Wrong users seeing content they shouldn’t is a frustrating problem. Maybe paying members are sharing premium resources with non-members. Or perhaps sensitive company documents are accessible to someone outside the authorized team.
Worse yet, what if someone with the wrong permissions accidentally edits or deletes important content?
That’s where role-based access control comes in. This guide covers how to restrict content by user role in WordPress — from what the platform handles natively to setting up full-page or partial-section protection with Passster, without touching a single line of code.
Why Restrict Content by User Role
Role-based restriction matches access levels to the trust level of each visitor type — so customers, members, employees, and casual browsers each see only what they need.
Here are the most common reasons to restrict content by role:
- Protect premium content — If you offer paid memberships, online courses, or exclusive resources, role-based restrictions keep those assets behind the right paywall. Only users who hold the correct role — “Subscriber,” “Premium Member,” or any custom role you define — access them automatically.
- Protect sensitive information — Internal documents, client data, and company reports shouldn’t be publicly available. Restricting these by role limits access to the people who actually need them.
- Prevent unauthorized changes — On multi-author sites, role-based permissions help prevent accidental (or intentional) edits that could break pages, delete content, or introduce security issues.
Proper role management also matters for security beyond content visibility. In 2025, privilege escalation vulnerabilities affected over 1.1 million WordPress sites — attackers exploiting flaws in plugins like WP Statistics (600K+ installs) and Post SMTP (400K+ installs) to gain access beyond their assigned role (smackcoders.com, 2025). Keeping each role’s access tightly scoped limits the blast radius of a successful exploit.
Restricting Access in Default WordPress
WordPress ships five built-in user roles as of 2026 (WordPress.org) — each controlling a different level of editing and publishing access, not front-end content visibility.
User role: A WordPress designation assigned to each registered user that determines which editing and publishing actions they can perform on the site.
WordPress automatically assigns you the Administrator role as site owner, which gives you full access to everything on the site. The five built-in roles are:
- Subscriber — Can read published posts only.
- Contributor — Can draft posts but cannot publish them.
- Author — Can write and publish their own posts.
- Editor — Can edit their own content and content drafted by other users.
- Administrator — Full permissions: install plugins and themes, manage users, publish content, assign roles, and everything else.
Here’s the key limitation: these five roles control editing and publishing capabilities, not front-end content visibility. Default WordPress can mark posts as private (visible only to logged-in users with edit access) or password-protected site-wide, but it can’t selectively show or hide content based on which role a logged-in visitor holds.
To restrict what specific roles can view on the front end — not just edit — you need a plugin. Passster handles exactly this.
What is Passster
Passster is a WordPress plugin that restricts access to content based on user role, without requiring a single line of code. You can protect an entire page, a specific section within a page, or your entire site. As of June 2026, Passster has 10,000+ active installs and a 4.2/5 star rating from 59 reviews on WordPress.org.
What distinguishes Passster from full membership suites is its layered protection model. When you restrict a page by user role, users with that role get in automatically — no password prompt. Everyone else still hits the password gate, so you can serve both a trusted internal team and a broader public audience from the same page — without building out a complete membership system.
How to Use Passster to Restrict Content by User Role
The following two steps show how to protect any page or post — assigning a role that bypasses the password form while everyone else must enter a password.
Step 1: Install and Activate Passster
In your WordPress dashboard, go to Plugins > Add New. Search for “Passster,” then click Install Now, followed by Activate.
Step 2: Restrict a Page by User Role
Passster works on both pages and posts. The steps below use a page — the same process applies to posts.
Go to Pages > All Pages and click Edit on the page you want to restrict.
On the right side of the block editor, find the Activate Protection toggle and turn it on.
This expands the Passster panel. First, choose your Protection Mode:
- Password — A single password grants access to the page.
- Passwords — A list of comma-separated passwords; any one of them grants access.
- Password List — Choose from a pre-created list of passwords.
- reCAPTCHA — No password required; this blocks bots while letting human visitors through.
Select your preferred mode and enter the password in the field below it (skip this step if you chose reCAPTCHA).
Next, scroll down to Misc Settings. There, you’ll see a Redirect field. Enter the URL you want non-permitted visitors sent to — a membership upgrade page or a custom “access required” screen, for example.
Then expand User Restriction and open the User Role dropdown. Select the role you want to grant automatic, password-free access.
The dropdown lists all roles active on your site, including custom roles added by other plugins. Custom roles — like “Premium Member” or “Student” — appear here once created, making Passster compatible with any role management setup. The User Role Editor plugin, with over 700,000 active installs as of 2026, is a popular choice for defining custom roles.
Click Update (or Publish for a new page) to save. Users with the selected role now land on the page directly — everyone else sees the password prompt.
