Building a successful WordPress multisite network isn’t just about functionality; it’s about providing a secure, streamlined, and professional experience for your users. The Access Restrictions in WP Frontend Admin are your command center for achieving this, allowing you to define exactly who can see what, and where they can see it.
This guide will walk you through every setting, empowering you to build a secure and user-friendly platform.
Preliminary Notes
- For a complete picture, we recommend reading our companion guide on WP Frontend Admin’s general settings for multisite.
- Remember that all frontend dashboard pages are built using our simple but powerful shortcodes.
The Core Security Switch
First, navigate to Network Admin > Frontend Admin > Settings > Access Restrictions. Here you’ll find the primary switch that activates all the rules you’re about to create.
Enable the wp-admin access restrictions
By enabling this single option, you take full control of the wp-admin environment. It activates all the other settings on this page, allowing you to force users onto your custom frontend dashboard and prevent them from accessing the default WordPress backend.
Building Your URL Whitelist
The foundation of your access restrictions is the “whitelist” — the list of admin pages that users are allowed to view on the frontend.
Access restriction: What wp-admin pages can be viewed on the frontend
In this text box, you will list every single wp-admin URL that you want to make available on your frontend dashboard. Any URL not on this list will be blocked. This is crucial for security, as it ensures users can only access the pages you’ve explicitly approved.
Tip: Use Learning Mode for Automatic Whitelisting
Manually copying every URL is slow and tedious. That’s why we created Learning Mode. Simply click the “Start learning mode” link, and for the next 10 minutes, every admin page you visit will be automatically added to the whitelist. It’s the fastest and most accurate way to set up your allowed pages.
Advanced Control with Dynamic Tags
Sometimes URLs contain dynamic values, like a post ID or a username. Our dynamic tags allow you to whitelist these pages easily. Here’s a quick reference:
{any_parameter_value} = this will work with any URL parameter value, for example, any taxonomy key (any value containing letters, numbers, hyphens, and/or underscores together)
{any_single_number} = one number
{any_numbers} = one or more numbers
{any_letter} = one letter in uppercase or lowercase
{any_letters} = one or more letters
Example: To allow users to edit any post, you don’t need to add every single post ID. You can just use a dynamic tag.
- Original URL:
.../wp-admin/post.php?post=123&action=edit - Dynamic URL:
.../wp-admin/post.php?post={any_numbers}&action=edit
This single line now whitelists the edit screen for every post on their site.
Managing Permissions & User Roles
Access restriction: Who can access the wp-admin dashboard
This setting defines your “super users.” Select a capability (manage_network is the default for Super Admins) that allows users to bypass all restrictions and access the traditional wp-admin dashboard. Everyone else will be subject to your rules and redirected to the frontend.
These user roles will use the frontend dashboard
Be explicit about which users should be restricted. Enter a comma-separated list of user role keys (e.g., administrator, editor). Anyone with these roles on a subsite will be automatically redirected to the frontend dashboard if they try to access wp-admin.
Users with role [X] can view users with roles [Y]
This powerful setting gives you granular control over the “Users” page on the frontend. By default, users who can see the user list can see everyone. Here, you can specify that a subsite “administrator” can only see and edit “editors” and “authors” on their own site, preventing them from seeing other administrators.
Handling Blocked Pages & Errors
Access restriction: Frontend dashboard URL
This is the default destination. If a user tries to access a blocked wp-admin page, they will be redirected to the URL you enter here. This should be the main page of your global frontend dashboard.
Blacklisted Page URL (optional)
This lets you set a custom redirect for blocked pages. Instead of sending users to the main dashboard, you could send them to a specific page explaining why that area is restricted.
Wrong Permissions Page URL (optional)
This is for when a user accesses an allowed page but lacks the correct user role to view it. It’s perfect for upselling. You can redirect them to a pricing page explaining that the feature is only available on a higher-tier plan.
Wrong Permissions Message (optional)
As an alternative to redirecting, you can display a custom message directly on the page, explaining why they don’t have access.
Message to display when a page did not load for a technical error
Sometimes things go wrong. If a page fails to load due to a server error or conflict, you can display a friendly message like “We’re sorry, this page is temporarily unavailable. Please contact support if the problem persists.” This is far better than a scary, technical error screen.
Platform-Wide User Management (Multisite)
These settings help you manage how users interact and are managed across your entire network.
Allow site owners to register users for their subsites?
Empower your subsite administrators by enabling this option. It allows them to create new user accounts for their own team (editors, authors, etc.) directly from the frontend dashboard, reducing your administrative workload.
Allow main site administrators to access the regular wp-admin?
This creates an exception for administrators of your main network site. It’s perfect if your main site is a marketing hub managed by a team that needs full wp-admin access, while your customers on subsites use the streamlined frontend dashboard.
Redirect to this URL when a user visits the dashboard without belonging to any site yet?
This is crucial for a smooth onboarding experience. When a new user signs up for your platform but doesn’t have a site yet, you can redirect them to a specific URL to get started—like a “Create Your New Site” page or a subscription plan selector.