=== PublishPress Permissions: Control User Access for Posts, Pages, Categories, Tags ===

Contributors: publishpress, kevinB, stevejburge, andergmartins
Tags: permissions, access, restrict, privacy, capabilities
Requires at least: 5.5
Tested up to: 7.0
Requires PHP: 7.2.5
Stable tag: 4.8.2
License: GPLv3
License URI: https://www.gnu.org/licenses/gpl-3.0.html

The permissions plugin for posts, pages, categories, tags and more. You can control permissions for roles, individual users, and even custom groups.

== Description ==

[PublishPress Permissions](https://publishpress.com/permissions) allows you to enable or deny access to posts, pages, categories, tags and more. You can apply these permissions for user roles, individual users, and even custom groups.

With PublishPress Permissions, you can control who can view and edit your WordPress content. You can choose who can access images and files in your site's Media Library. For example, you can deny all direct access to files for logged out users.

The Pro version of PublishPress Permissions has many advanced features such as teaser previews of restricted content, custom WordPress statuses, and automatically creating personal posts for users.

## PublishPress Permissions Pro ##

> <strong>Upgrade to Permissions Pro</strong><br />
> This plugin is the free version of PublishPress Permissions. The Pro version of Permissions has all the features you need to control permissions for your WordPress users. With Permissions Pro you can manage access to posts, pages, media, taxonomies and custom post types. <a href="https://publishpress.com/permisssions"  title="Permissions Pro">Click here to control access to your WordPress site with Permissions Pro!</a>

## Key Features in PublishPress Permissions ## 

1. **Viewing permissions**: Every post, page, and taxonomy term has a box where you can choose who can read this content.
2. **Editing permissions**: Every post, page, and taxonomy term has a box where you can choose who can edit this content.
3. **Media Library permissions**: You decide who gets to edit and view image files and documents in your Media Library.
4. **Hide other users' posts**: You can prevent users from seeing posts by other users in the WordPress admin area.
5. **Create user groups**: Build groups of users who can be given their own custom permissions. Two default groups include Logged in and Logged out users.
6. **Show teasers for restricted content (Pro version)**: Have teaser text that is publicly available, followed by private content that is restricted to only your site's users.
7. **Personal posts for each user (Pro version)**: You can automatically create individual posts for your users so they have their own private content to edit or read.
8. **Publishing statuses (Pro version)**: Go beyond "Draft", "Pending Review" and "Published" with your own custom, and far more advanced, workflow.
9. **Visibility statuses (Pro version)**: Create visibility options for your content. One example is a "Premium" status that makes content visible only for paying members. 
10. **Editorial Circles and Visibility Circles (Pro version)**: Restrict users to editing or viewing posts that were authored by other users in the same group.
11. **Integration with other plugins (Pro version)**: The Permissions plugin integrates with other popular plugins including bbPress, BuddyPress, WPML, and Relevanssi.

## Feature 1. Viewing Permissions for WordPress Content ##

PublishPress Permissions enables you to customize viewing access for WordPress content. Open any post and you'll see a box with the label, "Permissions: Read this Post". This box allows you to choose "Enabled" or "Blocked" for any user role, individual user, or user group. You can also set permissions for all users who are guests, and those who are logged in.

[Click here to see how to control viewing permissions](https://publishpress.com/knowledge-base/viewing-permissions/).

## Feature 2. Editing Permissions for WordPress Content ## 

PublishPress Permissions allows you to customize the editing permissions for all your content. Open a Post, Page, Category, Tag, or custom post type and you can decide who is allowed to edit that content. You can even prevent users from editing child pages of a specific parent page. Open any content item and you'll see a box with a label like this: "Permissions: Edit this Post". This box allows you to choose "Enabled" or "Blocked" for any user role, individual user, or user group.

[Click here to see how to control editing permissions](https://publishpress.com/knowledge-base/editing-permissions/).

