=== Limited Admin Role By HEMDOX Digital ===
Contributors: minhaz52
Tags: role, user role, woocommerce, access control, admin
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 2.9.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A safe "Admin Panel Manager" role for staff, clients and freelancers: one-click presets, per-plugin access, WooCommerce limits and session timeout.

== Description ==

**Limited Admin Role** adds a custom WordPress role called **Admin Panel Manager**. Give it to a shop manager, a content writer, an SEO agency or a client, and choose exactly what they can see and do — without ever handing over full administrator rights.

Users, plugins, themes and code stay locked no matter what you configure, so the role can never take over the site.

= One-click presets =

Set up the whole role in one click, then fine-tune it:

* **Whole job:** Store Manager, Content + SEO, Accountant (read-only), Client Owner.
* **One area only:** ⚡ LiteSpeed Cache only, 🔍 SEO only, 📝 Posts only, 🛍️ Shop only.
* **Your own presets:** save the current settings as a preset, or create one from JSON. Download any preset and reuse it on your other sites.

Every preset shows exactly what will change before you apply it, and every change is saved in History so it can be undone.

= Key features =

* 🔐 **Capability grid** — turn every WordPress, WooCommerce and SEO-plugin permission on or off, grouped into clear categories.
* 🚫 **Menu & URL blocks** — hide and block Orders, Customers, Reports, Coupons, Download permissions, Marketing, Users, Tools, Appearance, Settings and more (menu, direct URL and REST API).
* 🧩 **Plugin Access** — give the role full access to one plugin (for example Rank Math, Yoast, AIOSEO or LiteSpeed Cache), or hide single plugin pages.
* ⚡ **Quick actions** — let the role purge the LiteSpeed cache from the toolbar without opening LiteSpeed settings.
* 🛒 **WooCommerce controls** — orders blocked, view-only, "no delete/refund" or full; allow or block customers, sales reports, coupons, download permissions, marketing and status; hide stock and cost of goods. Works with HPOS and legacy order screens.
* 🧱 **Preset builder** — tick what a person may use and save it as your own one-click preset.
* 👁️ **Preview as role** — see the admin exactly as the role sees it, then exit with one click.
* 🗺️ **Access Map** — every admin page with allowed/blocked and the reason why.
* 📋 **Activity log** — logins, logouts, blocked attempts and settings changes.
* 🕐 **Session timeout** — forces logout after a set number of hours, even with "Remember Me".
* 📅 **Access expiry** — set an end date per user; access stops automatically.
* ↩️ **History, export and import** — restore any earlier version, move settings between sites as JSON.
* 🎨 **Colorful, modern settings screens** with a theme color picker.
* 💻 **WP-CLI** — `wp limadro status|export|import|history|rollback|preset|reset|log|expire`.
* 🆘 **Lockout recovery** — `define( 'LIMADRO_DISABLE', true );` in wp-config.php switches restrictions off.

= Always locked for security =

Whatever you configure, the role can never: create, edit, delete or promote users; change roles; post unfiltered HTML; install, update, delete or edit plugins or themes; switch themes; or edit files. The matching REST API routes are blocked too.

= About the developer =

Limited Admin Role is built and maintained by [HEMDOX Digital](https://hemdox.com/limited-admin-role/). Visit the [plugin page](https://hemdox.com/limited-admin-role/) for guides and updates. If the plugin saves you time, a [5-star review](https://wordpress.org/support/plugin/limited-admin-role/reviews/#new-post) helps a lot.

= Compatibility =

Tested with WooCommerce 11.2 (HPOS and legacy orders), Elementor 4.3, Rank Math, Yoast SEO, All in One SEO and LiteSpeed Cache.

== Installation ==

1. Install from **Plugins → Add New** (search "Limited Admin Role") or upload the `limited-admin-role` folder to `/wp-content/plugins/`.
2. Activate the plugin. The **Admin Panel Manager** role is created automatically.
3. Go to **Limited Admin Role → Settings → Presets** and pick a starting point.
4. Assign the role to a user via **Users → Add New** or **Users → Edit → Role**.
5. Click **Preview as Admin Panel Manager** to check what the user will see.

