Title: WP User Profile Restriction
Author: TheInnovs
Published: جنوري 7, 2019
Last modified: اگست 4, 2026
---
Search plugins
# WP User Profile Restriction
By [TheInnovs](https://profiles.wordpress.org/theinnovs/)
[Download](https://downloads.wordpress.org/plugin/wp-user-profile-restriction.zip)
* [Details](https://ps.wordpress.org/plugins/wp-user-profile-restriction/#description)
* [Reviews](https://ps.wordpress.org/plugins/wp-user-profile-restriction/#reviews)
* [Installation](https://ps.wordpress.org/plugins/wp-user-profile-restriction/#installation)
* [Development](https://ps.wordpress.org/plugins/wp-user-profile-restriction/#developers)
[Support](https://wordpress.org/support/plugin/wp-user-profile-restriction/)
## Description
**WP User Profile Restriction** is a powerful yet simple plugin that allows you
to restrict profile editing capabilities for specific user roles. Perfect for demo
sites, membership websites, or any WordPress installation where you need to maintain
control over user profile modifications.
#### Key Features
* **Granular Role-Based Restrictions** – Choose exactly which user roles should
be restricted from editing their profiles
* **Restricted Admin Pages** – Block restricted roles from the user management
screens: Profile (enabled by default), Users list, Add New User and Edit User
* **REST API Restriction Parity** – Profile updates sent to `/wp-json/wp/v2/users/
me` or to the user’s own `/wp-json/wp/v2/users/` endpoint are rejected with
HTTP 403, so the restriction cannot be bypassed through the API, a mobile app
or a headless client
* **Custom Redirect Options** – Redirect restricted users to a specific URL instead
of showing an error message
* **Automatic Menu Hiding** – Profile links are automatically hidden from admin
bar and dashboard menu for restricted users
* **Easy Settings Page** – Configure all options from a user-friendly settings
page in WordPress admin
* **Built-in Contact Form** – Send a question or a feature suggestion to the plugin
author straight from the settings page, without leaving your dashboard
* **Backward Compatible** – Maintains default security by restricting Subscribers
and Contributors by default
* **No Coding Required** – Simple checkbox interface for all configurations
* **Lightweight & Fast** – Minimal impact on site performance
#### How It Works
1. **Install and Activate** – The plugin works immediately with secure defaults
2. **Configure Settings** – Go to Settings > Profile Restriction to customize
3. **Select Roles** – Check which user roles should be restricted
4. **Select Pages** – Profile is blocked out of the box; optionally also check the
Users list, Add New User and Edit User screens
5. **Keep REST Protection On** – Leave the REST API restriction enabled so the same
rules apply to API requests
6. **Optional Redirect** – Set a custom redirect URL if desired
7. **Done!** – Restricted users can no longer edit their profiles from the dashboard
or the API
#### Default Behavior
By default, the plugin restricts **Subscribers** and **Contributors** from editing
their profiles. This maintains security while allowing Editors, Authors, and Administrators
full access. You can customize this behavior at any time from the settings page.
#### Perfect For
* Demo and staging websites
* Membership sites
* Multi-author blogs
* Educational institutions
* Client websites
* Any site requiring profile editing restrictions
#### What Gets Restricted
* Direct access to profile.php page
* Any additional user management pages you select: the Users list, Add New User
and Edit User
* Profile update requests sent through the WordPress REST API
* Profile link in admin bar
* Profile submenu in dashboard
* All profile editing capabilities for selected roles
#### Administrator Protection
Administrators always retain full access to edit any profile, regardless of plugin
settings. This ensures you never lock yourself out of critical functionality.
### Additional Information
#### Support
The quickest way to reach us is the contact form in the settings page (Dashboard
> Settings > User Profile Restriction) sidebar, which emails your question or feature
suggestion directly to the plugin author. You can also visit the plugin’s support
forum on WordPress.org.
#### Reviews
If the plugin is doing its job on your site, a five star review on WordPress.org
helps other site owners find it and is genuinely appreciated.
