Admin Accounts for Demo Purposes – (Pro Plugin Only)

Message: This Help Article contains code snippets that may need to be added to your demo website theme’s functions.php file to manage the capabilities of demo admin accounts. We’re excited to inform you that we are developing and testing a complete UI solution that will work with the Demo Reset Pro plugin. With it, you’ll have the ability to block or allow admin menu items and manage user capabilities for demo admin accounts (and other user roles) through an easy-to-use interface.

Concept of Demo Admin Accounts & Overview

One of the main advantages of the Demo Reset Pro plugin is its ability to let users experience even admin-only features and functionalities through demo admin accounts. At the same time, the security and integrity of the demo website must not be compromised. There are certain settings and information, such as API keys, licenses, server details, and site settings, that should be kept hidden. Therefore, certain limitations are enforced on demo admin accounts by default, restricting access to critical capabilities and functionalities. These limitations vary depending on the status of the demo website (THAWED state or FROZEN state). Any content added or edited via demo user accounts is nothing to worry about. With automatic reset executions, the entire demo website will be restored to the chosen reset point.

Only Demo Reset Admins have full access and control over these restrictions while the site is in THAWED state. By default, the admin who activates the Demo Reset Pro plugin is designated as the Demo Reset Admin.

What demo admin account holders can do in the FROZEN state (Demo Mode) by default:

  • Add, edit, and delete posts, pages, categories, tags, and custom post types.
  • Manage comments.
  • Upload and manage media files (If allowed in Demo Reset Pro settings).
  • Switch between themes.
  • Customize themes using the theme editor.
  • Customize themes, posts, and pages using the block editor.
  • Manage menus and widgets.
  • Access and manage any feature or functionality added by third-party plugins or themes that you have not restricted.

What demo admin account holders can’t do in the FROZEN state (Demo Mode) by default:

  • Install, activate, delete, update, resume, or edit plugins.
  • Install, delete, update, resume, or edit themes.
  • Edit theme or plugin files directly.
  • Create, edit, delete, list, remove, or promote users.
  • Import or export content, personal data, or erase personal data.
  • Install languages or update WordPress core.
  • Access or modify general site settings, writing, reading, discussion, media, or permalink options.
  • Check site health or perform related diagnostics.
  • Access Demo Reset Pro admin menu items and pages.
  • Add, edit, delete, or publish Help Articles (demo_reset_harticles), including managing categories.
  • Access the /wp/v2/settings REST API endpoint, regardless of the demo website’s state. (This restriction applies to all users at all times.)

All non-admin user accounts assigned with default WordPress user roles are not affected by these limitations, as the capabilities of those roles (Editor, Author, Contributor, and Subscriber) pose no security threat. However, you may still want to restrict access to certain features for these non-admin accounts. If so, please refer to the help article ‘Non-Admin Accounts for Demo Purposes‘.

Depending on your business needs, you may want to restrict or allow access to specific features and functionalities on your demo website for demo admin users. For example, you might need to limit access to certain plugin or theme settings pages. To learn how, please refer to the following topics.

Note: The WordPress ecosystem includes thousands of different plugins and themes. As a result, the features and functionalities you may need to block or restrict for various demo user account types can vary greatly. It is therefore not practically possible for us to provide guidance for every individual case. We strongly recommend that you adopt your own methods to restrict any specific features unique to your setup. This could include using a third-party restriction plugin, WordPress hooks, or custom PHP or CSS solutions. If you have developed effective methods, please do not hesitate to share them with us. (Email/Contact Form: Support) We will gladly publish this knowledge on our public forums to benefit the community. Thank you.

Restricting admin menu items

The Demo Reset Pro plugin lets you restrict access to selected WordPress admin menu items and their pages for demo admin user accounts. This allows you to safely create and share demo admin accounts without compromising your website’s security.

Demo Reset Pro plugin has two mechanisms to restrict admin menu items:

1. Blocking main admin menu items (top-level menu items) using demo_reset_blocked_main_menus filter hook. (Returns an array of main menu slugs.)

2. Blocking sub admin menu items (sub menu items under top-level menu items) using demo_reset_blocked_sub_menus filter hook. (Returns an array of sub menu slugs.)

Example codes

/**
 * Block specific main (parent) admin menu items
 */
add_filter('demo_reset_blocked_main_menus', function($menus) {
	$menus[] = 'parent_menu_item_1_slug';	// Example: blocks parent menu item 1
	$menus[] = 'parent_menu_item_2_slug';	// Example: blocks parent menu item 2
	return $menus;
});

/**
 * Block specific sub (child) admin menu items
 */
add_filter('demo_reset_blocked_sub_menus', function($submenus) {
	$submenus[] = 'sub_menu_item_1_slug';	// Example: blocks sub menu item 1
	$submenus[] = 'sub_menu_item_2_slug';	// Example: blocks sub menu item 2
	return $submenus;
});

Instructions

1. Copy and paste the code into your theme’s functions.php file or a custom plugin.

2. Add the actual parent and/or sub menu item slugs in place of the placeholders. You can add multiple slugs on separate lines to block all the desired menu items.

