Protecting admin screens is vital for plugin security. Learn to enforce user roles, hide menu items, and secure REST API access in your React-based dashboard.
Previously in this course, we covered input validation and error handling. While that ensures the data we receive is clean, it doesn't guarantee the user has the authority to send that data. In this lesson, we move from data integrity to access control, ensuring our Knowledge Base plugin is only accessible to authorized personnel.
Security in WordPress is a multi-layered practice. It is not enough to hide a button in the UI; you must secure the "front door" (the admin menu) and the "back door" (the REST API).
Authorization is the process of verifying what a user is allowed to do. WordPress handles this through Roles and Capabilities. Instead of checking for a specific role (like 'administrator'), always check for a capability (like 'manage_options'). This allows site administrators to grant access to your plugin to custom roles without you needing to update your code.
If a user doesn't have the capability to manage the knowledge base, they shouldn't even see the menu item. We use the capability argument in add_menu_page().
PHP#6A9955">// In your main plugin file or admin class add_action('admin_menu', 'kb_register_admin_menu'); function kb_register_admin_menu() { add_menu_page( 'Knowledge Base', 'Knowledge Base', 'manage_kb_options', #6A9955">// This is the required capability 'kb-admin', 'kb_render_admin_page', 'dashicons-book' ); }
By setting manage_kb_options, WordPress automatically hides this menu item for any user who lacks this specific capability. If you haven't created this capability yet, you can map it to existing ones using the map_meta_cap filter.
Even if the menu is hidden, a malicious user might try to access your admin page URL directly. We must add a secondary check inside the rendering function.
PHPfunction kb_render_admin_page() { if (!current_user_can('manage_kb_options')) { wp_die(__('You do not have sufficient permissions to access this page.')); } #6A9955">// Render the React root div echo '<div id="kb-admin-root"></div>'; }
This ensures that even if a user guesses the URL path, the server rejects the request before any React assets are loaded.
We have previously discussed implementing REST API permission callbacks. When building your endpoints, your permission_callback must explicitly verify the user's capabilities. Never rely on the client-side state for security.
PHPregister_rest_route('kb/v1', '/settings', [ 'methods' => 'POST', 'callback' => 'kb_update_settings', 'permission_callback' => function() { return current_user_can('manage_kb_options'); }, ]);
If a user tries to POST to this endpoint without the correct capability, WordPress returns a 403 Forbidden response automatically.
For this exercise, perform the following steps to secure your plugin:
manage_kb_options capability to the 'administrator' role using $role->add_cap().add_menu_page call to use manage_kb_options.register_rest_route calls and ensure every single one has a permission_callback that uses current_user_can.fetch request to your API returns a 403 error.if (current_user_can('administrator')) will break your plugin for users who use custom roles or plugins like Members to grant permissions. Always use capabilities.display: none) is not security. It is merely UX. Always enforce the check in PHP.Securing your admin screens requires a defense-in-depth approach. By leveraging WordPress's native capability system, you ensure that access control is consistent across the admin menu, the rendering logic, and the REST API. Always default to denying access, and explicitly grant it only through verified capability checks.
Up next: We will prepare our application for the real world by configuring the production build pipeline.
Learn to enforce strict schemas and validate nested JSON objects in your WordPress REST API to ensure data integrity and security in your plugin.
Read moreLearn to secure your WordPress REST API against CSRF attacks. Master generating nonces, passing them via headers, and verifying them in your API endpoints.
Protecting Admin Screens
Managing File Uploads via REST API
Optimizing API Response Times
Working with Date and Time in React
Implementing Drag-and-Drop Sorting
Creating Custom Hooks for API Logic
Integrating with Gutenberg Blocks
Handling Conflict Resolution
Building a Modal Confirmation System
Implementing Activity Logging
Using Webpack Aliases
Unit Testing API Endpoints
Unit Testing React Components
Handling Large Datasets with GraphQL
Implementing Real-time Updates with Web