#### Privacy
This plugin does not collect, store, or transmit any user data, and all settings
are stored locally in your WordPress database. The only exception is the contact
form on the settings page: when an administrator chooses to submit it, the name,
email address and message they type are emailed to the plugin author, together with
your site URL, plugin version and WordPress version so we can reproduce the issue.
Nothing is sent unless the form is submitted.
#### Credits
Developed and maintained by TheInnovs | WPCommerz
## Screenshots
[⌊Settings page with role-based restriction options and the support sidebar⌉⌊Settings
page with role-based restriction options and the support sidebar⌉[
Settings page with role-based restriction options and the support sidebar
[⌊Restricted admin pages selection, including the screens coming in a future release⌉⌊
Restricted admin pages selection, including the screens coming in a future release⌉[
Restricted admin pages selection, including the screens coming in a future release
[⌊REST API restriction setting⌉⌊REST API restriction setting⌉[
REST API restriction setting
[⌊Custom redirect configuration⌉⌊Custom redirect configuration⌉[
Custom redirect configuration
[⌊Restricted user attempting to access a blocked admin page⌉⌊Restricted user attempting
to access a blocked admin page⌉[
Restricted user attempting to access a blocked admin page
[[
## Installation
#### Automatic Installation (Recommended)
1. Log in to your WordPress dashboard
2. Navigate to Plugins > Add New
3. Search for “WP User Profile Restriction”
4. Click “Install Now” and then “Activate”
5. Go to Settings > Profile Restriction to configure
#### Manual Installation
1. Download the plugin ZIP file
2. Log in to your WordPress dashboard
3. Navigate to Plugins > Add New > Upload Plugin
4. Choose the downloaded ZIP file and click “Install Now”
5. Activate the plugin
6. Go to Settings > Profile Restriction to configure
#### FTP Installation
1. Download and unzip the plugin file
2. Upload the `wp-user-profile-restriction` folder to `/wp-content/plugins/` directory
3. Activate the plugin through the Plugins menu in WordPress
4. Go to Settings > Profile Restriction to configure
## FAQ
### Does this plugin require any configuration?
No! The plugin works immediately upon activation with secure defaults (Subscribers
and Contributors are restricted). However, you can customize the behavior from Settings
> Profile Restriction.
### Which user roles are restricted by default?
By default, **Subscribers** and **Contributors** are restricted from editing their
profiles. This provides security while maintaining backward compatibility with version
1.0.6.
### Can I choose which roles to restrict?
Yes! Version 2.0 introduces a settings page where you can select exactly which user
roles should be restricted using simple checkboxes.
### Can administrators still edit profiles?
Yes, administrators always have full access to edit any profile, regardless of plugin
settings.
### What happens when a restricted user tries to access their profile?
By default, they see an error message. Optionally, you can enable custom redirect
to send them to a specific page (like the homepage or a custom access denied page).
### Will restricted users see the Profile menu?
No, the Profile link is automatically hidden from both the admin bar and the dashboard
sidebar menu for all restricted users.
### Can I redirect restricted users to a custom page?
Yes! In the settings page, you can enable custom redirect and specify any URL where
restricted users should be redirected.
### Is this plugin compatible with the latest WordPress version?
Yes, the plugin is regularly tested and updated to ensure compatibility with the
latest WordPress releases.
### Will this affect my existing users?
If you’re upgrading from version 1.0.6, the plugin maintains the same default behavior(
restricting Subscribers and Contributors). Your existing security settings remain
intact.
### Can restricted users still edit their profile through the REST API?
No. Since version 2.0.1 the plugin also blocks write requests (POST, PUT, PATCH
and DELETE) to `/wp-json/wp/v2/users/me` and to the user’s own `/wp-json/wp/v2/users/
` endpoint, returning HTTP 403. This closes a real bypass in which the profile.
php screen was blocked but the API endpoint was not. The protection is enabled by
default and can be toggled from the settings page.
