Title: Limited Admin Role By HEMDOX Digital
Author: minhaz52
Published: <strong>6.4.2026</strong>
Last modified: 13.10.2026

---

Hae lisäosia

![](https://ps.w.org/limited-admin-role/assets/banner-772x250.png?rev=3744924)

![](https://ps.w.org/limited-admin-role/assets/icon.svg?rev=3744924)

# Limited Admin Role By HEMDOX Digital

 [minhaz52](https://profiles.wordpress.org/minhaz52/)

[Lataa](https://downloads.wordpress.org/plugin/limited-admin-role.2.9.3.zip)

 * [Tiedot](https://fi.wordpress.org/plugins/limited-admin-role/#description)
 * [Arvostelut](https://fi.wordpress.org/plugins/limited-admin-role/#reviews)
 *  [Asennus](https://fi.wordpress.org/plugins/limited-admin-role/#installation)
 * [Kehitys](https://fi.wordpress.org/plugins/limited-admin-role/#developers)

 [Tuki](https://wordpress.org/support/plugin/limited-admin-role/)

## Kuvaus

**Limited Admin Role** adds a custom WordPress role called **Admin Panel Manager**.
Give it to a shop manager, a content writer, an SEO agency or a client, and choose
exactly what they can see and do — without ever handing over full administrator 
rights.

Users, plugins, themes and code stay locked no matter what you configure, so the
role can never take over the site.

#### One-click presets

Set up the whole role in one click, then fine-tune it:

 * **Whole job:** Store Manager, Content + SEO, Accountant (read-only), Client Owner.
 * **One area only:** ⚡ LiteSpeed Cache only, 🔍 SEO only, 📝 Posts only, 🛍️ Shop
   only.
 * **Your own presets:** save the current settings as a preset, or create one from
   JSON. Download any preset and reuse it on your other sites.

Every preset shows exactly what will change before you apply it, and every change
is saved in History so it can be undone.

#### Key features

 * 🔐 **Capability grid** — turn every WordPress, WooCommerce and SEO-plugin permission
   on or off, grouped into clear categories.
 * 🚫 **Menu & URL blocks** — hide and block Orders, Customers, Reports, Coupons,
   Download permissions, Marketing, Users, Tools, Appearance, Settings and more (
   menu, direct URL and REST API).
 * 🧩 **Plugin Access** — give the role full access to one plugin (for example Rank
   Math, Yoast, AIOSEO or LiteSpeed Cache), or hide single plugin pages.
 * ⚡ **Quick actions** — let the role purge the LiteSpeed cache from the toolbar
   without opening LiteSpeed settings.
 * 🛒 **WooCommerce controls** — orders blocked, view-only, ”no delete/refund” or
   full; allow or block customers, sales reports, coupons, download permissions,
   marketing and status; hide stock and cost of goods. Works with HPOS and legacy
   order screens.
 * 🧱 **Preset builder** — tick what a person may use and save it as your own one-
   click preset.
 * 👁️ **Preview as role** — see the admin exactly as the role sees it, then exit
   with one click.
 * 🗺️ **Access Map** — every admin page with allowed/blocked and the reason why.
 * 📋 **Activity log** — logins, logouts, blocked attempts and settings changes.
 * 🕐 **Session timeout** — forces logout after a set number of hours, even with”
   Remember Me”.
 * 📅 **Access expiry** — set an end date per user; access stops automatically.
 * ↩️ **History, export and import** — restore any earlier version, move settings
   between sites as JSON.
 * 🎨 **Colorful, modern settings screens** with a theme color picker.
 * 💻 **WP-CLI** — `wp limadro status|export|import|history|rollback|preset|reset
   |log|expire`.
 * 🆘 **Lockout recovery** — `define( 'LIMADRO_DISABLE', true );` in wp-config.php
   switches restrictions off.

#### Always locked for security

Whatever you configure, the role can never: create, edit, delete or promote users;
change roles; post unfiltered HTML; install, update, delete or edit plugins or themes;
switch themes; or edit files. The matching REST API routes are blocked too.

