Keep subscribers and customers out of wp-admin in WordPress
To keep subscribers and customers out of wp-admin, send them to the front page whenever they ask for a dashboard screen, and leave them their own profile. BetterShield does that with one fix, Dashboard lock for customers and subscribers, which starts off and can be trialed before it changes anything. This guide covers how to set it up, which accounts it never touches, what it can break, and how to check it.
The fix is one of the sign-in changes described in WordPress user roles security, which explains why each account should hold only the access it needs. This post is the practical step for the accounts that need none of wp-admin.
Quick summary
- Dashboard lock for customers and subscribers sends the roles you choose to the front page when they open a dashboard screen, except their own profile.
- It is under Signing in on BetterShield › Protection › Login & Access, and it starts off.
- It never applies to an account that can manage the site or BetterShield, to a super admin, or to an account that can edit posts, upload files, list users or moderate comments.
- Preview the change and Monitor first show who it reaches before anything changes.
- Undo never expires: turn the switch off and everyone reaches the dashboard as before.
Why it matters
A site that lets people register fills up with accounts that have no work in the dashboard: readers who subscribed, customers who bought something, members who joined a course. WordPress still lets each of them open wp-admin. It is a quiet gap rather than a danger, but a smaller dashboard audience means fewer screens for a restricted account to reach, and fewer questions from people who wandered into the wrong place.
The idea behind it is the principle of least privilege: give each account only what its job needs. WordPress describes what each built-in role can do in its roles and capabilities documentation. A subscriber can read and edit their own profile, and that is about all.
What it does
When one of the chosen roles asks for a dashboard screen, BetterShield sends it to the front page. In detail:
- The profile still works. The account can still reach its own profile, where it changes its password, manages two-factor and ends a sign-in it does not recognize.
- Front-end features keep working. admin-ajax.php and admin-post.php are left alone, because front-end features rely on them while someone is signed in.
- The admin bar is hidden for those accounts on the front end. It still shows on their profile screen.
- Signed-out visitors are not affected. That is the job of Hide the dashboard, a separate fix covered below.
Who it never applies to
The fix is checked on every request, and it never applies to:
- an account that can manage this site or BetterShield, or a super admin;
- an account with work in the dashboard: one that can edit posts, upload files, list users or moderate comments, even when it also holds a chosen role. An editor who also became a customer keeps the dashboard.
Only roles with no work in the dashboard are offered in the list, usually Subscriber and, on a store, Customer.
Set it up
- Open BetterShield › Protection › Login & Access and find Dashboard lock for customers and subscribers under Signing in.
- Under Which accounts to keep out, tick the roles to keep out. You can tick more than one.
- Press Preview the change. Its first line says how many accounts it reaches, and nothing changes.
- Turn the switch on. The row names the roles, with On since and Undo never expires.
| Option | What it does | Default |
|---|---|---|
| Which accounts to keep out | The roles sent to the front page, one or several. | Subscriber |
The choice is hidden while the fix is on. To change it, turn the fix off, choose again and turn it on.
Like every Signing in fix, applying it first checks your way back in: a working recovery link or unused printed code, checked within the last day. If that fails, Check the way back in first offers Check now and Go ahead anyway, which is logged. See Set up recovery.
Trial it with Monitor first
Monitor first, at the end of the row, counts real dashboard requests without sending anyone away.
- Tick the roles, choose a New observation window (1 hour, 24 hours, which is preselected, or 7 days), and press Start monitoring with the fields above.
- The panel reads, for example, “310 requests observed; 4 matched this rule.” End monitoring now stops early.
- When the window ends, press Enforce reviewed settings. It applies the roles saved with the window and leaves the usual undo.
Checkout traffic is not counted. For the wider picture on a shop, see WooCommerce security: protect customer and staff sign-ins. For a membership or course site, see Membership site security: members, instructors and shared logins.
Automatic undo for the first 24 hours
When you enforce from Monitor first, this fix also offers Automatic undo for the first 24 hours: Keep undo manual, the default, or Undo after N authenticated denials with 1, 5 or 10. The undo runs with the site’s scheduled tasks, so it can come late. Because a restricted account can trigger it, the panel suggests it only while you are testing.
