The easiest way is to use if ( current_user_can( 'capability' ) ) // do stuff. You’ll find more about capabilities in the codex. You can also inspect the data some user has attached with normal var_dump() and else. I also got a pretty old plugin for that. But I’m not sure if it still works with the current WP version. If it does, you’ll be presented with close to all user data and some hints & snippets on a new admin page.
Related Posts:
- Getting a List of Currently Available Roles on a WordPress Site?
- How to secure or disable the RSS feeds?
- How do I authenticate WP users from a chrome extension?
- Best Way to Enable Two Step Authentication
- Single sign-on: wp_authenticate_user vs wp_authenticate
- How does the “authentication unique keys and salts” feature work?
- Auth cookie value security risk?
- Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?
- Restrict Access in Admin Panel
- Auto log in hook is requiring a page refresh
- Is WordPress secure enough for a multi-user article directory?
- User generated content and security
- Uploading attachment (pdf) and prevent download for anonymous user
- How to make WP page accessile only to specific user roles
- Custom user roles are unable to login
- Why is SSH password authentication a security risk?
- Authentication versus Authorization
- SSL Error: unable to get local issuer certificate
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site? [closed]
- How to redirect all HTTP requests to HTTPS
- What is the difference between a cer, pvk, and pfx file?
- How to solve “Kernel panic – not syncing – Attempted to kill init” — without erasing any user data
- What’s the best approach for generating a new API key?
- Is it possible to decrypt SHA1
- Simplest two-way encryption using PHP
- Why does the URL http://a/%%30%30 crash Google Chrome?
- what is a auth_user_file.txt?
- When you use ‘badidea’ or ‘thisisunsafe’ to bypass a Chrome certificate/HSTS error, does it only apply for the current site?
- How does the SQL injection from the “Bobby Tables” XKCD comic work?
- Error `sec_error_revoked_certificate` when viewed in Firefox only
- How to view PHP on live site
- Convert .pfx to .cer
- how fix “this certificate cannot be verified up to a trusted certification authority”
- Can an attacker use inspect element harmfully?
- Where does Internet Explorer store saved passwords?
- How can bcrypt have built-in salts?
- Is moving wp-config outside the web root really beneficial?
- Hide the fact a site is using WordPress?
- Verifying that I have fully removed a WordPress hack?
- Infected Files – what to do [closed]
- WordPress 4.7.1 REST API still exposing users
- Can I Prevent Enumeration of Usernames?
- Allow member to have access to custom post type only. Permission to only edit their own posts
- Best way to eliminate xmlrpc.php?
- What’s the easiest way to stop WP from ever logging me out
- If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
- Should I escape wordpress functions like the_title, the_excerpt, the_content
- Why should I use the esc_url?
- Should I remove install.php and install-helper.php?
- Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
- How safe / sanitized is wp_insert_posts()?
- Why does WordPress need my private ssh key to update?
- When to use esc_html and when to use sanitize_text_field?
- From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
- Where to securely store API keys and passwords in WordPress?
- Are Nonces Useless?
- What is the difference between esc_html filter vs attribute_escape filter?
- Why escape if the_content isnt?
- Why does WordPress have more than one salt?
- Why are passwords exportable as plain text in WordPress?
- What is the ideal setup to address security concerns?
- Will there be security updates for 3.1 once 3.2 is released?
- What’s the difference between esc_* functions?
- wp_update_user not updating
- Full path disclosure on rss-functions.php
- What to use instead of wp_kses() in user output
- How to set up fail2ban with WordFence?
- Allowing users to edit only their page and nobody else’s
- How do I technically prove that WordPress is secure?
- Are the default salts secure?
- is_email() VS sanitize_email()
- WordPress it’s cleaning a custom query_var to avoid sql injections?
- Which KSES should be used and when?
- Can someone explain the use cases of esc_html?
- Is there a way to force ssl on certain pages
- How do WordPress Nonces Work?
- Troubleshooting a “You do not have sufficient permissions to access this page” error
- Restrict admin access to certain pages for certain users
- How can I hide a category from Contributors in the edit/add new post screen?
- Disallowing Users of a Custom Role from Deleting or Adding Administrators?
- Tips for finding SPAM links injected into the_content
- Subscribe to email for security fixes?
- Close a wordpress blog – keep site as it is but prevent hacks
- How to assign specific users the capability to edit specific pages / posts / custom post types
- Hide Admin Menu for Specific User ID who has administrator Role
- Is WordPress vulnerable to the httpoxy?
- What is the purpose of having a token in cookies?
- How to escape custom css?
- How to remove “Connection Information” requirement on localhost install of WP on MACOSX
- Understanding SVG vulnerabilities in WordPress related to a specific fix
- How is password strength calculated?
- Moving wp-config.php: Can this be done after site launch?
- How to get all capabilities of an existing user role
- Make A WordPress Page Accessible To Admins Only, Redirect Other User Roles
- Limit access to posts/pages by user roles
- Regular security checks – what steps should be included?
- What are the pros and cons of using a custom front-end to retrieve content from a WordPress back-end
- Is WordPress’ is_user_logged_in() secure?
- How can I easily verify a core or plugin update has not broken anything?