Access Control

The default, locked state — the resource stays available to administrators only until you choose another option.

Open a resource to all users — including logged-out visitors — with no further checks.

Restrict a resource to one or more WordPress roles — Administrator, Editor, Author, Contributor, Subscriber or your own custom roles.

Grant access to specific people by searching for them by username or email and adding them to the list.

Restrict a resource by capability — the fine-grained permissions behind roles, including ones added by other plugins.

The exact order the system uses to allow or deny a user — and where administrators and logged-out visitors fit in.

How the wpb-access-control library works under the hood — custom providers, the REST API, the drop-in React panel, and the one PHP call that gates a resource.