Hello Brajesh
Please can you review theis code below if its safe and efficient to use might be helpful to others to secure admin accounts
function bp_redirect_admin_profile_to_404() { // Get the ID of the user whose profile is being viewed $displayed_user_id = bp_displayed_user_id(); // Check if the displayed user is an administrator if ( user_can( $displayed_user_id, 'administrator' ) ) { // Get the ID of the currently logged-in user $current_user_id = get_current_user_id(); // Check if the currently logged-in user is an administrator if ( $current_user_id && user_can( $current_user_id, 'administrator' ) ) { // Allow logged-in admins to view the profile return; } // Redirect non-admin users to the default WordPress 404 template global $wp_query; $wp_query->set_404(); status_header( 404 ); nocache_headers(); include( get_404_template() ); exit(); } } add_action( 'bp_template_redirect', 'bp_redirect_admin_profile_to_404' );
Hello Tosin,
Please try the following code:
add_action( 'bp_template_redirect', function () { if ( ! bp_is_user() || bp_is_my_profile() ) { return; } $displayed_user = get_user_by( 'id', bp_displayed_user_id() ); // this should never happen. if ( ! $displayed_user ) { return; } if ( ! in_array( 'administrator', $displayed_user->roles, ) ) { return; } // if we are on admin profile and user is not logged or the logged user is not admin do 404. if ( ! is_user_logged_in() || ! in_array( 'administrator', wp_get_current_user()->roles ) ) { //add_filter( 'bp_use_theme_compat_with_current_theme', '__return_false' ); bp_do_404(); } }, 1000 );
Please un-comment the line before bp_do_404 if your theme is not block theme and then give it a try.
Regards
RaviThanks for the updated code
I am using the profile privacy plugin and while using your updated code I am receiving the 404 error correctly but the url is in this format https://site.com/members/mike/visibility-protected/.
I dont think it’s cool to show the (visibility-protected) slug for admins since it reveals that the admin account is available but just hidden
The topic ‘ [Resolved] Secure or hide buddypress admin users using 404 error’ is closed to new replies.