== Frequently Asked Questions ==

= Why should I update to 2.9.2? =

2.9.2 is a security release. Older versions let a user with the Admin Panel Manager role use the REST API to gain more rights than you gave them. 2.9.2 closes this and permanently locks users, roles, plugins, themes and code for the role. Every site using the plugin should update now. The update also adds presets, the WooCommerce tab, preview, history and many other features — your existing settings are kept.

= Will updating change my settings? =

No. Your saved capabilities, blocks and plugin access are kept. After updating, open **Menu & URL Blocks** once and check the blocks are as you want them: a bug in older versions could switch them off when another tab was saved.

= How do I assign the role to a user? =

Go to **Users → Add New** (or edit an existing user) and set the Role to **Admin Panel Manager**.

= What is the fastest way to set it up? =

Open the **Presets** tab and click **Use this preset** on the card that fits the job. Then review the other tabs and use **Preview as Admin Panel Manager** to check the result.

= What is the difference between the presets? =

"Whole job" presets (Store Manager, Content + SEO, Accountant, Client Owner) adjust your current settings for a common job. "One area only" presets (LiteSpeed Cache only, SEO only, Posts only, Shop only) first hide everything, then open just that one area.

= How do I create my own preset? =

On the **Presets** tab, use **Build a custom preset** (tick the areas and plugins the person may use), **Save current settings as a preset**, or **Create a preset from JSON** (upload a file or paste the JSON). The tab shows the JSON format with an example you can copy. Downloaded presets can be imported on any site running this plugin.

= Can a JSON preset give the role dangerous rights? =

No. Every preset is checked again each time it is applied. Locked permissions (users, roles, plugins, themes, unfiltered HTML, code editing) and locked plugins are always removed.

= Can I give the role full access to one plugin, like Rank Math or LiteSpeed Cache? =

Yes. Go to **Plugin Access** and turn on **Full access** for that plugin. The role can then use all of its screens, while everything else stays restricted. Plugins that manage users, files or code cannot be given full access.

= Can the role clear the LiteSpeed cache without opening LiteSpeed settings? =

Yes. On **Plugin Access**, enable the **Purge cache (toolbar menu)** quick action for LiteSpeed Cache.

= Can the user install or activate plugins? =

No. Installing, activating, deactivating, updating and deleting plugins is always blocked. You can choose whether the role may view the plugins list (Capabilities → activate_plugins).

= Does it work with WooCommerce HPOS? =

Yes. Orders, Customers and Reports are blocked on both the HPOS screens (`page=wc-orders`) and the legacy screens, as well as AJAX and the WooCommerce REST API. The WooCommerce tab can make orders view-only or prevent deletes and refunds.

= Does it work with Rank Math, Yoast SEO and All in One SEO? =

Yes. The SEO meta boxes appear on posts and products for the role. To let the role open the SEO plugin's own screens, give that plugin Full access on the Plugin Access page (or use the SEO only / Content + SEO preset).

= Why does the role see Elementor? =

Elementor shows its menu to anyone who can edit posts. To hide it, open **Plugin Access** and check the Elementor pages you want to block.

= How does the session timeout work? =

The plugin records the login time. When the configured number of hours has passed (default 12), the user is logged out — "Remember Me" cannot extend it.

= Can I see what the role can open? =

Yes. The **Access Map** tab lists every admin page as allowed or blocked with the reason, and **Preview as Admin Panel Manager** shows the admin exactly as the role sees it.

= I locked myself out. What now? =

Add `define( 'LIMADRO_DISABLE', true );` to wp-config.php. All restrictions switch off (the security locks stay). Fix the settings, then remove the line. You can also restore an earlier version from **Tools & History** or with `wp limadro rollback`.

= Why do I see a review request? =

Seven days after install, administrators see a small review card on this plugin's own settings screens (never on other admin pages or the front end). Click "Maybe later" to hide it for 30 days or "I already did" to hide it for good.

= Is the theme color the same for every admin? =

No. Each administrator picks their own color with the 🎨 button. It only changes the plugin's settings screens.

