Access

Who can open Stack Guard

Decides which roles and which people can open Stack Guard, and whether they can change settings or only look.

What it does

Every role gets one of three levels. Full Access can see and change everything. View Only can open Stack Guard and read it, with every control disabled. Hidden does not see Stack Guard at all.

User Overrides give one person a different level from their role, for example View Only for a client who is an administrator.

Why it matters

Security settings can lock people out of a site. Letting clients and editors see the status without being able to change it keeps them informed and keeps the site safe.

Set it up

Go to the Access tab, section Access control.
In Role Access, choose a level for each role.
In User Overrides, set a level for any person who should differ from their role, or leave Use role default.
Click Save Access Settings. This button saves this panel on its own; the main Save Changes bar does not.

Good to know

Administrators follow these levels too, so you can make another administrator View Only or Hidden. Until someone changes it, the Administrator role has Full Access and every administrator keeps it. On a network, Super Admins always have full access.

Two guards stop a lockout. You cannot lower your own access: your row is locked, and another full-access administrator has to make that change. And saving is refused if nobody who can manage the site would keep full access.

If you are ever shut out anyway, add define( 'SMG_SAFE_MODE', true ); to wp-config.php: every administrator gets full access until you remove the line. The Recovery switches topic explains how.

These levels control Stack Guard only. A Hidden administrator can still manage plugins and users in WordPress itself.

The Access, License, System, Appearance and Settings tabs are only shown to people with full access. The Docs tab is open to everyone who can open Stack Guard.

View Only people see a "View only" chip at the top of each tab.

Which plan includes it

Role Access is in every plan. User Overrides are shown with a Pro plan.

How it works, for developers

Order of precedence: network Super Admin (multisite only), then SMG_SAFE_MODE for anyone with manage_options, then the user override, then the role. A role set to Hidden is skipped and the user's next role is checked.
Lockout guards in SMG_Admin::validate_access_change() run on the server before saving: at least one account with manage_options must resolve to full access, and the person saving must keep full access. Both ignore SMG_SAFE_MODE.
Levels are stored in smg_access_roles (default: administrator full) and smg_access_users. The menu is registered with the read capability; Stack Guard checks the level itself.
Saving uses the smg_save_access_settings AJAX action with its own nonce and needs manage_options plus full access. Saving the main settings form also needs full access (option_page_capability_smg_settings).
Actions that change the site also check WordPress capabilities on the server, so View Only is enforced there, not only by disabled buttons.

Quick answers about who can open stack guard

What does Who can open Stack Guard do in Stack Guard?

Every role gets one of three levels. Full Access can see and change everything. View Only can open Stack Guard and read it, with every control disabled. Hidden does not see Stack Guard at all. User Overrides give one person a different level from their role, for example View Only for a client who is an administrator.

Why use who can open stack guard on a WordPress site?