PHPackages                             freshsystems/wp-permission-manager - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. freshsystems/wp-permission-manager

ActiveWordpress-plugin

freshsystems/wp-permission-manager
==================================

A user role management plugin for WordPress that puts you in full control of your site's permissions.

3.0.1(4y ago)11402[4 issues](https://github.com/freshsystems/wp-permission-manager/issues)GPL-2.0+PHPPHP >=5.3.0

Since Apr 19Pushed 3y ago3 watchersCompare

[ Source](https://github.com/freshsystems/wp-permission-manager)[ Packagist](https://packagist.org/packages/freshsystems/wp-permission-manager)[ Docs](https://github.com/freshsystems/wp-permission-manager)[ RSS](/packages/freshsystems-wp-permission-manager/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (3)Dependencies (1)Versions (4)Used By (0)

👥 Permission Manager
====================

[](#-permission-manager)

**A user role management plugin for WordPress that puts you in full control of your site's permissions.**

This plugin is forked from the last release of the popular [justintadlock/members](https://github.com/justintadlock/members) plugin, before it's codebase was hijacked and turned into a sales pitch for a premium plugin by it's new maintainers.

[![Screenshot](screenshot-2.png)](screenshot-2.png)

---

Plugin Features
---------------

[](#plugin-features)

- **Role Manager:** Allows you to edit, create, and delete roles as well as capabilities for these roles.
- **Multiple User Roles:** Give one, two, or even more roles to any user.
- **Explicitly Deny Capabilities:** Deny specific caps to specific user roles.
- **Clone Roles:** Build a new role by cloning an existing role.

In order to refocus plugin responsibilities, original features below were removed in [`v3.0.0`](https://github.com/freshsystems/wp-permission-manager/releases/tag/3.0.0). If you still require these features you can use the [`v2.2.1`](https://github.com/freshsystems/wp-permission-manager/releases/tag/2.2.1) release, or another version of this plugin.

- **Content Permissions:** Gives you control over which users (by role) have access to post content.
- **Shortcodes:** Shortcodes to control who has access to content.
- **Widgets:** A login form widget and users widget to show in your theme's sidebars.
- **Private Site:** You can make your site and its feed completely private if you want.

Installation
------------

[](#installation)

```
composer require freshsystems/wp-permission-manager:^3

```

If you're not [using Composer with WordPress](https://roots.io/bedrock-vs-regular-wordpress-install/), you can alternatively download the ZIP archive from the releases page and upload/install the plugin manually. The plugin will be made available through the WordPress Plugin Directory after significant refactoring in `v4.0.0`.

Roadmap
-------

[](#roadmap)

#### [`v2.2.1`](https://github.com/freshsystems/wp-permission-manager/releases/tag/2.2.1) ✅

[](#v221-)

- Update Composer/package details.
- Update UI visible plugin and menu names (`Members` → `WP Permission Manager`).
- Remove non-functional admin settings pages (i.e. 'Donate').

#### [`v3.0.0`](https://github.com/freshsystems/wp-permission-manager/releases/tag/3.0.0) ✅

[](#v300-)

- Remove all 'Shortcodes'.
- Remove all 'Widgets'.
- Remove all 'Content Permission' functionality.
- Remove 'Private Site' functionality.
- Remove all 'add-ons' functionality.
- Make the core 'Role Manager' always enabled.
- Bump minumum PHP version requirement to `>= 5.6.20`.

#### `v4.0.0`

[](#v400)

- Replace remaining "members" terminology (translation text-domain, slug use, etc.).
- Maybe incorporate relevant add-ons (license dependant) into the plugin's core.
- Replace the plugin's namespace, e.g. `Members\` → `Fresh\PermissionManager\`.
- Replace the prefix for all filter/action hook names and functions (deprecate the originals for permanent backwards-compatibility), e.g. `members_register_cap_group()` → `Fresh\PermissionManager\register_cap_group()`, `members_register_cap_groups` → `wppm_register_cap_groups`.
- Consider implementing some enhancements proposed in [justintadlock/members - 3.0.0 Milestone](https://github.com/justintadlock/members/milestone/5).
- Update `readme.md` documentation and add `readme.txt` files.
- Publish to the WordPress Plugin Directory.

---

Documentation
-------------

[](#documentation)

### Role management

[](#role-management)

The Role Manager feature allows you to edit and add new roles as well as add and remove both default capabilities and custom capabilities from roles. It is an extremely powerful system.

Any changes you make to users and roles using this feature are permanent changes. What I mean by this is that if you deactivate or uninstall this plugin, the changes won't revert to their previous state. This plugin merely provides a user interface for you to make changes directly to your WordPress database. Please use this feature wisely.

#### Editing/Adding Roles

[](#editingadding-roles)

This feature can be both a blessing and a curse, so I'm going to ask that you use it wisely. Use extreme caution when assigning new capabilities to roles. You wouldn't want to grant Average Joe the `edit_plugins` capability, for example.

You can find the settings page for this feature under the "Users" menu. It will be labeled "Roles". When clicking on the menu item, you'll be take to a screen similar to the edit post/page screen, only it'll be for editing a role.

In the "Edit Capabilities" box on that screen, you simply have to tick the checkbox next to the capability you want to grant or deny.

#### Grant, deny, or neither?

[](#grant-deny-or-neither)

Every capability can have one of three "states" for a role. The role can be *granted*, *denied*, or simply not have a capability.

- **Granting** a capability to a role means that users of that role will have permission to perform the given capability.
- **Denying** a capability means that the role's users are explicitly denied permission.
- A role that is neither granted nor denied a capability simply doesn't have that capability.

**Note:** When assigning multiple roles to a single user that have a conflicting capability (e.g., granted `publish_posts` and denied `published_posts` cap), it's best to enable the denied capabilities override via the Members Settings screen. This will consistently make sure that denied capabilities always overrule granted capabilities. With this setting disabled, WordPress will decide based on the *last* role given to the user, which can mean for extremely inconsistent behavior depending on the roles a user has.

#### How denied capabilities work

[](#how-denied-capabilities-work)

Suppose the **Super** role is *granted* these capabilities:

- `edit_posts`

Then, suppose the **Duper** role is *granted* these capabilities:

- `publish_posts`
- `edit_products`

Now, further suppose **User A** has the **Super** role because you want them to edit posts. However, you also want **User A** to be able to edit products so you assign them the **Duper** role. Suddenly, **User A** is *granted* the following capabilities:

- `edit_posts`
- `publish_posts`
- `edit_products`

For whatever reason you don't ever want users with the **Super** role to be able to publish posts. Now you have a problem. One way to solve this is to create a third role with just the caps that you want and give that single role to **User A**. However, that becomes cumbersome on larger sites with many roles.

Instead, you could explicitly *deny* the publish posts capability to the **Super** role. When you do that, **User A** is only *granted* the following capabilities:

- `edit_posts`
- `edit_products`

And is denied the following capabilities:

- `publish_posts`

### Multiple user roles

[](#multiple-user-roles)

You can assign a user more than one role by going to that edit user screen in the admin and locating the "Roles" section. There will be a checkbox for every role.

You can also multiple roles to a user from the add new user screen.

On the "Users" screen in the admin, you can bulk add or remove single roles from multiple users.

### Checking if the current user has a capability

[](#checking-if-the-current-user-has-a-capability)

In plugins and your theme template files, you might sometimes need to check if the currently logged in user has permission to do something. We do this by using the WordPress function `current_user_can()`. The basic format looks like this:

```