= What is removed when I delete the plugin? =

The role, all plugin settings, presets, history, the activity log and the plugin's user meta. Users who had the role keep their accounts.

== Screenshots ==

1. Presets — one-click setups for a whole job or a single area, plus your own presets from JSON.
2. General — role name, session timeout, after-login page and admin notices, with the colorful header and theme color picker.
3. Capabilities — every permission grouped by area, with search and filters.
4. Menu & URL Blocks — Allowed / Blocked switches for whole areas (menu, URL and REST API), with the always-locked list.
5. WooCommerce — one choice for order access plus switches for customers, reports, coupons, download permissions, marketing, settings and status.
6. Plugin Access — every active plugin is detected: Default, Full access or Hidden per plugin, quick actions like LiteSpeed purge, or block single pages.
7. Access Map — every admin page, allowed or blocked, and why.
8. Activity — logins, blocked attempts and settings changes.
9. Tools & History — restore any earlier version, export and import settings.
10. The orders screen as the Admin Panel Manager sees it with "No delete or refund".
11. Preset builder — tick the areas and plugins a person may use, name it and save it as your own preset.

== Changelog ==

= 2.9.3 =
* New: preset builder — tick the areas, plugins and quick actions a person may use, name it, and save it as your own preset or apply it straight away.
* New: WooCommerce blocks for Coupons, Download permissions (the order meta box, grant/revoke and the downloads REST routes), Marketing, and Status & Extensions.
* New: one place to set order access — Blocked, View only, Edit (no delete or refund) or Full.
* Changed: Menu & URL Blocks, WooCommerce and Plugin Access screens redesigned with clear Allowed / Blocked switches, Allow all / Block all, live counters and an unsaved-changes bar.
* Changed: Plugin Access now uses one choice per plugin (Default, Full access or Hidden), with search, filters and per-page blocks.
* Fixed: blocking Sales reports now also blocks the WooCommerce Analytics REST routes (/wc-analytics/reports).
* Fixed: blocking Customers now also blocks the WooCommerce Customers screen under wc-admin.
* New: "SEO fields in the editor" area in the preset builder — Rank Math, Yoast and AIOSEO boxes on posts, pages and products, without their settings.
* Security: the role can no longer change capabilities through other plugins' role editors (Rank Math Role Manager, Members, User Role Editor), regardless of settings.
* Fixed: Hidden plugins are now matched by who registered the page, not only by its URL — e.g. Rank Math's "rank-math-options-*" settings pages, which live in the "seo-by-rank-math" folder, were still reachable.
* Fixed: Hidden plugins also hide their toolbar menus (front end and admin) and their own post-type screens (e.g. Elementor's template library).
* Fixed: Full access now works for plugins that use their own capabilities (e.g. Contact Form 7) and for plugin pages under Tools (e.g. Redirection), while the Tools block keeps the core Tools screens closed.
* Fixed: blocking Coupons and Download permissions now also covers their WooCommerce Analytics pages.
* Fixed: the Orders menu item, "Add order" button and order list columns were hidden on legacy (non-HPOS) stores even when orders were allowed.
* Fixed: "No delete or refund" now also stops deleting order notes.
* Fixed: blocking WooCommerce Settings now also removes the top-level Payments menu and the "Store coming soon" toolbar badge that open it.
* Fixed: a PHP warning on WordPress 6.0 when the block editor loads with the settings route blocked.
* Tested: WordPress 6.0 with WooCommerce 7.7 (legacy orders), WordPress 6.5 with WooCommerce 8.9 (HPOS) and WordPress 7.1 with WooCommerce 11.2 (HPOS), plus Rank Math, Yoast SEO, Elementor and LiteSpeed Cache.
* New: refreshed plugin icon and banner.
* New: a small, dismissible review request on the plugin's own settings screens (shown 7 days after install, administrators only).
* New: "Made by HEMDOX Digital", rate and support links in the footer of the plugin's settings screens.
* Changed: clearer plugin description on the Plugins screen and a Plugin URI.