#### About the developer

Limited Admin Role is built and maintained by [HEMDOX Digital](https://hemdox.com/limited-admin-role/).
Visit the [plugin page](https://hemdox.com/limited-admin-role/) for guides and updates.
If the plugin saves you time, a [5-star review](https://wordpress.org/support/plugin/limited-admin-role/reviews/#new-post)
helps a lot.

#### Compatibility

Tested with WooCommerce 11.2 (HPOS and legacy orders), Elementor 4.3, Rank Math,
Yoast SEO, All in One SEO and LiteSpeed Cache.

### License

This plugin is licensed under the GNU General Public License v2.0 or later.

Full license text: https://www.gnu.org/licenses/gpl-2.0.html

## Kuvankaappaukset

[⌊Presets — one-click setups for a whole job or a single area, plus your own presets
from JSON.⌉⌊Presets — one-click setups for a whole job or a single area, plus your
own presets from JSON.⌉[

Presets — one-click setups for a whole job or a single area, plus your own presets
from JSON.

[⌊General — role name, session timeout, after-login page and admin notices, with
the colorful header and theme color picker.⌉⌊General — role name, session timeout,
after-login page and admin notices, with the colorful header and theme color picker
.⌉[

General — role name, session timeout, after-login page and admin notices, with the
colorful header and theme color picker.

[⌊Capabilities — every permission grouped by area, with search and filters.⌉⌊Capabilities—
every permission grouped by area, with search and filters.⌉[

Capabilities — every permission grouped by area, with search and filters.

[⌊Menu & URL Blocks — Allowed / Blocked switches for whole areas (menu, URL and 
REST API), with the always-locked list.⌉⌊Menu & URL Blocks — Allowed / Blocked switches
for whole areas (menu, URL and REST API), with the always-locked list.⌉[

Menu & URL Blocks — Allowed / Blocked switches for whole areas (menu, URL and REST
API), with the always-locked list.

[⌊WooCommerce — one choice for order access plus switches for customers, reports,
coupons, download permissions, marketing, settings and status.⌉⌊WooCommerce — one
choice for order access plus switches for customers, reports, coupons, download 
permissions, marketing, settings and status.⌉[

WooCommerce — one choice for order access plus switches for customers, reports, 
coupons, download permissions, marketing, settings and status.

[⌊Plugin Access — every active plugin is detected: Default, Full access or Hidden
per plugin, quick actions like LiteSpeed purge, or block single pages.⌉⌊Plugin Access—
every active plugin is detected: Default, Full access or Hidden per plugin, quick
actions like LiteSpeed purge, or block single pages.⌉[

Plugin Access — every active plugin is detected: Default, Full access or Hidden 
per plugin, quick actions like LiteSpeed purge, or block single pages.

[⌊Access Map — every admin page, allowed or blocked, and why.⌉⌊Access Map — every
admin page, allowed or blocked, and why.⌉[

Access Map — every admin page, allowed or blocked, and why.

[⌊Activity — logins, blocked attempts and settings changes.⌉⌊Activity — logins, 
blocked attempts and settings changes.⌉[

Activity — logins, blocked attempts and settings changes.

[⌊Tools & History — restore any earlier version, export and import settings.⌉⌊Tools&
History — restore any earlier version, export and import settings.⌉[

Tools & History — restore any earlier version, export and import settings.

[⌊The orders screen as the Admin Panel Manager sees it with "No delete or refund".⌉⌊
The orders screen as the Admin Panel Manager sees it with "No delete or refund".⌉[

The orders screen as the Admin Panel Manager sees it with ”No delete or refund”.

[⌊Preset builder — tick the areas and plugins a person may use, name it and save
it as your own preset.⌉⌊Preset builder — tick the areas and plugins a person may
use, name it and save it as your own preset.⌉[

Preset builder — tick the areas and plugins a person may use, name it and save it
as your own preset.

