How to Secure Your WordPress Dashboard and Prevent Clients from Breaking Their Sites

A guide on using Admin Extension Access Control to lock down WordPress plugins and prevent unauthorized changes.

How to Secure Your WordPress Dashboard and Prevent Clients from Breaking Their Sites

If you are a freelance web developer or run an agency, you have probably experienced the dread of a client accidentally bringing down their WordPress site. You spend weeks building a robust, performant website, only for an unauthorized user to log into the dashboard, start deactivating essential plugins, or install poorly coded extensions that break everything.

WordPress is fantastic because of its flexibility, but out of the box, any Administrator can touch everything.

To solve this problem, I want to introduce a lightweight solution: Admin Extension Access Control.

What is Admin Extension Access Control?

Admin Extension Access Control is a WordPress plugin designed to give you granular control over who can see, modify, install, or delete plugins on your site.

Built for modern environments (PHP 8.1+ and WordPress 6.0+), it allows you to configure strict role-based access rules without writing custom PHP functions in your functions.php file every time.

Key Features

• Global Lockdown: Completely remove the plugins page for specific user roles.
• Granular Permissions: Restrict the ability to add, delete, activate, deactivate, or install plugins on a per-role basis.
• Exempt Users Whitelist: Designate trusted administrators (like yourself) who bypass all lockdown rules. Only exempt users can configure the access control settings.
• Dashboard Cleanup: Hide the plugins menu item from unauthorized users to keep the dashboard less confusing for clients.

How It Works

Once installed and activated, the user who activates the plugin is automatically added to the Exempt Users list. This prevents you from accidentally locking yourself out.

From the settings panel, you can select which roles should be restricted from managing plugins. For example, you can give your client an "Administrator" role (so they feel in control of their site) but restrict their ability to install or delete plugins. If they try to access the restricted URLs directly, they will be safely redirected.

What's Next?

The plugin is currently actively developed, and there are some exciting advanced features on the roadmap:

• Individual Plugin Selection: Hide specific plugins from users while leaving others visible.
• Activity & Audit Logs: A timestamped log of all access attempts and plugin visibility events.(Coming soon)
• Slack Notifications: Get instant alerts when someone attempts to breach a lockdown rule.(Coming soon)
• Multisite Compatibility: Manage rules across a network of sites.(Coming soon)

Conclusion

Securing the WordPress admin area is a critical step in maintaining the longevity and stability of your client projects. By restricting plugin access, you save yourself hours of troubleshooting and protect your clients from their own curiosity.

Check out the repository on (https://wordpress.org/plugins/restrictify-extension-access-control/) to contribute, or download the latest release to try it out on your next project!

If you find it useful, let me know in the comments below!