How to Restrict WordPress Pages by User Role

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

The reliable way to restrict a WordPress Page is to authorize a capability, not to compare a user’s role name. Use current_user_can() for the capability that represents access, handle anonymous and authenticated denials separately, and make sure caching, files, feeds and APIs cannot deliver the same protected content through another route.

Roles are bundles of capabilities

WordPress includes Super Admin, Administrator, Editor, Author, Contributor and Subscriber roles. A role is a collection of capabilities, and administrators can add, remove or create capabilities and roles. Capabilities such as edit_pages and publish_pages govern editorial work in the dashboard; they do not automatically define who may view a Page on the front end.

#	Preview	Product	Price
1		WordPress Multisite Administration	$34.38	Buy on Amazon
2		Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)	$9.90	Buy on Amazon
3		WordPress 24-Hour Trainer	$3.95	Buy on Amazon
4		Teacher Record Book	$4.89	Buy on Amazon

Define the access policy first. For example, “members may view this Page” should map to a capability such as read_members_area, while access to WordPress private Pages could use read_private_pages. Test the capability for the current user rather than assuming every site assigns roles identically. WordPress can map a meta capability to the primitive capabilities required for a user through map_meta_cap(); that mapping does not itself grant permission.

Native PHP: protect a Page request

Place the authorization check in code that runs before the protected content is rendered, such as an early request hook or the relevant template. This pattern sends logged-out visitors to a login Page and denies authenticated users who lack the required capability:

#1 Best Overall

Sale

WordPress Multisite Administration

$34.38

Buy on Amazon

if ( ! is_user_logged_in() || ! current_user_can( 'read_private_pages' ) ) {
    wp_safe_redirect( home_url( '/login/' ) );
    exit;
}

Replace read_private_pages with the capability that matches your policy. A custom capability is usually clearer when the rule is specific to a business role or membership tier.

Choose the denial response

• Anonymous visitor: redirect to a login URL, preserving a safe return destination if your login flow supports one.
• Authenticated but unauthorized visitor: return a 403-style response or a clear explanation rather than repeatedly redirecting the user to login.
• Authorized visitor: continue the request and render the Page.

Use wp_safe_redirect() for redirects to a local or otherwise allowed destination, then call exit so execution cannot continue into the protected output.

Do not make the role name the security rule

A check such as in_array( 'editor', $user->roles, true ) couples authorization to one role label and can fail when capabilities are customized, users have multiple roles, or a site changes its role model. WordPress’s current_user_can() documentation discourages checking particular roles in place of capabilities because the result may be unreliable.

Rank #2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

Buy on Amazon

When a plugin is the better implementation

A maintained restriction plugin can put the rule in the editor interface, which is useful when nontechnical staff must manage access without editing PHP. Confirm the plugin’s current version, supported WordPress version, caching behavior and denial options before enabling it.

Role Based Content Restrictor

The WordPress.org listing describes restrictions for individual posts, Pages and custom post types based on role or login status. It also describes per-content redirect settings and a global fallback redirect. This is suited to a small number of Pages where editors need a per-Page control.

Page and Post Restriction

Its official listing describes global restrictions for all Pages or posts, role and login-status rules, logged-in-only content, and creation of custom capabilities or roles. It is a better fit when a site needs broad defaults with exceptions.

Rank #3

Sale

WordPress 24-Hour Trainer

$3.95

Buy on Amazon

For either plugin, check rule precedence, multisite behavior, custom post type support and whether restricted material remains available in feeds, REST responses, search results or cached HTML.

Native code versus plugin rules

Protect every delivery path

A front-end check covers the normal HTML request only. Review every route through which the same information could escape:

• Media and downloads: a protected Page does not automatically protect a directly addressable file URL. Store sensitive files behind an authorization-aware delivery mechanism.
• REST and other APIs: inspect custom endpoints and any endpoint that returns the Page’s data; apply an appropriate permission callback.
• Feeds and search: verify that excerpts, titles or full content are not exposed in feeds, internal search, XML output or SEO previews.
• Caching and CDNs: a cache that stores an authorized response and serves it to everyone defeats a correct capability check. Vary or bypass caches for user-specific protected responses.
• Alternative templates and AJAX: secure requests that load fragments or perform actions independently of the main Page.

These checks are deployment precautions: the WordPress permission APIs answer whether a user has a capability, while your cache, media and API configuration determines whether another route bypasses that decision.

Rank #4

Teacher Record Book

• Keep track of everything from attendance to test scores
• Spiral bound
• Measures 8-1/2" x 11"

$4.89

Buy on Amazon

Implementation and testing checklist

1. Write the audience rule in plain language, such as “users with the members capability may view this Page.”
2. Create or select the capability that expresses that rule; do not infer it from an editing capability.
3. Implement current_user_can() before output, or configure a plugin that enforces the equivalent rule.
4. Choose separate behavior for logged-out visitors and authenticated users without permission.
5. Check direct files, REST endpoints, feeds, search, previews and AJAX responses containing the same data.
6. Configure page and CDN caches so one user’s authorized response cannot be reused for another user.
7. Test an Administrator, the intended allowed user, another authenticated role and a logged-out visitor.
8. Repeat the tests after role changes, plugin updates, theme changes and cache purges.

Common mistakes

Using an editorial capability for viewing

edit_pages or publish_pages answers who may modify content, not who should read it. Define a reading capability for the front-end policy.

Checking only the browser-visible Page

Hiding a menu item or returning a different visual block is not authorization. Enforce the decision on the request and on every endpoint that supplies the protected data.

Redirecting every failure to login

An already logged-in user without permission cannot fix the problem by logging in again. Give that case a 403-style response or a useful explanation.

Ignoring cache variation

Authorization can be correct in PHP and still fail operationally if a full-page cache serves the first generated response to subsequent visitors.

Quick Recap

SaleBestseller No. 1

WordPress Multisite Administration

$34.38

Bestseller No. 2

Mon Site WordPress – Volume 2 – Administration & Utilisation (French Edition)

$9.90

SaleBestseller No. 3

WordPress 24-Hour Trainer

$3.95

Bestseller No. 4

Teacher Record Book

Keep track of everything from attendance to test scores; Spiral bound; Measures 8-1/2" x 11"

$4.89

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.