How to Restrict WordPress Content by User Role

Understanding WordPress Roles

WordPress includes five default user roles, each with different capabilities:

Role	Capabilities	Typical Use
Administrator	Full site access, plugin/theme management	Site owners, developers
Editor	Publish and manage all posts	Content managers
Author	Publish and manage own posts	Regular writers
Contributor	Write posts, cannot publish	Guest writers
Subscriber	Read only, manage own profile	Registered members

These roles control what users can do in the admin dashboard. But they can also control what content users can see on the frontend.

Custom Roles

You can create custom roles for specific access levels:

// Create a custom 'Premium Member' role
add_role('premium_member', 'Premium Member', array(
    'read' => true,
    'level_0' => true
));

// Create a 'VIP' role
add_role('vip', 'VIP Member', array(
    'read' => true,
    'level_0' => true
));

Plugins like "User Role Editor" let you create roles without code.

Content Restriction Basics

Content restriction means controlling access to specific posts or pages based on user attributes, typically their role.

The Logic

When a user requests a page:

1. Check if the content has access restrictions
2. Get the current user's role(s)
3. Compare against allowed roles
4. Show content or show access denied message

What to Restrict

You can restrict:

• Entire posts/pages The whole content is members-only
• Post archives Hide restricted posts from category listings
• Inline content Sections within a public post (use shortcodes)
• Media files Protect downloadable content

URL Protection

Important: Hiding a post from listings isn't enough. Users with the direct URL can still access it. True content restriction must:

• Check permissions on every page load
• Redirect unauthorized users
• Not expose content in page source

Implementing Role-Based Access

Role Based Content Pro adds a simple interface to each post:

1. Edit any post or page
   The Role Based Content meta box appears below the editor.
2. Select allowed roles
   Check which roles can view this content. Unselected roles are blocked.
3. Configure visitor access
   Optionally allow non-logged-in visitors to see the content.
4. Save
   Restrictions apply immediately.

Behind the Scenes

The plugin uses the template_redirect hook to check access before content loads:

add_action('template_redirect', function() {
    if (is_singular()) {
        $allowed_roles = get_post_meta(get_the_ID(), '_allowed_roles', true);

        if (!empty($allowed_roles)) {
            $user = wp_get_current_user();
            $user_roles = $user->roles;

            // Check if user has any allowed role
            $has_access = array_intersect($allowed_roles, $user_roles);

            if (empty($has_access) && !current_user_can('administrator')) {
                wp_redirect(home_url('/access-denied/'));
                exit;
            }
        }
    }
});

Posts are also filtered from archives using pre_get_posts:

add_action('pre_get_posts', function($query) {
    if (!is_admin() && $query->is_main_query()) {
        // Filter out posts the user can't access
        $meta_query = array(
            'relation' => 'OR',
            array(
                'key' => '_allowed_roles',
                'compare' => 'NOT EXISTS'
            ),
            array(
                'key' => '_allowed_roles',
                'value' => get_current_user_role(),
                'compare' => 'LIKE'
            )
        );
        $query->set('meta_query', $meta_query);
    }
});

Practical Use Cases

Free vs. Premium Content

The classic membership model:

• Create a "Premium Member" role
• Free content: Allow all roles + visitors
• Premium content: Allow only Premium Member + Administrator
• Use a payment gateway to assign the premium role on purchase

Online Courses

Tiered course access:

• Create roles: "Course A Student", "Course B Student", "All Access"
• Restrict course pages to appropriate roles
• All Access role sees everything
• Enrolled students see only their courses

Company Intranet

Internal communication:

• Roles: "Employee", "Manager", "Executive"
• General announcements: All employees
• HR documents: Managers only
• Board reports: Executives only

Client Portals

Agency client management:

• Create a role for each client company
• Restrict project pages to relevant clients
• Clients only see their own projects
• Staff sees everything

Security Considerations

Don't Trust the Frontend

Never rely on JavaScript to hide content. Users can disable JS or view page source. All restrictions must be enforced server-side, before content reaches the browser.

Direct URL Access

Test your restrictions by:

1. Copying a restricted post's URL
2. Opening an incognito/private window
3. Pasting the URL

If you see the content, restrictions aren't working properly.

RSS Feeds

Restricted content may appear in RSS feeds if not filtered. Verify your restriction plugin handles feeds.

Search Engines

Googlebot visits as a logged-out user. Restricted content shouldn't be indexed unless you want it discoverable (with access denied message).

Caching

Page caching can serve restricted content to unauthorized users if not configured properly. Either:

• Exclude restricted pages from caching
• Use a cache plugin that respects logged-in users
• Implement fragment caching for restricted sections

Teaser Content

Good UX shows non-members what they're missing. Options include:

• Excerpts: Show the first paragraph, blur or gate the rest
• Titles only: List restricted content titles without full access
• Upgrade prompts: Replace content with membership CTA

This is where Content Locker Pro complements role-based restrictions: gate content behind email signup or social share before requiring full membership.

Summary

WordPress roles provide the foundation for content restriction. Instead of expensive membership plugins, you can build tiered access using native roles and a restriction plugin. The key is proper server-side enforcement. Never trust frontend hiding.

For membership sites, course platforms, and client portals, role-based restrictions offer flexibility without complexity.