## Feature 3. Access Permissions for the Media Library ## 

PublishPress Permissions gives you detailed control over access to media on your WordPress site. You decide who gets to edit and view files in your Media Library. For example, you can set up WordPress so that users only have access to files that they uploaded. Or you can add an exception so users can edit other people's media files if they are attached to a post they can edit.

The Pro version of Permissions allows you to deny any public access to files on your site. Nobody will be able to see your Media Library files unless they have access to a post that includes that file.

[Click here to see how to manage access to your media files](https://publishpress.com/knowledge-base/permissions-media-files/).

## Feature 4. Hide Other Users' Posts in the WordPress Admin ##

By default, WordPress users in the admin area can see all the Posts on the site, regardless of whether they are the author. This is not a problem for many sites. After all, most posts on most sites are publicly available – there's no need to hide them. However, in some situations, site owners don't want authors to see the posts that other users are working on. PublishPress Permissions can hide posts in the WordPress admin area, unless you have access to edit that post.

[Click here to see how to hide other users' posts](https://publishpress.com/blog/hide-peoples-posts-wordpress-admin/).

## Feature 5. Create Your Own User Groups ##

PublishPress Permissions allows you to create your own user groups. Imagine you want to give some users access to a single Post. Instead of creating a new user role and applying all the permissions, you can easily add those users to a group. This is a simple and more flexible alternative to user roles. You can also prevent users from reading or editing content if they are not in a specific group. By default, this plugin gives you sample groups that include all Logged in and Logged out users so you can easily set public and private content.

[Click here to see how to use custom user groups](https://publishpress.com/knowledge-base/groups/).

## Feature 6. Show Teasers for Restricted Content (Pro Version) ##

PublishPress Permissions Pro allows you to display a teaser for unreadable content. This is perfect for making small snippets of your content available to the public. You can have teaser text that is publicly available, followed by private content that is only visible for your site's users. If you choose to display a login form, the redirect will go to the originally requested content.
[Click here to see how to display content teasers](https://publishpress.com/knowledge-base/how-to-create-a-teaser-for-private-content-in-wordpress/).

## Feature 7. Automatically Create Posts for Users (Pro Version) ##

This Pro feature allows you to automatically create content for your users. For example, you can sync your staff members to Pages. This would allow your staff to each have their own page to edit and update. You can use this feature to automatically create posts, WooCommerce products, or any other post type that is defined on your site.
[Click here to see how to automatically create posts for users](https://publishpress.com/knowledge-base/how-to-create-a-personal-page-for-each-wordpress-user/).

## Feature 8. Create Your Own Publishing Statuses (Pro Version) ##

WordPress provides some status options including "Draft", "Pending Review" and "Published". Permissions Pro enables you to design a far more advanced workflow. Each status you create can have its own unique capability requirements.
[Click here to see how to build your own workflow statuses](https://publishpress.com/knowledge-base/multi-step-moderation/).

## Feature 9. Create Your Own Visibility Statuses (Pro Version) ##

With PublishPress Permissions Pro, you can create visibility options for your content. One example is a "Premium" status that makes content visible only for paying members. Another example is a "Staff" status, for the people who run your site.

[Click here to see how to build your own visibility statuses](https://publishpress.com/knowledge-base/custom-post-visibility/).

## Feature 10. Editorial Circles and Visibility Circles (Pro Version) ##

Visibility Circles are a feature in PublishPress Permissions Pro that restrict users to viewing posts that were authored by other users in the same group. PublishPress Permissions also has Editorial Circles. If you are in an Editorial Circle for Pages, you will only be able to edit pages authored by other circle members.

The most common way to use this feature is to restrict users in the Editor role so that they can only edit posts written by other Editors. This is because Editors are the only default WordPress role that can edit content (except for Administrators).

[Click here to see how to build your own Editorial Circles](https://publishpress.com/knowledge-base/circles/) and [click here to see how to build your own Visibility Circles](https://publishpress.com/knowledge-base/visibility-circles/).