### Which additional wp-admin pages can I restrict?
This version provides checkboxes for the four user management screens: Profile (`
profile.php`), Users list (`users.php`), Add New User (`user-new.php`) and Edit
User (`user-edit.php`). The Profile page is selected by default. Further screens
such as Tools, Export, Import, General Settings, Themes, Plugins, Comments and Media
Library, along with free-form custom page slugs, are listed on the settings page
as options planned for the Pro version.
### Could I accidentally lock myself out of the plugin settings?
No. The plugin’s own settings screen is always exempt from page restrictions, and
administrators are only affected if you explicitly add the Administrator role to
the restricted roles list.
### Can I restrict Editors or Authors?
Yes, you can select any combination of user roles to restrict from the settings
page.
### Does this work with custom user roles?
Yes, the plugin automatically detects all user roles on your site, including custom
roles created by other plugins.
### How do I contact the developer about a question or a feature idea?
Use the contact form in the sidebar of the settings page. Fill in your name, email
address and the details of your question, then press Submit. The message is emailed
to the plugin author with your address as the reply-to, so any answer comes straight
back to you. Only administrators can see and use the form.
### The contact form says the message could not be sent. What now?
That message means your WordPress site could not hand the email to a mail server,
which is common on hosts without a configured mailer. Installing an SMTP plugin
usually resolves it. In the meantime you can email theinnovs@gmail.com directly.
### Does the contact form send any of my site data automatically?
No. Nothing leaves your site unless an administrator fills in the form and presses
Submit. When that happens the message includes your site URL, plugin version and
WordPress version so we can reproduce the issue you are describing.
## Reviews
### [Great](https://wordpress.org/support/topic/great-14985/)
[gwenm](https://profiles.wordpress.org/gwenm/) اکتوبر 28, 2022
Very good 🙂
### [It works!](https://wordpress.org/support/topic/it-works-2273/)
[OutBoxed](https://profiles.wordpress.org/outboxed/) اپریل 26, 2022
It does exactly what I needed it to do, thank you 🙂 PS: This works perfectly in
conjunction with the Autologin Links and Registered Users Only plugins, where you
want to create a standard subscriber autologin link (for restricted/intranet/private
content), but you don't want subscribers to be able to modify any profile info.
### [Nice plugin](https://wordpress.org/support/topic/nice-plugin-4163/)
[samurai17](https://profiles.wordpress.org/samurai17/) مارچ 26, 2021
Good job 🙏
### [Great feature](https://wordpress.org/support/topic/great-feature-44/)
[lien007](https://profiles.wordpress.org/lien007/) جنوري 24, 2021
Thank you so much for making
### [Thank you so much](https://wordpress.org/support/topic/thank-you-so-much-121/)
[evillizard](https://profiles.wordpress.org/evillizard/) مې 27, 2020
Quick and simple straight to the point, other authors to should be more like you,..
I've tried several confusing plugins .. But this just went straight to the point
and solved the problem..
[ Read all 5 reviews ](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/)
## Contributors & Developers
“WP User Profile Restriction” is open source software. The following people have
contributed to this plugin.