Important Notes

1. These hooks only block admin menu items for standard administrator accounts intended for demo purposes. Demo Reset Admin accounts are not affected. Lower-privileged roles (e.g., Editor, Author, Subscriber) are also unaffected and will continue to see only the admin menu items allowed by their default WordPress role capabilities.

2. By default, the following parent and sub admin menu slugs are blocked for standard administrator accounts created for demo purposes to ensure site security.

Main Admin Menu Items Blocked by Default:

'plugins.php'
'edit.php?post_type=demo_reset_harticle'
'users.php'
'profile.php'

Sub Admin Menu Items Blocked by Default:

'update-core.php'
'options-general.php'
'options-writing.php'
'options-reading.php'
'options-discussion.php'
'options-media.php'
'options-permalink.php'
'import.php'
'export.php'
'site-health.php'
'export-personal-data.php'
'erase-personal-data.php'
'theme-editor.php'
'plugin-editor.php'
'plugins.php'
'plugin-install.php'
'edit.php?post_type=demo_reset_harticle'
'post-new.php?post_type=demo_reset_harticle'
'edit-tags.php?taxonomy=demo_reset_harticle_cat&post_type=demo_reset_harticle'
'users.php'
'user-new.php'
'profile.php'

3. The following admin menu items cannot be blocked using the hooks above, as they are essential for core site functionality. Therefore, the Dashboard menu link and the default Posts-related menu items cannot be blocked.

'index.php'
'edit.php'
'post-new.php'

4. You can use the same hooks mentioned above to unblock the admin menu items that are blocked by default by unsetting any of the above menu slugs. However, we strongly advise doing this with extreme caution, because admins can do anything that you can do on your demo website. We are deliberately limiting some capabilities so that random users can experience the demo almost like an admin, without compromising the security of the demo website. With these two filters, you can fine-tune which items to allow on the admin menu and which to block for demo admin accounts, according to your requirements.

/**
 * Blocked main admin menu slugs to unblock.
 */
add_filter('demo_reset_blocked_main_menus', function($menus) {
	$menus = array_diff($menus, [
		'parent_menu_item_1_slug',
		'parent_menu_item_2_slug',
	]);
	return $menus;
});

/**
 * Blocked sub (child) admin menu slugs to unblock.
 */
add_filter('demo_reset_blocked_sub_menus', function($submenus) {
	$submenus = array_diff($submenus, [
		'sub_menu_item_1_slug',
		'sub_menu_item_2_slug',
	]);
	return $submenus;
});

How to find the slug of an admin menu item?

1. First, log in to your website’s Admin Dashboard as the Demo Reset Admin.

2. Copy and paste the code below into your theme’s functions.php file via sftp. (Temporarily)

/**
 * Displays all parent and child admin menu items with their slugs.
 * Useful for identifying menu slugs to block or unblock for demo/admin purposes.
 * Stops execution after output to prevent further page loading.
 */
add_filter('parent_file', function($parent_file) {
	global $menu, $submenu;

	echo '<pre>';
	foreach ($menu as $parent) {
		$parent_label = $parent[0];
		$parent_slug  = $parent[2];
		echo "Parent: {$parent_label} -> {$parent_slug}\n";
		
		if (isset($submenu[$parent_slug])) {
			foreach ($submenu[$parent_slug] as $sub) {
				$sub_label = $sub[0];
				$sub_slug  = $sub[2];
				echo "	Sub: {$sub_label} -> {$sub_slug}\n";
			}
		}
	}
	echo '</pre>';

	exit(); // Stop execution after output.
	return $parent_file;
});

3. Then reload the Admin Dashboard page. A white screen will appear showing a list of main and sub admin menu slugs next to their corresponding labels. Copy this list, as you may need it to block certain menu items for general admins.

An example list:

	Parent: Dashboard -> index.php
		Sub: Home -> index.php
		Sub: Updates 0 -> update-core.php
	Parent:  -> separator1
	Parent: Posts -> edit.php
		Sub: All Posts -> edit.php
		Sub: Add Post -> post-new.php
		Sub: Categories -> edit-tags.php?taxonomy=category
		Sub: Tags -> edit-tags.php?taxonomy=post_tag
	Parent: Media -> upload.php
		Sub: Library -> upload.php
		Sub: Add Media File -> media-new.php
	Parent: Pages -> edit.php?post_type=page
		Sub: All Pages -> edit.php?post_type=page
		Sub: Add Page -> post-new.php?post_type=page

Here are some of the admin menu slugs from the list above: index.php, update-core.php, edit.php and edit-tags.php?taxonomy=category. Just ignore the separator slugs, such as separator1.

4. Finally, and most importantly, remove the added code from your theme’s functions.php file and reload the Admin Dashboard page.