## Feature 11. Support for Other Plugins ## 

The Permissions plugin integrates with other popular plugins:

* [BuddyPress content permissions](https://publishpress.com/knowledge-base/buddypress-content-permissions/): With the PublishPress Permissions Pro plugin, you can give users access to create WordPress content, based on their BuddyPress group membership.
* [Relevanssi search permissions](https://publishpress.com/knowledge-base/relevanssi-and-presspermit-pro/): Relevanssi is an excellent plugin that replaces the standard WordPress search with a better search engine. PublishPress Permissions Pro has integration with Relevanssi. If you use PublishPress Permissions Pro, your Relevanssi search results will have the correct visibility. 
* [WPML language permissions](https://publishpress.com/knowledge-base/wpml-and-presspermit-pro/): PublishPress Permissions Pro does have support for the WPML plugin. By default, PublishPress Permissions Pro will automatically mirror your post / category permissions to the translated content.
* [bbPress language permissions](https://publishpress.com/knowledge-base/bbpress-permissions/): bbPress is the most popular forum software for WordPress. With PublishPress Permissions Pro, you can manage access and to important bbPress features.


## Join PublishPress and get the Pro plugins ##

The Pro versions of the PublishPress plugins are well worth your investment. The Pro versions have extra features and faster support. [Click here to join PublishPress](https://publishpress.com/pricing/).

Join PublishPress and you'll get access to these Pro plugins:

* [PublishPress Authors Pro](https://publishpress.com/authors) allows you to add multiple authors and guest authors to WordPress posts.
* [PublishPress Blocks Pro](https://publishpress.com/blocks) has everything you need to build professional websites with the WordPress block editor.
* [PublishPress Capabilities Pro](https://publishpress.com/capabilities) is the plugin to manage your WordPress user roles, permissions, and capabilities.
* [PublishPress Checklists Pro](https://publishpress.com/checklists) enables you to define tasks that must be completed before content is published.
* [PublishPress Future Pro](https://publishpress.com/future)  is the plugin for scheduling changes to your posts.
* [PublishPress Permissions Pro](https://publishpress.com/permissions) is the plugin for advanced WordPress permissions.
* [PublishPress Planner Pro](https://publishpress.com/publishpress) is the plugin for managing and scheduling WordPress content.
* [PublishPress Revisions Pro](https://publishpress.com/revisions) allows you to update your published pages with teamwork and precision.
* [PublishPress Series Pro](https://publishpress.com/series) enables you to group content together into a series.
* [PublishPress Shortlinks Pro](https://publishpress.com/shortlinks) allows you to create custom URLs for your posts and external links.
* [PublishPress Statuses Pro](https://publishpress.com/statuses) enables you to create additional publishing steps for your posts.

Together, these plugins are a suite of powerful publishing tools for WordPress. If you need to create a professional workflow in WordPress, with moderation, revisions, permissions and more, then you should try PublishPress.

## Bug Reports ## 

Bug reports for PublishPress Permissions are welcomed in our [repository on GitHub](https://github.com/publishpress/publishpress-permissions). Please note that GitHub is not a support forum, and that issues that aren't properly qualified as bugs will be closed.

## Follow the PublishPress team ## 

Follow PublishPress on [Facebook](https://www.facebook.com/publishpress), [Twitter](https://www.twitter.com/publishpresscom) and [YouTube](https://www.youtube.com/publishpress)

== Frequently Asked Questions ==

= Can I restrict access to custom post types? =

A large number of WordPress have sites with custom post types. These custom post types often hold sensitive information. In this guide, we'll show you how to control who can read, edit and publish content in your custom post types. By default, nearly all custom post types will inherit the same permissions as Posts. So a user in the “Editor” will role will automatically be able to write and edit in your custom post type.

* Install the PublishPress Permissions Pro plugin.
* Go to Permissions > Settings > Core.
* Under “Filtered Post Types”, check the box for your post type. 
* Click “Save Changes”.
* You will now be able to edit any post in your custom post type and see editing permissions.

