Open dashboard doors
- —Every non-admin account can reach /wp-admin
- —Former contractors remain an access risk
- —Blocked users receive inconsistent feedback
← UserFlow overview
Restrict WordPress dashboard access without role changes
Set a clear boundary around wp-admin without redesigning WordPress roles. This guide shows how to keep the dashboard available to administrators and explicitly trusted users.
WordPress wp-admin access controlblock subscriber dashboard accessWordPress dashboard whitelist
Keep the backend limited to trusted people.
WordPress accounts do not always need dashboard access. UserFlow adds a clear boundary without forcing a role redesign.
Controlled access
- —Only trusted usernames can reach the dashboard
- —Session expiry can remove idle access automatically
- —A custom redirect gives blocked users a clear next step
Choose the protection level that fits.
UserFlow keeps the default secure and gives site owners a small set of focused controls for exceptions.
Whitelist trusted usernames
Allow specific non-admin users to access the dashboard without changing their role.
- —Useful for named editors, developers, and support staff
Expire idle sessions
Set a session timeout from 1 to 24 hours and apply it to all users or only non-admins.
- —Reduce the risk of unattended sessions
Hide the admin toolbar
Keep the WordPress backend out of the frontend view for unauthorized users.
- —Make the access boundary less visible
Redirect blocked users
Send blocked visitors to a branded page, login screen, or help document instead of a generic error.
- —Turn a denial into a useful instruction
Lock down wp-admin in four steps.
The secure default works immediately, while the settings screen handles trusted exceptions and messaging.
Install UserFlow
Install UserFlow from the WordPress plugin directory and activate it.
Confirm the boundary
Non-admin users are blocked from /wp-admin immediately after activation.
Add exceptions
Open Settings → UserFlow and whitelist the usernames that need dashboard access.
Set the redirect
Choose a custom redirect URL and configure session timeouts, then save.
Common questions.
Does UserFlow require changing WordPress roles?
No. You can whitelist trusted usernames while leaving their existing WordPress roles unchanged.
Can administrators still access the dashboard?
Yes. UserFlow is designed to protect non-admin dashboard access while administrators retain access.
Can blocked users be sent to a custom page?
Yes. Configure a custom redirect URL for a branded landing page, login screen, or help document.
Put this guide into practice with UserFlow.
Review the plugin features, requirements, and other implementation guides, or install it directly from WordPress.org.