Restricting User Role Capabilities

Apart from the default admin menu restrictions mentioned above, certain user role capabilities will also be restricted at runtime based on the following factors:

  • Current Website Status (THAWED or FROZEN)
  • Role Type (Demo Reset Admin, regular WordPress Admin, or other WP Role Types)
  • User Upload Capability Settings

Slugs of Role Capabilities that are managed according to the three factors stated above:

  • install_plugins
  • activate_plugins
  • delete_plugins
  • update_plugins
  • resume_plugins
  • edit_plugins
  • install_themes
  • delete_themes
  • update_themes
  • resume_themes
  • edit_themes
  • switch_themes
  • edit_theme_options
  • edit_files
  • upload_files
  • unfiltered_upload
  • edit_users
  • delete_users
  • create_users
  • list_users
  • remove_users
  • promote_users
  • import
  • install_languages
  • update_core
  • edit_demo_reset_harticles
  • edit_others_demo_reset_harticles
  • delete_demo_reset_harticles
  • publish_demo_reset_harticles
  • read_private_demo_reset_harticles
  • delete_private_demo_reset_harticles
  • delete_published_demo_reset_harticles
  • delete_others_demo_reset_harticles
  • edit_private_demo_reset_harticles
  • edit_published_demo_reset_harticles

The way Role Capabilities are managed in the Demo Reset Pro plugin is complex, but the purpose is simple. The purpose is: to limit or adjust WordPress’s default admin capabilities to create safe demo admin accounts, allowing random users to experience the demo website without risking its security or integrity.

If you want to activate or deactivate a role capability for demo admin accounts while in demo mode (FROZEN state), use the demo_reset_allowed_caps filter hook. This hook provides all available capabilities at runtime as an array. We strongly advise using it with caution, as demo admins can perform any actions you allow on your demo website.

Example code

/**
 * Example: Activate or deactivate certain capabilities for demo admin accounts
 * 1 means activate, and 0 means deactivate.
 */
add_filter('demo_reset_allowed_caps', function($allcaps) {
	// --- Activate capabilities ---
	if (isset($allcaps['create_users']) && !$allcaps['create_users']) $allcaps['create_users'] = 1;
	if (isset($allcaps['list_users']) && !$allcaps['list_users']) $allcaps['list_users'] = 1;

	// --- Deactivate capabilities ---
	if (isset($allcaps['publish_pages']) && $allcaps['publish_pages']) $allcaps['publish_pages'] = 0;
	if (isset($allcaps['delete_pages']) && $allcaps['delete_pages']) $allcaps['delete_pages'] = 0;

	return $allcaps;
});

How to find the slug of a user role capability?

1. First, log in to your website’s Admin Dashboard as the Demo Reset Admin.

2. Copy and paste the code below into your theme’s functions.php file via sftp. (Temporarily)

/*
 * Show all capabilities for the current logged-in user
 * Displays each capability and whether it is true or false
 * Useful for debugging user permissions
 */
add_action('init', function () {
	if (!is_user_logged_in()) {
		return;
	}

	global $wp_roles;
	$user = wp_get_current_user();

	echo '<pre>';
	echo "User: {$user->user_login}\n";
	echo "User ID: {$user->ID}\n";
	echo "Roles: " . implode(', ', $user->roles) . "\n\n";
	echo "Capabilities (full list):\n";

	$all_capabilities = [];
	foreach ($wp_roles->roles as $role) {
		$all_capabilities = array_merge($all_capabilities, array_keys($role['capabilities']));
	}
	$all_capabilities = array_unique($all_capabilities);
	sort($all_capabilities);

	foreach ($all_capabilities as $cap) {
		echo $cap . ' => ' . (user_can($user, $cap) ? 'true' : 'false') . "\n";
	}

	echo '</pre>';
	exit; // Stop execution after output.
});

3. Then reload the Admin Dashboard page. A white screen will appear showing a long list of user role capabilities. Copy this list, as you may need it later to enable or disable capabilities for certain user roles.

An example list:

	User: User-Name
	User ID: 1
	Roles: administrator

	Capabilities (full list):
	activate_plugins => true
	create_users => true
	delete_pages => true
	delete_plugins => true
	delete_posts => true
	delete_published_pages => true
	delete_published_posts => true
	delete_themes => true
	delete_users => true
	edit_dashboard => true
	edit_files => false

If a capability is marked as true, it means it is enabled for the user role of the account you are logged in with; if marked as false, it is disabled.

4. Finally, and most importantly, remove the added code from your theme’s functions.php file and reload the Admin Dashboard page.

Extra Note: To see which capabilities are granted to a user role at runtime, use the code below (as explained above) after logging in with an account of the relevant user role. This will provide a comprehensive list of user role capabilities for the logged-in account’s role at runtime. Also, remember to remove the code from the functions.php file after copying the list of user role capabilities.

/*
 * Display all capabilities of the currently logged-in user
 * Shows the capability slug and whether it is granted (true/false)
 * Useful for debugging user permissions at runtime
 */
add_action('init', function () {
	if (!is_user_logged_in()) {
		return;
	}

	$user = wp_get_current_user();

	echo '<pre>';
	echo "User: {$user->user_login}\n";
	echo "User ID: {$user->ID}\n";
	echo "Roles: " . implode(', ', $user->roles) . "\n\n";
	echo "Capabilities (runtime):\n";

	foreach ($user->allcaps as $capability => $granted) {
		echo $capability . ' => ' . ($granted ? 'true' : 'false') . "\n";
	}

	echo '</pre>';
	exit;
});

Latest Posts

Categories

Tags