Wordpress User only to access CiviCRM

Question

I would like allow a WordPress user only to have access to CiviCRM. I realise that it has to go through the WordPress interface, but we want the CiviCRM users to only be able to administer CiviCRM, and not the WordPress site. Some will need full rights to CiviCRM.

I have found some info regarding this, and this questions helped me a lot: How to display CiviCRM menu for non-admin role using WordPress?

Anyone can register is not selected in WP admin, and I have changed that a subscriber can access basically everything in in WordPress Access Control.

I am just concerned about security, and was wondering if perhaps there is a better way of doing this?

Thank you

Answer 1

1. I find the plugin User Role Editor Pro to be very helpful with this. https://www.role-editor.com/ This makes it easier to setup the access control on the WP side.

2. Use CiviCRM > administer > Users & Permissions > Permissions (Access Control) > WordPress Access Control to control what parts of Civi different roles have access to.

3. I would NOT give Subscribers full access to Civi or WP. This is the role your basic donor is likely assigned. Yes this would create a serious security and liability issue if you give donors full access to Civi. Create/use another role besides Subscriber for anyone that needs some level of access beyond their donor dashboard.

4. Helpful tip. Create a user that is not your admin. Assign this user whatever role you are wanting setup with limited access. Login with one browser or computer as admin and in another browser or computer as the new user. Start editing Civi or WP Access Control settings as the admin, then refresh your other user tab and see what has changed.