If what you want to do is to hide the menu items you can make use of remove_menu_page and remove_submenu_page by hooking into admin_menu. In order to hide certain links based on the user’s role (in your case, Editor): function custom_remove_menus(){ // Get current user’s data $current_user = wp_get_current_user(); $user_id = $current_user->ID; // Check user’s … Read more
You can set this in the wp-config.php, check the Editing wp-config.php page in the docs.
Here you go, this creates a Delete Post link that only appears to the user if they are both logged in and the author of the post. When the link is clicked, they get a js confirmation asking them if they’re sure, which once clicked will delete the post. And it does work with Custom … Read more
You can… Learn about file permission (on wordpress) Install WordPress Firewall plugin (version 2 for 3+ versions) (this dissalow access to any folder or file indirectly) Hide Your WordPress Version Try to update plugins & Wp install Login Lockdown Plugin (this stops any brute force attemts) Verify that your theme doesnt show “publish by $username” … Read more
Here is your answer: function remove_menus () { global $menu; if( (current_user_can(‘install_themes’)) ) { $restricted = array(); } // check if admin and hide nothing else { // for all other users if ($current_user->user_level < 10) $restricted = array(__(‘Dashboard’), __(‘Posts’), __(‘Media’), __(‘Links’), __(‘Pages’), __(‘Appearance’), __(‘Tools’), __(‘Users’), __(‘Settings’), __(‘Comments’), __(‘Plugins’)); // this removes a lot! Just … Read more
Depends on what you mean by “redirect”. If you want to 404 them, this will do the job: add_filter(‘wp_die_handler’,’custom_404_die_handler’); function custom_404_die_handler() { global $wp; $wp->handle_404(); load_template(get_404_template()); die(); } If you actually want to redirect them somewhere, then you could do something like this, but that’s not exactly a “404”, as such. add_filter(‘wp_die_handler’,’custom_404_die_handler’); function custom_404_die_handler() { … Read more
First of all you have to deny access to trash page in admin. To show trash, the ‘post_status’ argument for main query must be ‘trash’, so you can check that and redirect if current user is not an administrator: add_action( ‘pre_get_posts’, ‘deny_trash_access’ ); function deny_trash_access( $query ) { // nothing to do if not in … Read more
You can hook onto parse_request and trick WordPress into thinking it matched a page permalink if one exists with the same slug for a category term: /** * Override query for pages that match a category slug. * * @param WP $wp */ function wpse_177014_category_to_page ( $wp ) { if ( ! empty( $wp->query_vars[‘category_name’] ) … Read more
Clear your browser cache or use another browser to load the site, this may be a cache issue.
The point of hardening is to avoid the core files to be manipulated by external users (on shared hosting) and by the webserver (as it is the main source of exploits). Since the update runs via the webserver it is obvious that if you hardened your files against webserver initiated manipulation, the update will fail. … Read more