How to Restrict a Specific Section with Passster
Passster’s Protected Areas feature lets you restrict a specific section within a page — a download link, a client-only block, or a preview excerpt — while leaving the rest of the page publicly accessible. Passster introduced its shortcode-based Protected Areas in version 3.1 (WordPress.org changelog); every theme and page builder that renders standard WordPress post content supports the shortcode format.
Protected Area: A Passster content container — created in Passster > Protected Areas — that wraps content you want to gate. Once published, Passster generates a shortcode you paste into any page or post.
Step 1: Create a Protected Area
In your WordPress dashboard, go to Passster > Protected Areas.
Click Add New Protected Area. A standard WordPress editor opens — add the content you want to restrict just as you would for any post or page. Click Publish when done. Passster automatically generates a shortcode for this area.
Step 2: Configure and Copy the Shortcode
Go to the backend of the Protected Area you just published. In the Protected Area panel on the right, set your Protection Mode and activate User Restriction Type — the same options as the full-page setup.
Then expand Overwrite Defaults to customize the text that appears in the password prompt: the headline, description, input placeholder, and button label. This lets you show visitors branded messaging instead of the default Passster copy.
Click Save. A Copy Shortcode button appears at the bottom of the panel — copy it.
Step 3: Add the Protected Area to Your Page
Go to Pages > All Pages and click Edit on the page where you want the restricted section to appear.
Paste the shortcode into the page content at the position you want the restricted block to appear.
Click Save. The protected section is now live. Visitors without the required role see the password prompt in place of the restricted content.
What Blocked Visitors See
Passster shows a password form by default when a visitor lacks the required role — but you can redirect them to a custom URL or replace the default form text with your own messaging instead. All three blocked-visitor responses listed below have been available since version 3.4.1 added URL redirect support (WordPress.org changelog).
- Password prompt — By default, restricted visitors see the Passster password form. Entering the correct password grants access; failing to enter it keeps them locked out.
- Redirect — If you filled in the Redirect URL under Misc Settings, Passster sends them to that URL instead of showing the password form. This works well for pointing users to a sign-up or upgrade page.
- Custom form text — The Overwrite Defaults option lets you change the headline, description, and button label on the password prompt, so the form matches your site’s messaging rather than showing generic defaults.
Users who hold the correct role assigned to their WordPress account skip all this — they land on the page or section directly, with no form shown.
Conclusion
Restricting content by user role keeps premium assets protected and sensitive information away from the wrong audiences. You get fine-grained control without needing a full membership suite.
With Passster, full-page and partial-section restrictions each take a few clicks. The layered model — role-based automatic access combined with a password fallback for everyone else — means you’re not choosing between open and locked. A single post or page can serve both audiences at once.
Get Passster now and start restricting content by role on your WordPress site.
Frequently Asked Questions
No. WordPress’s five built-in user roles — Subscriber, Contributor, Author, Editor, and Administrator — control what users can edit or publish, not what they can view on the front end. Default WordPress can make posts private (visible only to users with edit access) or globally password-protected, but it cannot selectively show or hide content based on which role a logged-in visitor holds. Role-based viewing restrictions require a plugin.
A user role is a named group (such as “Editor” or “Subscriber”) assigned to a WordPress user. A capability is a specific permission — for example, edit_posts or publish_pages — that determines what actions that group can take. Roles are bundles of capabilities. WordPress checks capabilities when a user tries to perform an action; the role is simply the label that carries those capabilities.
In Passster, set User Restriction > User Role to any role that all your logged-in users share — typically “Subscriber” if you assign that role on registration. All authenticated visitors with that role or higher will bypass the password form. Users who are not logged in, or whose role doesn’t match, will see the password prompt or get redirected, depending on your Misc Settings configuration.
WordPress doesn’t provide a built-in UI for creating custom roles. The most common approach is a plugin. User Role Editor (700,000+ active installs as of 2026) lets you create roles such as “Premium Member” or “Student” and assign any combination of capabilities to them. Once you create a custom role, it appears automatically in Passster’s User Role dropdown, making the two plugins fully compatible.
It depends on your configuration. By default, restricted visitors see the Passster password form in place of the protected content. If you’ve entered a URL in the Redirect field under Misc Settings, Passster sends those visitors to that URL instead — useful for membership upgrade or login pages. You can also customize the form text under Overwrite Defaults to match your site’s branding.
Yes. Passster’s Protected Areas feature lets you add protected sections to a single page, each with its own User Role restriction. You could, for example, show a “Premium Member” section, a “Staff” section, and public content all within the same page. Each Protected Area generates its own shortcode, and you paste them at different positions within the page.
Yes. WooCommerce adds its own user roles — including “Customer” and “Shop Manager” — to your WordPress site. These roles appear in Passster’s User Role dropdown alongside the five default WordPress roles. You can restrict any page or Protected Area to WooCommerce customers specifically, which is useful for order-confirmation content, wholesale pricing pages, or customer-only resources.