## Asennus

 1. Install from **Plugins  Add New** (search ”Limited Admin Role”) or upload the `
    limited-admin-role` folder to `/wp-content/plugins/`.
 2. Activate the plugin. The **Admin Panel Manager** role is created automatically.
 3. Go to **Limited Admin Role  Settings  Presets** and pick a starting point.
 4. Assign the role to a user via **Users  Add New** or **Users  Edit  Role**.
 5. Click **Preview as Admin Panel Manager** to check what the user will see.

## UKK

### Why should I update to 2.9.2?

2.9.2 is a security release. Older versions let a user with the Admin Panel Manager
role use the REST API to gain more rights than you gave them. 2.9.2 closes this 
and permanently locks users, roles, plugins, themes and code for the role. Every
site using the plugin should update now. The update also adds presets, the WooCommerce
tab, preview, history and many other features — your existing settings are kept.

### Will updating change my settings?

No. Your saved capabilities, blocks and plugin access are kept. After updating, 
open **Menu & URL Blocks** once and check the blocks are as you want them: a bug
in older versions could switch them off when another tab was saved.

### How do I assign the role to a user?

Go to **Users  Add New** (or edit an existing user) and set the Role to **Admin 
Panel Manager**.

### What is the fastest way to set it up?

Open the **Presets** tab and click **Use this preset** on the card that fits the
job. Then review the other tabs and use **Preview as Admin Panel Manager** to check
the result.

### What is the difference between the presets?

”Whole job” presets (Store Manager, Content + SEO, Accountant, Client Owner) adjust
your current settings for a common job. ”One area only” presets (LiteSpeed Cache
only, SEO only, Posts only, Shop only) first hide everything, then open just that
one area.

### How do I create my own preset?

On the **Presets** tab, use **Build a custom preset** (tick the areas and plugins
the person may use), **Save current settings as a preset**, or **Create a preset
from JSON** (upload a file or paste the JSON). The tab shows the JSON format with
an example you can copy. Downloaded presets can be imported on any site running 
this plugin.

### Can a JSON preset give the role dangerous rights?

No. Every preset is checked again each time it is applied. Locked permissions (users,
roles, plugins, themes, unfiltered HTML, code editing) and locked plugins are always
removed.

### Can I give the role full access to one plugin, like Rank Math or LiteSpeed Cache?

Yes. Go to **Plugin Access** and turn on **Full access** for that plugin. The role
can then use all of its screens, while everything else stays restricted. Plugins
that manage users, files or code cannot be given full access.

### Can the role clear the LiteSpeed cache without opening LiteSpeed settings?

Yes. On **Plugin Access**, enable the **Purge cache (toolbar menu)** quick action
for LiteSpeed Cache.

### Can the user install or activate plugins?

No. Installing, activating, deactivating, updating and deleting plugins is always
blocked. You can choose whether the role may view the plugins list (Capabilities
activate_plugins).

### Does it work with WooCommerce HPOS?

Yes. Orders, Customers and Reports are blocked on both the HPOS screens (`page=wc-
orders`) and the legacy screens, as well as AJAX and the WooCommerce REST API. The
WooCommerce tab can make orders view-only or prevent deletes and refunds.

### Does it work with Rank Math, Yoast SEO and All in One SEO?

Yes. The SEO meta boxes appear on posts and products for the role. To let the role
open the SEO plugin’s own screens, give that plugin Full access on the Plugin Access
page (or use the SEO only / Content + SEO preset).

### Why does the role see Elementor?

Elementor shows its menu to anyone who can edit posts. To hide it, open **Plugin
Access** and check the Elementor pages you want to block.

### How does the session timeout work?

The plugin records the login time. When the configured number of hours has passed(
default 12), the user is logged out — ”Remember Me” cannot extend it.

### Can I see what the role can open?

Yes. The **Access Map** tab lists every admin page as allowed or blocked with the
reason, and **Preview as Admin Panel Manager** shows the admin exactly as the role
sees it.

