden from specific user roles.
• 🌐 Multisite Compatibility: Manage lockdown rules across all sites from a single Network Admin panel.
• 🛡️ Admin Permissions Control: Fine-grained permissions for administrators.
• 🔔 Notifications & Alerts: Get real-time alerts when a restricted user attempts to access locked plugins.
• 💬 Slack Notifications: Instant Slack messages whenever a lockdown event is triggered.
• 📋 Activity & Audit Log: Full timestamped log of access attempts and plugin visibility events.
• 🛡️ Plugin-Based Access Control: Choose exactly which plugins are hidden from specific user roles.

📦 Installation

1. Download the plugin zip file or clone the repository.
2. Upload the admin-extension-access-control folder to the /wp-content/plugins/ directory of your WordPress installation.
3. Activate the plugin through the Plugins menu in WordPress.
4. Navigate to Admin Extension Access Control in the WordPress admin menu to configure your settings.

❓ Frequently Asked Questions

What happens to the plugins page for restricted users?

Restricted users will not see the "Plugins" menu in the admin sidebar. If they try to access the URL directly, they will be redirected and denied access.

Can I prevent users from adding or installing new plugins?

Yes, you can easily restrict the "Add Plugins" and "Install Plugins" functionality for specific user roles.

Is it possible to stop certain roles from deleting plugins?

Yes, you can configure the plugin to remove the ability to delete plugins for specific user roles, keeping your site's core functionalities safe.

Can I restrict users from activating or deactivating plugins?

Absolutely. You have full control over who can activate or deactivate plugins by using the role-based access control.

What are exempt users?

Exempt users are administrators who bypass all lockdown rules. When the plugin is first activated, the activating user is automatically added to the exempt list. Only exempt users can see and modify Admin Extension Access Control settings. Non-exempt administrators are fully restricted by all enabled lockdown rules.

What happens if no exempt users are configured?

If no exempt users are configured (e.g., the plugin was activated via WP-CLI without a user context), all lockdown rules remain inactive and an admin notice is shown prompting any administrator to configure the exempt list.

How do I recover access if all exempt users are removed or unavailable?

If all exempt administrators lose access, you can recover using one of these methods:

1. WP-CLI: wp plugin deactivate admin-extension-access-control
2. FTP/SFTP: Rename or delete the admin-extension-access-control folder in /wp-content/plugins/
3. Database: Run DELETE FROM wp_options WHERE option_name = 'admin_extension_access_control_options'; to reset all settings

☕ Support the Development

If you find this plugin useful, consider buying me a coffee to support continued development and the upcoming advanced features!

📄 License

This plugin is licensed under the GPL v2 or later.

---

Developed and Tested with ❤️ by Abiodun Paul Ogunnaike (Abbeymaniak)