25% off ProSNIPC25OFF
Get Pro

How to redirect subscribers away from wp-admin in WordPress

The SnipCraft team

If your site has customers, members, or subscribers, they have WordPress accounts, and by default they can all reach wp-admin. Here’s how to send low-privilege users back to the front end where they belong.

Why bother?

The default subscriber profile screen exposes the WordPress admin chrome to people who should never see it. On membership sites and WooCommerce stores it looks unprofessional and occasionally leaks information you’d rather keep in the admin. Redirecting them to the homepage (or a custom account page) keeps the experience clean.

The snippet

This checks capability on every admin request and redirects anyone who can’t edit posts, while carefully not breaking AJAX or cron, which also run through admin_init:

php
<?php
add_action( 'admin_init', 'scseed_redirect_non_editors_from_admin' );
function scseed_redirect_non_editors_from_admin() {
    if (
        ! current_user_can( 'edit_posts' ) &&
        ! ( defined( 'DOING_AJAX' ) && DOING_AJAX ) &&
        ! ( defined( 'DOING_CRON' ) && DOING_CRON )
    ) {
        wp_redirect( home_url( '/' ) );
        exit;
    }
}

How it works

current_user_can( 'edit_posts' ) is true for Contributors and up, so Subscribers and Customers get redirected. The two extra guards are the important part: DOING_AJAX and DOING_CRON requests hit admin_init too, and redirecting them would break front-end AJAX and scheduled tasks. Skipping them keeps everything working.

Note

Want to send them to a custom account page instead of the homepage? Swap home_url( '/' ) for your URL. The snippet is in the SnipCraft library. Import it here and edit in place.
#php#security#users
Get SnipCraft freeBrowse the snippet library →