[Click here to see how to restrict access to custom post types](https://publishpress.com/knowledge-base/regulate-post-type-access/).

= Can I restrict viewing access to specific categories? =

Yes, PublishPress Permissions makes it possible to control who can view and read content with a specific category attached. In this situation, “read” means “view”. So we're going to control who can see this content. By default, Categories are only available on WordPress Posts. However, you can add Categories to other post types and so you will be able to use the tutorial for those post types too.

[Click here to see how to restrict access to categories](https://publishpress.com/knowledge-base/category-exceptions/).

= Can I force users to create posts in a category or parent page? =

This guide will show you how to require users to create content in a specific category or parent page. The solution in this guide is a flexible approach for sites with a substantial number of users in different roles. Depending on the needs of your site, the PublishPress plugins also offer other approaches such as this one based on user roles. In this tutorial, we'll use examples from a university. Our sample site has categories for different university departments. Our aim will be to restrict some users to posting in some categories, or underneath some parent pages. By default, Categories are only available on WordPress Posts. However, you can add Categories to other post types and so you will be able to use the tutorial for those post types too.

[Click here to see how to force users to post in a category](https://publishpress.com/knowledge-base/limit-posting-category-parent/).

= Can I block access to WordPress category and tag archives?

Yes, the PublishPress Permissions plugin allows you to block access to WordPress category and tag archive pages. For example, you can block public access to the “Blog” category on your site. We will use this as an example, but the same approach can work for all taxonomies.

* Install the PublishPress Permissions plugin.
* Go to “Posts”, then “Categories”.
* Click “Edit” for your category.
* Scroll down to the “Permissions: Read Posts in this Category” area.
* Set “Anonymous” to “Blocked”.

This will impact anyone who is anonymous / not logged in to your site and tries to visit a post with the “Blog” category, or “Blog” category archive page. People without access to this category will only see a “Page Not Found” message.

[Click here to see how to deny access to blog archives](https://publishpress.com/knowledge-base/block-access-to-wordpress-categories-and-tags/).

= Can I control access to Media Library files?

The PublishPress Permissions plugin allows you to control permissions for media files on your site.

* Go to Permissions > Settings.
* Click the “Core” tab and make sure the “Media” box is checked.
* Click the “Editing” tab.

Scroll down to the “Media Library” area. Here you're going to see 4 options you can use to control access to files inside the Media Library:

* List other users' uploads if attached to a readable post: If this boxed is checked, users can view other people's media files if they are attached a post they can read.
* List other users' uploads if attached to an editable post: If this boxed is checked, users can view other people's media files if they are attached a post they can edit.
* Edit other user' uploads if attached to an editable post: If this boxed is checked, users can edit other people's media files if they are attached a post they can edit.
* Other users' unattached uploads listed by default: If this boxed is checked, users can view other people's media files.

[Click here to see how to control access to the Media Library](https://publishpress.com/knowledge-base/permissions-media-files/).

= Can I block people and search engines from accessing Media Library file URLs? =

By default, all the files and images you upload to WordPress are publicly available. This is great news for most sites. The goal of most sites is to create popular content that is viewed by as many readers as possible. But this public access is a problem if you run a membership site and DO NOT want everyone reading your content. Yes, you can restrict the privacy of your posts, but people can still view your files if they know the URL. The PublishPress Permissions Pro plugin makes it possible to block direct access to your media files. Even if someone knows the URL, they won't be able to access your files unless you give them the correct access.

[Click here to see how to block people and search engines from accessing file URLs](https://publishpress.com/knowledge-base/block-search-engines-wordpress-file-urls/).

