How to protect your WordPress work on client websites

by Blair Jersyer | WordPress Tutorials

WordPress is wonderfully un powerful CMS comes with many versatile features, which give it the ability to work without special configuration, for a wide range of users. However, if you are a theme and WordPress plugins, sometimes these features can be problematic.

The same features and options that allow WordPress themes to fit many different use cases can sometimes also be used to fine-tune a custom theme carefully for a specific use case.

In this tutorial, I provide you with a collection of snippets that you can use on most of your WordPress projects.

What they have in common is that they prevent inquisitive customers from ruining all the work you've spent so long creating. All of the following can be used on a website, but these tips are particularly applicable for professionals who create themes and WordPress plugins customized for customers.

But before, if you have never installed WordPress discover How to Install a WordPress Blog in 7 Steps et How to search, install and activate a WordPress theme on your blog 

Then back to why we are here.

Disable WordPress theme and plugin editor

There is no good reason why everyone should be able to edit plugins and themes right from the WordPress dashboard.

It is a mistake that some beginners make because they do not realize how easy it is to break a website by skipping a semicolon. It is also a vulnerability that hackers can easily exploit. Fortunately, it is possible to easily deactivate this editor.

Just add the following snippet to your wp-config.php file.

define ( 'DISALLOW_FILE_EDIT', true);

In addition to the WordPress theme editor, this will also disable the theme editor. WordPress Plugin.How to protect wordpress work from client websites

Limit the visual and the text editor

By default, the WordPress WYSIWYG editor brings far too many formatting options for a well-designed custom theme. Letting the customer replace text colors or font sizes is a quick way to make a beautiful website look ugly.

Also read our 8 WordPress plugins to integrate a billing system

If blog text is still supposed to be left aligned, why give the possibility of aligning it to the right?

What you need to understand is that you need to exempt your client from anything that might interfere with the design of your blog. In most situations, I recommend that you turn off the visual editor entirely.

deactivation of-the editor-visual de wordpress

function emersonthis_disable_visual_editor(){
    # add logic here if you want to permit it selectively
    return false;
}
add_filter('user_can_richedit' , 'emersonthis_disable_visual_editor', 50);

Disable the Customizer theme

If you are working on a child theme, the parent theme may offer customization options that are not suitable for the child theme. Personalization options can be used on your child theme, which can potentially affect the design of the child theme.

See also How to duplicate a WordPress database with phpMyAdmin

Either way, with the Customizer API, it's easy to get rid of certain sections with a few lines of code.

# Remove customizer options.
function emersonthis_remove_customizer_options( $wp_customize ) {
    // $wp_customize->remove_section( 'static_front_page' );
    // $wp_customize->remove_section( 'title_tagline' );
    $wp_customize->remove_section( 'colors' );
    $wp_customize->remove_section( 'header_image' );
    $wp_customize->remove_section( 'background_image' );
    // $wp_customize->remove_section( 'nav' );
    // $wp_customize->remove_section( 'themes' );
    // $wp_customize->remove_section( 'featured_content' );
    // $wp_customize->remove_panel( 'widgets' );
}
add_action( 'customize_register',
            'emersonthis_remove_customizer_options',
            30);

Each line in the above snippet corresponds to an individual theme customization option that you can turn off.

Hide unused items from the dashboard menu

Not every website has the same type of content. Some websites have no blogs, for example. If we apply the same logic to the WordPress dashboard as we apply to any other user interface, it is confusing and unnecessary to post links to unused functionality.

See also our article on How to display the date of an article update

For a website that does not use a blog, leaving the “Articles” link visible can cause a lot of confusion:

function emersonthis_custom_menu_page_removing() {
  // remove_menu_page( 'index.php' );                  //Tableau de bord
  // remove_menu_page( 'jetpack' );                    //Jetpack* 
  remove_menu_page( 'edit.php' );                   //Articles
  remove_menu_page( 'upload.php' );                 //Médias
  // remove_menu_page( 'edit.php?post_type=page' );    //Pages
  remove_menu_page( 'edit-comments.php' );          //Commentaires
  // remove_menu_page( 'themes.php' );                 //Apparence
  // remove_menu_page( 'plugins.php' );                //Plugins
  // remove_menu_page( 'users.php' );                  //Utilisateurs
  // remove_menu_page( 'tools.php' );                  //Outils
  // remove_menu_page( 'options-general.php' );        //Reglages
}
add_action( 'admin_menu', 'emersonthis_custom_menu_page_removing' );

Each line corresponds to a specific menu in the dashboard. File names do not always match the name that appears in the dashboard menu. You can use commented lines to disable even more links.