### I locked myself out. What now?

Add `define( 'LIMADRO_DISABLE', true );` to wp-config.php. All restrictions switch
off (the security locks stay). Fix the settings, then remove the line. You can also
restore an earlier version from **Tools & History** or with `wp limadro rollback`.

### Why do I see a review request?

Seven days after install, administrators see a small review card on this plugin’s
own settings screens (never on other admin pages or the front end). Click ”Maybe
later” to hide it for 30 days or ”I already did” to hide it for good.

### Is the theme color the same for every admin?

No. Each administrator picks their own color with the 🎨 button. It only changes
the plugin’s settings screens.

### What is removed when I delete the plugin?

The role, all plugin settings, presets, history, the activity log and the plugin’s
user meta. Users who had the role keep their accounts.

## Arvostelut

There are no reviews for this plugin.

## Avustajat & Kehittäjät

“Limited Admin Role By HEMDOX Digital” perustuu avoimeen lähdekoodiin. Seuraavat
henkilöt ovat osallistuneet tämän lisäosan kehittämiseen.

Avustajat

 *   [ minhaz52 ](https://profiles.wordpress.org/minhaz52/)

[Käännä “Limited Admin Role By HEMDOX Digital” omalle kielellesi.](https://translate.wordpress.org/projects/wp-plugins/limited-admin-role)

### Oletko kiinnostunut kehitystyöstä?

[Browse the code](https://plugins.trac.wordpress.org/browser/limited-admin-role/),
check out the [SVN repository](https://plugins.svn.wordpress.org/limited-admin-role/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/limited-admin-role/)
by [RSS](https://plugins.trac.wordpress.org/log/limited-admin-role/?limit=100&mode=stop_on_copy&format=rss).

## Muutosloki

#### 2.9.3

 * New: preset builder — tick the areas, plugins and quick actions a person may 
   use, name it, and save it as your own preset or apply it straight away.
 * New: WooCommerce blocks for Coupons, Download permissions (the order meta box,
   grant/revoke and the downloads REST routes), Marketing, and Status & Extensions.
 * New: one place to set order access — Blocked, View only, Edit (no delete or refund)
   or Full.
 * Changed: Menu & URL Blocks, WooCommerce and Plugin Access screens redesigned 
   with clear Allowed / Blocked switches, Allow all / Block all, live counters and
   an unsaved-changes bar.
 * Changed: Plugin Access now uses one choice per plugin (Default, Full access or
   Hidden), with search, filters and per-page blocks.
 * Fixed: blocking Sales reports now also blocks the WooCommerce Analytics REST 
   routes (/wc-analytics/reports).
 * Fixed: blocking Customers now also blocks the WooCommerce Customers screen under
   wc-admin.
 * New: ”SEO fields in the editor” area in the preset builder — Rank Math, Yoast
   and AIOSEO boxes on posts, pages and products, without their settings.
 * Security: the role can no longer change capabilities through other plugins’ role
   editors (Rank Math Role Manager, Members, User Role Editor), regardless of settings.
 * Fixed: Hidden plugins are now matched by who registered the page, not only by
   its URL — e.g. Rank Math’s ”rank-math-options-*” settings pages, which live in
   the ”seo-by-rank-math” folder, were still reachable.
 * Fixed: Hidden plugins also hide their toolbar menus (front end and admin) and
   their own post-type screens (e.g. Elementor’s template library).
 * Fixed: Full access now works for plugins that use their own capabilities (e.g.
   Contact Form 7) and for plugin pages under Tools (e.g. Redirection), while the
   Tools block keeps the core Tools screens closed.
 * Fixed: blocking Coupons and Download permissions now also covers their WooCommerce
   Analytics pages.
 * Fixed: the Orders menu item, ”Add order” button and order list columns were hidden
   on legacy (non-HPOS) stores even when orders were allowed.
 * Fixed: ”No delete or refund” now also stops deleting order notes.
 * Fixed: blocking WooCommerce Settings now also removes the top-level Payments 
   menu and the ”Store coming soon” toolbar badge that open it.
 * Fixed: a PHP warning on WordPress 6.0 when the block editor loads with the settings
   route blocked.
 * Tested: WordPress 6.0 with WooCommerce 7.7 (legacy orders), WordPress 6.5 with
   WooCommerce 8.9 (HPOS) and WordPress 7.1 with WooCommerce 11.2 (HPOS), plus Rank
   Math, Yoast SEO, Elementor and LiteSpeed Cache.
 * New: refreshed plugin icon and banner.
 * New: a small, dismissible review request on the plugin’s own settings screens(
   shown 7 days after install, administrators only).
 * New: ”Made by HEMDOX Digital”, rate and support links in the footer of the plugin’s
   settings screens.
 * Changed: clearer plugin description on the Plugins screen and a Plugin URI.

