Repository navigation
Managing users
The Users section in the admin lets you see who has access to your site and control what each person can do.
This covers admin Users only - people who can access your admin area. For visitor accounts (registration, sign-in, public profiles), see Members.
New home for roles and member settings. Roles used to be tucked away under Settings, which meant looking after one person's account and deciding what accounts can do were two different screens. Both now live here, as tabs across the top of the Users page: Users, Pending Approval, Invites, Roles and Settings (registration, avatars, usernames, account sections, access control). Old links into Settings still work - they carry you here. If your role lets you edit roles but not users, you still get in; you simply see the tabs you are allowed.
Every user is assigned a role. A role is a named set of permissions that determines which parts of the admin that user can access and what actions they can take.
Cactus comes with one built-in role: Admin. The Admin role always has full access and cannot be edited or deleted. If you switch on the Members system, a second protected role called Members appears the moment your first visitor registers - it's just a label so members show a role badge in the combined Users list; it carries no admin permissions and members never use it to access the admin area.
You can create as many additional roles as you need - for example, an Editor who can manage pages but not change site settings, or a Moderator for a specific module.
- Go to Users → Roles.
- Click New role.
- Give the role a name.
- Tick the permissions you want this role to have. Permissions are grouped by area (Pages, Media, Users, Settings, and so on). Installed modules add their own permissions to the list.
- Click Save.
Click any role in the list to edit its name or permissions. Click Delete to remove it.
Deleting a role does not delete users who had that role - those users simply end up with no role assigned.
The tick boxes are the whole story: a role that has not been given a screen's permission cannot open that screen, whether it finds it in the menu, in a bookmark, or by typing the address. Pages, Media, Menus, Layouts, Modules and Appearance each answer "you do not have permission to view this" to anybody without the matching tick.
Settings is the one screen with a door rather than a lock, because installed modules put their own settings tabs on it. Someone whose role only carries a module's permission gets in - and sees that module's tab, and nothing else. The site's own settings (General, Speed, Email delivery, Media, GDPR, Integrations, Backup, Restore, Navigation, Schedules) need Edit site configuration. Two tabs have a second key of their own, so you can hand out one job without the rest: Edit email templates and wrapper designs opens the email Templates tab, and Access the members GDPR dashboard opens the members half of GDPR & Legal.
Go to Users in the admin sidebar to see a list of everyone with an account on your site.
The list shows each user's name, email address, role, and when they joined - and it's a combined list: admin staff and site members both appear here, side by side, with a Type column telling them apart. Staff rows still have the role/suspend/delete controls right there in the table; click a member row to open their full profile and management options instead (approve, suspend, trust, and so on).
There's no public sign-up for admin accounts - the only admin user created automatically is the one made during setup. To give someone else access to the admin, add them through the Members system instead (invite or registration, depending on how you've configured it), then assign them a role with the permissions they need from the Users list.
- Go to Users and click the user.
- Select a new role from the Role dropdown.
- Save.
The change takes effect immediately.
Suspending a user locks them out of the admin immediately without deleting their account. Their content and history are preserved.
- Go to Users and click the user.
- Click Suspend.
To reinstate a suspended user, click Unsuspend on the same page.
- Go to Users and click the user.
- Click Delete.
- Confirm.
Deleting an account is permanent. Their pages and other content are not automatically deleted.
To change your display name, email address, or password, click My account at the bottom of the admin sidebar (or go to /<your-admin-path>/account).
Profile has a box for your own phone number. It is optional, nobody outside your own account sees it, and it does one job: when you place a call from the site, the Call me at box arrives already filled in with it, so your mobile is not something you type in from memory several times a day. You can still change it on the call itself, which changes it for that call only.
Type it however you would say it - 07700 900123 is fine, so is 020 8138 0512, so is the whole thing with +44 on the front. It is saved in the international form a phone company needs, so do not be alarmed when it comes back looking slightly more formal than you left it. A number without a country code is taken as your site's, which is set in Settings > General > Dialling code.
Passkeys are the primary way to sign in to Cactus - they use your device's fingerprint reader, Face ID, or a security key instead of a password. They're faster and more secure than a password alone.
The sign-in page asks your device for a passkey as soon as it loads - no button to click first. If you dismiss the prompt (or your browser wants a click before it will show one), the page reveals the other ways in: Use another way to sign in gives you the passkey button again alongside the password and authenticator app options.
To add a new passkey:
- Go to My account → Passkeys.
- Click Add passkey and follow the prompt from your device.
You can register multiple passkeys - for example, one on your laptop and one on your phone.
If a passkey isn't an option on your device, you can sign in with an authenticator app instead (Google Authenticator, Authy, 1Password, and similar apps all work). It's just as secure as a passkey - a different way of proving it's really you.
To set it up:
- Go to My account → Authenticator app and click Set up authenticator app.
- Scan the QR code with your authenticator app, or type in the key shown underneath if you can't scan it.
- Enter the 6-digit code your app shows to confirm it's connected.
Once it's set up, you'll see an "Use authenticator app instead" option on the sign-in page. Click Remove on the account page if you want to stop using it.
If email is set up on your site, you can also sign in with a password and a one-time code sent to your email. To set or change your password, go to My account → Password.
The list of links down the left of your admin area is yours to arrange. Go to Settings → General → Admin Menu.
For each item you can:
- Reorder it with the up and down arrows, and move whole sections too.
- Rename it - type a new label, or leave it blank to keep the original.
-
Decide who sees it:
- Default - anyone whose role already lets them use that screen.
- Everyone - shows the link to all admin users. It shows the link and nothing more: anyone whose role lacks the permission still gets turned away at the screen itself, so use this to surface something, not to grant it.
- Administrators only - hidden from every other role.
- Only chosen roles - tick the roles that may see it.
- Hidden - taken off the menu for everyone.
Click Save menu and the change appears straight away. Reset to defaults puts everything back.
Administrators always see every item, hidden ones included (marked with a small padlock), so you can never lock yourself out of your own settings.
A few handy touches in the menu itself: a filter box to find a link quickly, a star to pin favourites to the top, a list of your recently visited pages, and a search box (or press Cmd/Ctrl + K) to jump straight to any screen. The filter box and your favourites stay put at the top while the rest of the menu scrolls, so your pinned links are always where you left them. Pin a great many and the favourites list gets its own scrollbar rather than pushing everything else out of sight.
Go to Settings → General to control:
- Admin path - the secret URL prefix for your admin area.
- Trust this browser - how long a "trust this browser" cookie lasts before asking for a one-time code again.
For visitor registration settings, see Members.
Wiki: Home · Managing pages · Appearance and design · Managing users · Members · Managing media · Modules · Configuration reference