Add a record on the Content Editor (Articles / Pages)

By default, the visual editor (TinyMCE) will create a new paragraph, when the user taps “Enter”. If you just want to add a quick line break, you have to press this button combination " Shift+Return ».

See also How to receive plugin recommendations on WordPress by viewing this article

It's clever and powerful but not intuitive for many users. The ideal would be to display information that your customers can see during article editing.

# Adds instruction text after the post title input
function emersonthis_edit_form_after_title() {
    $tip = '<strong>TIP:</strong> Pour ajouter un retour a la ligne simple, utilisez : SHIFT+ENTRER. Par défaut, ENTRER crée un noauveau paragraphe.';
    echo '<p style="margin-bottom:0;">'.$tip.'</p>';
}
add_action(
    'edit_form_after_title',
    'emersonthis_edit_form_after_title'
);

Do not assign the admin role to anyone

The WordPress admin role is very powerful and with great power comes great responsibility. Some clients are experienced users and manage a website themselves. However, many of them are not.

The latter should therefore not rummage in sensitive areas. Instead, you can assign them an editor role. You can later assign the Administrator role when the customer in question has sufficient bases with WordPress.

Management-of-directors-on-wordpress

 

Discover also some premium WordPress plugins  

You can use other WordPress plugins to give a modern appearance and to optimize the handling of your blog or website.

We offer you here some premium WordPress plugins that will help you do that.

1. Ultimate Membership Pro

Ultimate Membership Pro is a WordPress Plugin very popular premium, which sets up an exclusive multi-level access system on your website. This system is configured according to the different types of plans of your users (free or paid).Ultimate membership pro wordpress membership wordpress plugin

Its main features are: nunlimited subscription levels (free / paid), content protection, multiple levels of content restriction, support for ppayment slogans: PayPal, Authorize.net, Stripe, 2CheckOut, BrainTree, Payza, bank transfer, afree / paid trial period, the support of Visual Composer, etc ...

Download | Demo | Web hosting   

2. WProtect

WProtect is a WordPress Plugin premium which performs version analysis of all plugins and WordPress themes installed on your website. It is an ideal tool that will help you forget about all the individual tests carried out on your plugins and themes with the aim of avoiding certain vulnerabilities.Wprotect wordpress plugins protect site against malware virus attacks

Its features are: a clean and modern interface, easy to use, protection against brute force attacks, banning of IP addresses, protection of wp-admin, wp-login and other directories, disabling of editing files, etc ...

Download | Demo | Web hosting

3. Grid FX

With four unique skins, Grid FX is a very versatile premium WordPress portfolio plugin. It lets you place images, videos, audio, blog posts, and WooCommerce products in stylish grids, Pinterest-style galleries, and image carousels.

Grid fx plugin wordpress portfolio

Personalization is king with this plugin, with its over 80 different styling options. You can choose from a range of skins, lightbox backgrounds, title animations, colors, and buttons. You can also define the number of items that will appear in the portfolio, the size of each item and the number of columns.

See also 6 WordPress plugins for video games on your website

To improve navigation, visitors will be able to filter the grids to find what they are looking for. Adding a portfolio to your website with this WordPress plugin is as simple as pasting a shortcode into a post, page or widget area.

Download | Demo | Web hosting

Recommended Resources

Find out about other recommended resources to help you build and manage your website.

Conclusion

Here ! That's it for this tutorial. I hope it will allow you to better secure your customers' dashboards. If you have suggestions or remarks, leave them in our section Comments.

However, you will also be able to consult our resources, if you need more elements to carry out your projects of creation of Internet sites, by consulting our guide on the WordPress blog creation.

Feel free to share this article with your friends on your favorite social networks. 

... 

Submit comment

Your email address will not be published. Required fields are marked with *

This site uses Akismet to reduce unwanted. Learn more about how your comments data is used.