#### 2.9.2

 * Security: fixed privilege escalation via REST API for Admin Panel Manager role.
   All users should update immediately.
 * Security: manage_options is now only granted while a Rank Math (/rankmath/v1/),
   Yoast (/yoast/v1/) or AIOSEO (/aioseo/v1/) REST route is executing — never based
   on the request URL.
 * Security: the role can never manage users or roles, post unfiltered HTML, edit
   files, or install/update/delete/edit/switch plugins or themes, regardless of 
   settings.
 * Security: REST routes /wp/v2/plugins, /wp/v2/settings and all write requests 
   to /wp/v2/users are always blocked for the role.
 * Security: plugin bulk actions submitted via the bottom bulk-action dropdown are
   now blocked.
 * Security: saving one settings tab no longer resets the other tabs. Previously,
   saving General or Capabilities turned off the Orders, Customers, Users and Reports
   blocks (and saving General cleared all capabilities).
 * Security: Site Editor and Font Library were reachable when Appearance was blocked;
   block-theme REST writes (templates, global styles, navigation, fonts) are now
   blocked too.
 * New: Presets tab — one-click setups for a whole job (Store Manager, Content +
   SEO, Accountant, Client Owner) or one area only (LiteSpeed Cache only, SEO only,
   Posts only, Shop only). Each card shows what will change before you apply it.
 * New: Custom presets — save the current settings as a preset, or create one from
   JSON. Download any preset as JSON to reuse it on other sites. Locked permissions
   and locked plugins are always removed.
 * New: Plugin Access Full access — let the role use every screen of one plugin (
   Rank Math, Yoast, AIOSEO, LiteSpeed Cache and others).
 * New: Quick actions — purge the LiteSpeed cache from the toolbar without access
   to LiteSpeed settings.
 * New: WooCommerce tab — orders view-only or no delete/refund, hide stock and cost
   of goods. Works with HPOS and the legacy order screens, AJAX and REST.
 * New: Preview as role — see the admin as the role sees it, with one-click exit.
 * New: Access Map tab — every admin page with allowed/blocked and the reason.
 * New: Activity log — logins, logouts, blocked attempts, settings changes, previews
   and expiries.
 * New: Settings history — every save is recorded; restore any earlier version or
   reset to recommended settings.
 * New: Export/import settings as JSON with a change preview before applying.
 * New: After-login redirect (products, orders, posts, pages or a custom admin page).
 * New: Hide admin notices from other plugins (or only update nags) for the role.
 * New: Per-user access expiry date (Users  Edit).
 * New: WP-CLI commands — `wp limadro status|export|import|history|rollback|preset
   |reset|log|expire`.
 * New: Lockout recovery — `define( 'LIMADRO_DISABLE', true );` in wp-config.php
   switches off all restrictions while keeping the security locks.
 * New: Colorful redesign of all settings screens, with a per-admin theme color 
   picker.
 * Changed: ”View Plugins List” (activate_plugins) is now off by default for new
   installs and after Reset. Existing saved settings are not changed.
 * Fixed: with Block Orders on and HPOS enabled, the orders pages showed a blank
   error page (HTTP 500) instead of ”Access Denied”.
 * Fixed: ”Translation loading triggered too early” notice on requests by the role.
 * Fixed: fatal error on PHP 7.4 caused by the `mixed` return type.
 * Tested with WordPress 7.1, WooCommerce 11.2 (HPOS) and Elementor 4.3.

