How to Limit Access to WordPress Pages by Specific User

I am working on a WordPress plugin that stores login information for websites and online services. I could use LastPass or 1Password for this, but:

  1. I don’t like the idea of shelling out extra money any time a member of my team needs access to a password.
  2. I like to control my own data.
  3. It is more fun to do it in WordPress.

I should note that I do use 1Password on my local machine to help me remember all of my logins. It is great for that.

Goal

My goal was to allow the admins the ability to grant specific users “view” privileges on a page-by-page basis

How I Did It

I considered a number of options when I got started:

I ended up going with Advanced Custom Fields’ “User” field. I would have rather gone with the Members plugin, but I was having problems getting it to respect my custom filters on the_content. Wishlist Member (and similar) are simply too bloated for my taste.

It took me a while to figure out how to grab the user data out of the ACF “User” field. That plugin is awesome, but sometimes documentation is lacking… Thankfully, support for the plugin is out of this world!

See my final code solution below:


function does_user_have_access($content) {
	
	// Grab the current user's info so that we can compare it to the "allowed" users from the ACF "User" field later.
	$current_user = wp_get_current_user();
	
	// Store the ACF "User" info
	$values = get_field('user_info');
	
	if($values) { 
		// Create an array of users that will be able to access the page from the ACF "User" field
		$users_that_can_access_this_post = array();
		foreach($values as $value) {
			$user_IDs_that_can_access_this_post[] = $value['ID'];
		} 
		// Check to see if the current user is in the "User" field's array
		if (in_array($current_user--->ID, $user_IDs_that_can_access_this_post, false) || current_user_can( 'manage_options' )) {
			// Display the post
			display_all_acf_fields();
		} else {
			// Hide the post content if the user is not in the ACF "User" array
			echo 'You do not have access to this post.  Please let Toby know if you do, indeed, need access.' . edit_post_link('Edit', '', ' ');
		}
	} else {
		// Display something if a post has no users set
		echo 'Please set the user restriction on this post.' . edit_post_link('Edit', '', ' ');
		die();	
	}
	
	return $content;
	
}

Pretty nifty, eh?

Got any thoughts or ideas on how I can improve the above code? I would love to hear them! Please post a comment below if you have an idea.

Thanks!

The Mighty Mo! Design Co.

RSS From Toby’s Blog

  • “Now THAT was a good meeting!”
    A single effective meeting can change the course of history for a company. Imagine if you could lead effective meetings EVERY DAY! You can, but it takes curiosity & practice. This article is a good place to start your journey to a more effective you.
  • Never Respond to RFPs & Custom Proposal Requests
    Y'all who work at normal 9-5 jobs don't need to deal with the B.S. that is an RFP process (or rather you get paid to deal with it). But us freelancers gotta deal with a whole big bag of schtuff when it comes to custom proposals. Here's my quick-and-dirty RFP filtering process that I use […]
  • What content should I put on my homepage?
    I see websites as one stop of many on the sales journey, useful to help get customers from Point A to Point B in the sales process (or maybe from Point D to Point E).  If you are wondering about what to put on your homepage, start with these basic sales-related questions: Who, specifically, will…

More posts from themightymo.com

How I created a Local SEO-Driven WordPress website in 1 hour

How I created a Local SEO-Driven WordPress website in 1 hour

By Toby Cryns | February 28, 2022

This morning, I got curious about the competitiveness of a specific keyword in the Google Map (a.k.a. “Local SEO”). The Google map is this strange beast that I am particularly-curious about, because almost 100% of my customers live within a 10-mile bike ride of my house…and I’d like to have more customers so… The keyword…

WP Multisite a love story

WordPress Multisite – A Love Story

By The Mighty Mo! Design Co. | February 25, 2022

Rob says WP Multisite should be put out to pasture – I 100% disagree.

Adding Blur to Quicktime Videos in Post-Production is Easy in Youtube’s Free Browser-based Editor!

By Toby Cryns | February 24, 2022

I recorded a screencast today of me sharing my live “how to” process for creating a new website. The video is about an hour long, and there were a few small things I wanted to blur on the screen (serial numbers for software). I was surprised that Youtube now has a “blur” effect available after…

RSS From Toby’s Blog

  • “Now THAT was a good meeting!”
    A single effective meeting can change the course of history for a company. Imagine if you could lead effective meetings EVERY DAY! You can, but it takes curiosity & practice. This article is a good place to start your journey to a more effective you.
  • Never Respond to RFPs & Custom Proposal Requests
    Y'all who work at normal 9-5 jobs don't need to deal with the B.S. that is an RFP process (or rather you get paid to deal with it). But us freelancers gotta deal with a whole big bag of schtuff when it comes to custom proposals. Here's my quick-and-dirty RFP filtering process that I use […]
  • What content should I put on my homepage?
    I see websites as one stop of many on the sales journey, useful to help get customers from Point A to Point B in the sales process (or maybe from Point D to Point E).  If you are wondering about what to put on your homepage, start with these basic sales-related questions: Who, specifically, will…