= Can I restrict WordPress users from creating higher-level users? =

By default, WordPress only allows Administrators to create users. If you want to allow other roles to create users then you need to give them at least the promote_users, list_users, edit_users and create_users permissions. However, if you give them those permissions, they can create and edit users in any role. So you could have Editors creating and editing Administrator accounts. That could be a security problem. Fortunately, PublishPress Permissions has a feature called “Limit User Edit by Level”. This prevents anyone from editing a user with a higher level or assigning a role higher than their own.

[Click here to see how to restrict user creation](https://publishpress.com/knowledge-base/how-to-block-wordpress-users-from-creating-higher-level-users/).

= How does PublishPress Permissions compare to PublishPress Capabilities, User Role Editor, Members and other role editor plugins? =

PublishPress Permissions can be used in addition to a basic role editor / user management plugin.  Those plugins are designed to modify existing WordPress permissions. That's a valuable task, and in many cases will be all the role customization you need. We do recommend [PublishPress Capabilities](https://wordpress.org/plugins/capability-manager-enhanced) which is a WordPress role editor designed for integration with PublishPress Permissions.

PublishPress Permissions can supercharge your permissions engine and goes much further than the basic role editor plugins. PublishPress Permissions is particularly useful when you want to customize access to a specific post, category or term. PublishPress Permissions adds content-specific editing permissions, custom post status permissions, file access restriction, and other features which are not possible in default WordPress. 

= What should I do if I use the Role Scoper plugin? =

Moving forward, we do not plan any major development of the Role Scoper code base. If you encounter issues with Role Scoper and need to migrate to a different solution, [PublishPress Permissions](https://publishpress.com/permissions) provides access to an import script which can automate the majority of your Role Scoper migration. PublishPress Permissions can import the most Role Scoper groups, roles, restrictions and options.  Some manual follow up may be required for some configurations.

= Is PublishPress Permissions a complete membership solution? =

No, but it can potentially be used in conjunction with an e-commerce or membership plugin. If you have a way to sell users into a WordPress role or BuddyPress group, PublishPress Permissions can grant access based on that membership.

= Where does PublishPress Permissions store its settings? =

PublishPress Permissions creates and uses the following tables: pp_groups, pp_group_members, ppc_roles, ppc_exceptions, ppc_exception_items. PublishPress Permissions options stored to the WordPress options table have an option name prefixed with "presspermit_". Due to the potential damage incurred by accidental deletion, no automatic removal is currently available. You can use a SQL editing tool such as phpMyAdmin to drop the tables and delete options with option_name LIKE presspermit_%.

= Can I share a link to install PublishPress Permissions? =

Yes, we use the phrase "publishpress-ppcore-install" to share install links. You will see that text included in the links from other PublishPress plugins.


= Where do I report security bugs found in this plugin? =

Please report security bugs found in the source code of the PublishPress Permissions plugin through the [Patchstack Vulnerability Disclosure  Program](https://patchstack.com/database/vdp/a6e3eb6f-ddf2-47d2-aee1-43acf358e5c2). The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.


== Screenshots ==

1. Custom viewing permissions: Every post, page, and taxonomy term has a box where you can choose who can read this content.
2. Custom editing permissions: Every post, page, and taxonomy term has a box where you can choose who can edit this content.
3. Category permissions: Every category has a box where you can choose who can edit, read, or assign this category.
4. Create custom groups: Build groups of users who can be given their own custom permissions. Two default groups include Logged in and Logged out users.
5. Manage media library access: You decide who gets to edit and view image files and documents in your Media Library.
6. Show content teasers: Have teaser text that is publicly available, followed by private content that is restricted to only your site's users.
7. Synchronize content to users: You can automatically create individual posts for your users so they have their own private content to edit or read.
8. Create your own Workflow Statuses: Go beyond "Draft", "Pending Review" and "Published" with your own custom, and far more advanced, workflow.
9. Create your own Privacy Statuses: Create visibility options for your content. One example is a "Premium" status that makes content visible only for paying members. 

== Changelog ==

The full changelog can be found on [GitHub](https://github.com/publishpress/publishpress-permissions/blob/master/CHANGELOG.md).