#### 2.3.0

 * Fixed: Rank Math REST API calls (/wp-json/rankmath/v1/updateSettings) returning
   403 — SEO plugin REST routes are now always whitelisted
 * Fixed: manage_options is temporarily elevated during any SEO plugin REST request
   so save/update operations work correctly
 * Improved: Capabilities tab now shows SEO plugin sections only when that plugin
   is actually installed — each setting as its own row, all defaulting to enabled
 * Improved: Rank Math redirections, 404 monitor, analytics, site analysis — all
   individually controllable per row
 * Improved: Yoast and AIOSEO caps similarly separated with all defaults on

#### 2.2.0

 * Fixed: Replaced inline <style> echo in access control with wp_add_inline_style()(
   WordPress.org requirement)
 * Fixed: Replaced inline <style> and <script> in Plugin Access Deny page with wp_add_inline_style()
   and wp_add_inline_script() (WordPress.org requirement)
 * Improved: Plugin Access Deny now uses explicit slug patterns for Rank Math, Yoast,
   AIOSEO, WooCommerce and other major plugins — all their admin pages reliably 
   appear in the deny list
 * Added: Author URI field in plugin header
 * Updated: Contributors field in readme.txt

#### 2.1.0

 * Fixed: SEO plugins (Rank Math, Rank Math Pro, Yoast SEO, Yoast Premium, AIOSEO,
   AIOSEO Pro) now fully unrestricted — all caps pass through freely
 * Added: SEO Plugins capability category with 15 caps across all supported plugins
 * Added: Auto-detection of active SEO plugins shown on General tab
 * Fixed: WordPress.Security.EscapeOutput errors (escaped $found with wp_kses, $
   bg with esc_attr)

#### 2.0.0

 * Added full capabilities registry with 15 categorized sections
 * Added per-capability checkbox grid in settings UI
 * Added Plugin Access Deny submenu for per-plugin admin page blocking
 * Added Grant All / Deny All per category, search/filter, Restore Defaults
 * Added toggle switches for quick access blocks
 * Added unsaved-changes warning in settings
 * Rebuilt settings page with tabbed UI
 * All v1 features preserved

#### 1.1.0

 * Added plugin view-only mode (can see installed plugins list, all actions blocked)
 * Added CSS hiding of plugin action links and bulk-action controls
 * Removed Plugins menu from sidebar (now kept visible as read-only)

#### 1.0.0

 * Initial release
 * Custom Admin Panel Manager role
 * WooCommerce Orders, Customers, Users, Reports blocking
 * 12-hour session timeout with configurable settings page
 * REST API blocking for orders, customers, users
 * Compatible with Rank Math, Yoast SEO, WooCommerce HPOS

## Metatiedot

 *  Version **2.9.3**
 *  Last updated **2 päivää sitten**
 *  Active installations **10+**
 *  WordPress version ** 6.0 or higher **
 *  Tested up to **7.1.3**
 *  PHP version ** 7.4 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/limited-admin-role/)
 * Tags
 * [access-control](https://fi.wordpress.org/plugins/tags/access-control/)[admin](https://fi.wordpress.org/plugins/tags/admin/)
   [role](https://fi.wordpress.org/plugins/tags/role/)[user role](https://fi.wordpress.org/plugins/tags/user-role/)
   [woocommerce](https://fi.wordpress.org/plugins/tags/woocommerce/)
 *  [Edistynyt näkymä](https://fi.wordpress.org/plugins/limited-admin-role/advanced/)

## Arvosanat

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/limited-admin-role/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/limited-admin-role/reviews/)

## Avustajat

 *   [ minhaz52 ](https://profiles.wordpress.org/minhaz52/)

## Tuki

Onko sinulla jotain sanottavaa? Tarvitsetko apua?

 [Tukifoorumi](https://wordpress.org/support/plugin/limited-admin-role/)