From WP-CLI
wp bettershield harden admin_area_access --dry-run
wp bettershield harden admin_area_access --roles=subscriber,customer --user=admin
Without --roles, it keeps Subscribers out. An AI assistant connected to BetterShield can only propose this fix, as a plan you agree to. See WP-CLI commands.
Two fixes, two different jobs
Do not mix this up with the fix beside it. They answer different people:
| Fix | Who it answers | What happens |
|---|---|---|
| Dashboard lock for customers and subscribers | Signed-in subscribers and customers | Sent to the front page, profile kept |
| Dashboard privacy for visitors | Signed-out visitors | /wp-admin/ answers 404 instead of the sign-in form |
Neither one moves the sign-in page. If you also want a different sign-in address, change the WordPress login URL is the guide for that, and Dashboard privacy for visitors is the fix meant to go with it.
What it can break, and how to undo
- Links into the dashboard. A link that takes a signed-in member to a dashboard page other than their profile now takes them home. A dashboard screen a plugin built for members is out of their reach.
- The admin bar is gone for those accounts on the front end.
- WooCommerce or bbPress. With either active, the row says it already keeps customers out of the dashboard, and whichever runs first decides where they land.
To undo, turn the switch off. Everyone reaches the dashboard as before. Undo needs a signed-in browser, and your password if Ask for my password before an action that removes a protection is on. From the terminal: wp bettershield harden admin_area_access --undo --user=admin.
Check it is working
- A test account. Sign in as an account in a chosen role and open yoursite.com/wp-admin/. You land on the front page, with no admin bar. yoursite.com/wp-admin/profile.php still opens.
- The row. It names the roles and says this fix “has no effect a page view can check, so it is reported from your settings.”
- The activity log. “Hardening applied” and “Hardening undone” name the fix, including an automatic undo. See Activity log.
- Findings. Some protections that are switched on are not working (Medium) names the fix if it reads as on but is no longer in force, for example because another plugin took it off.
Recommended settings
We recommend it on any site where people register for an account, since everything they need is on the front end and in their profile.
| Site | What we recommend |
|---|---|
| Blog or brochure site | Subscriber, if anyone can register. With no registered readers it has nothing to do. |
| Store (WooCommerce) | Customer. WooCommerce already sends customers to its own account page, so check where a customer lands afterwards. |
| Membership or course site | Your members’ role, if it is listed. Run Monitor first for 24 hours to see whether members reach the dashboard for anything. |
| Agency or many sites | Run Monitor first for 7 days on a client site before enforcing. |
On a multisite network each site has its own switch, and the role list shows that site’s roles.
Frequently asked questions
Can a subscriber still change their password?
Yes. The fix lets the chosen roles keep their own profile, where they change their password, manage two-factor and end a sign-in they do not recognize.
Does it lock out my editors?
No. It never applies to an account that can edit posts, upload files, list users or moderate comments, or that can manage the site. An editor who is also a customer keeps the dashboard.
Is this the same as hiding wp-admin from visitors?
No. This fix answers signed-in accounts in the roles you choose. Dashboard privacy for visitors answers signed-out requests with a 404. They work well together.
What if a plugin for members stops working?
Turn the switch off and everyone reaches the dashboard as before. Then trial the roles with Monitor first before you enforce again, to see what your members open.
Can I try it without affecting anyone?
Yes. Preview the change reports how many accounts it reaches and changes nothing, and Monitor first counts real requests for 1 hour, 24 hours or 7 days without sending anyone away.
Conclusion
Subscribers and customers rarely have a reason to open wp-admin. One switch sends them to the front page, keeps their profile, spares every account with real work in the dashboard, and undoes at any time. Preview it, monitor it for a day, then turn it on and check with a test account.
BetterShield is free on WordPress.org. The docs cover the fix in full: Low-privilege accounts, Hide the dashboard and Login & Access.