Contributors
* [ TheInnovs ](https://profiles.wordpress.org/theinnovs/)
[Translate “WP User Profile Restriction” into your language.](https://translate.wordpress.org/projects/wp-plugins/wp-user-profile-restriction)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/wp-user-profile-restriction/),
check out the [SVN repository](https://plugins.svn.wordpress.org/wp-user-profile-restriction/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/wp-user-profile-restriction/)
by [RSS](https://plugins.trac.wordpress.org/log/wp-user-profile-restriction/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 2.0.1
* Added: Restricted Admin Pages – block restricted roles from wp-admin screens
beyond profile.php, with checkboxes for the Users list, Add New User and Edit
User screens
* Added: The Profile page (profile.php) is now restricted by default on new installs,
matching the plugin’s long-standing behaviour
* Added: Preview of further restrictable screens (Tools, Export, Import, General
Settings, Themes, Plugins, Comments, Media Library and custom page slugs) shown
as options reserved for the Pro version
* Added: REST API restriction parity – write requests to /wp-json/wp/v2/users/me
and to the user’s own /wp-json/wp/v2/users/ endpoint are now rejected with HTTP
403, closing the API bypass of the profile.php restriction
* Added: Settings toggle to enable or disable the REST API restriction, enabled
by default
* Added: Developer hooks – wpupr_default_settings, wpupr_available_admin_pages,
wpupr_pro_admin_pages, wpupr_custom_pages_available, wpupr_restricted_pages,
wpupr_before_restrict_admin_page, wpupr_after_pro_page_checkboxes, wpupr_rest_write_methods,
wpupr_is_restricted_rest_route, wpupr_rest_access_denied_message, wpupr_rest_access_denied_response
and wpupr_rest_access_denied
* Improved: Access denial logic centralised so redirects and error messages behave
identically on the profile page and on other restricted pages
* Improved: Settings are merged with defaults on read, so options saved by earlier
versions keep working without a database upgrade
* Improved: Page entries are sanitized against path traversal, only pages offered
by this version can be saved or enforced, and the plugin’s own settings screen
can never be blocked
* Added: Contact form in the settings sidebar for questions and feature suggestions,
delivered to the plugin author by email with your address set as the reply-to
* Added: Five star review request on the settings page, opening WordPress.org in
a new tab
* Added: “New” badges on the Restricted Admin Pages and REST API Restrictions sections
* Added: Developer hooks – wpupr_new_badge, wpupr_settings_page_url, wpupr_review_url,
wpupr_before_sidebar, wpupr_after_sidebar, wpupr_contact_form_before_submit,
wpupr_contact_form_processed, wpupr_contact_email_to, wpupr_contact_from_email,
wpupr_contact_from_name, wpupr_contact_email_subject, wpupr_contact_email_message
and wpupr_contact_email_headers
* Improved: Settings page now uses a two column layout, placing the support and
review boxes in the previously empty space beside the settings
* Updated: Tested with WordPress 7.0.2
#### 2.0.0 (2024-11-09)
* **Major Update** – Complete rewrite with new features
* Added: Settings page for easy configuration
* Added: Granular role-based restriction controls
* Added: Custom redirect option for restricted users
* Added: Automatic hiding of Profile menu for restricted users
* Added: Checkbox interface for selecting restricted roles
* Improved: Code structure using OOP approach
* Improved: Security with proper sanitization and validation
* Improved: User experience with informative settings page
* Maintained: Backward compatibility with default restrictions
* Updated: Tested with WordPress 6.8.3
#### 1.0.6
* Fix: Compatibility with the latest WordPress version
#### 1.0.5
* Compatibility fix with WordPress 5.8.2
#### 1.0.4
* Compatibility fix with latest WordPress
#### 1.0.3
* Compatibility check
#### 1.0.2
* Compatibility with WordPress 5.3.2
#### 1.0.1
* Compatibility with WordPress 5.1
#### 1.0.0
* Initial release
## Meta
* Version **2.0.1**
* Last updated **2 میاشتی ago**
* Active installations **500+**
* WordPress version ** 4.0.3 or higher **
* Tested up to **7.0.6**
* Language
* [English (US)](https://wordpress.org/plugins/wp-user-profile-restriction/)
* Tag
* [role based restrictions](https://ps.wordpress.org/plugins/tags/role-based-restrictions/)
* [Advanced View](https://ps.wordpress.org/plugins/wp-user-profile-restriction/advanced/)
## Ratings
5 out of 5 stars.
* [ 5 5-star reviews ](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/?filter=5)
* [ 0 4-star reviews ](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/?filter=4)
* [ 0 3-star reviews ](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/?filter=3)
* [ 0 2-star reviews ](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/?filter=2)
* [ 0 1-star reviews ](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/?filter=1)
[Your review](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/wp-user-profile-restriction/reviews/)
## Contributors
* [ TheInnovs ](https://profiles.wordpress.org/theinnovs/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/wp-user-profile-restriction/)