Roles that can do more than they should, trimmed back
See every role's capabilities and who has it, spot roles that can install plugins or manage users without needing to, and remove those capabilities.
- Difficulty
- Advanced
- Time
- about 20 min
Show me every role on my site with its capabilities and how many users have it, and point out roles other than Administrator that can [install or activate plugins, edit themes, manage users or change options]. Tell me which users have those roles. For [role name], remove [capabilities] once I approve with my password, and show me the capabilities before and after.
Already connected?
If SAR is already in your AI app, this is enough:
Find roles that can do more than they should and remove [capabilities] from [role].
What happens
- The AI app reads every role with its capabilities, how many users have it, which roles can manage the whole site, and the default role.
- It lists the users and their roles, so you see who is affected.
- Removing capabilities changes what everyone with that role may do, so it is approved in SAR with your password. Administrator-level capabilities are flagged for whoever approves.
- The Administrator role never loses anything, and the change can be undone.
Approvals involved
Worked out from the tools this recipe uses.
wordpress_list_roles_and_capabilitiesRoles and capabilitiesNonewordpress_list_usersList usersNonewordpress_change_role_capabilitiesChange what a role may doApproval and password
What you get
Each role able to do its job and no more, with a record of what changed.
Related recipes
- Security & backups · about 10 minWho can sign up on your site, and with which roleCheck whether anyone can register an account, which role new accounts get and who joined lately, and learn where to change it if it's wrong.
- Security & backups · about 10 minCheck your WordPress files for tamperingCompare WordPress's own files and your WordPress.org plugins with the official copies, and find out whether anything was changed or is missing.
- Security & backups · about 15 minAdministrators you don't recognise, found and taken down a levelList everyone who can manage your whole site, spot accounts you don't know, lower their role with your password, and send password resets where needed.
Try it on your own site
Install the plugin, add SAR to your AI app and paste the prompt. Free to start.