= 2.9.2 =
* Security: fixed privilege escalation via REST API for Admin Panel Manager role. All users should update immediately.
* Security: manage_options is now only granted while a Rank Math (/rankmath/v1/), Yoast (/yoast/v1/) or AIOSEO (/aioseo/v1/) REST route is executing — never based on the request URL.
* Security: the role can never manage users or roles, post unfiltered HTML, edit files, or install/update/delete/edit/switch plugins or themes, regardless of settings.
* Security: REST routes /wp/v2/plugins, /wp/v2/settings and all write requests to /wp/v2/users are always blocked for the role.
* Security: plugin bulk actions submitted via the bottom bulk-action dropdown are now blocked.
* Security: saving one settings tab no longer resets the other tabs. Previously, saving General or Capabilities turned off the Orders, Customers, Users and Reports blocks (and saving General cleared all capabilities).
* Security: Site Editor and Font Library were reachable when Appearance was blocked; block-theme REST writes (templates, global styles, navigation, fonts) are now blocked too.
* New: Presets tab — one-click setups for a whole job (Store Manager, Content + SEO, Accountant, Client Owner) or one area only (LiteSpeed Cache only, SEO only, Posts only, Shop only). Each card shows what will change before you apply it.
* New: Custom presets — save the current settings as a preset, or create one from JSON. Download any preset as JSON to reuse it on other sites. Locked permissions and locked plugins are always removed.
* New: Plugin Access Full access — let the role use every screen of one plugin (Rank Math, Yoast, AIOSEO, LiteSpeed Cache and others).
* New: Quick actions — purge the LiteSpeed cache from the toolbar without access to LiteSpeed settings.
* New: WooCommerce tab — orders view-only or no delete/refund, hide stock and cost of goods. Works with HPOS and the legacy order screens, AJAX and REST.
* New: Preview as role — see the admin as the role sees it, with one-click exit.
* New: Access Map tab — every admin page with allowed/blocked and the reason.
* New: Activity log — logins, logouts, blocked attempts, settings changes, previews and expiries.
* New: Settings history — every save is recorded; restore any earlier version or reset to recommended settings.
* New: Export/import settings as JSON with a change preview before applying.
* New: After-login redirect (products, orders, posts, pages or a custom admin page).
* New: Hide admin notices from other plugins (or only update nags) for the role.
* New: Per-user access expiry date (Users → Edit).
* New: WP-CLI commands — `wp limadro status|export|import|history|rollback|preset|reset|log|expire`.
* New: Lockout recovery — `define( 'LIMADRO_DISABLE', true );` in wp-config.php switches off all restrictions while keeping the security locks.
* New: Colorful redesign of all settings screens, with a per-admin theme color picker.
* Changed: "View Plugins List" (activate_plugins) is now off by default for new installs and after Reset. Existing saved settings are not changed.
* Fixed: with Block Orders on and HPOS enabled, the orders pages showed a blank error page (HTTP 500) instead of "Access Denied".
* Fixed: "Translation loading triggered too early" notice on requests by the role.
* Fixed: fatal error on PHP 7.4 caused by the `mixed` return type.
* Tested with WordPress 7.1, WooCommerce 11.2 (HPOS) and Elementor 4.3.

= 2.3.0 =
* Fixed: Rank Math REST API calls (/wp-json/rankmath/v1/updateSettings) returning 403 — SEO plugin REST routes are now always whitelisted
* Fixed: manage_options is temporarily elevated during any SEO plugin REST request so save/update operations work correctly
* Improved: Capabilities tab now shows SEO plugin sections only when that plugin is actually installed — each setting as its own row, all defaulting to enabled
* Improved: Rank Math redirections, 404 monitor, analytics, site analysis — all individually controllable per row
* Improved: Yoast and AIOSEO caps similarly separated with all defaults on

= 2.2.0 =
* Fixed: Replaced inline &lt;style&gt; echo in access control with wp_add_inline_style() (WordPress.org requirement)
* Fixed: Replaced inline &lt;style&gt; and &lt;script&gt; in Plugin Access Deny page with wp_add_inline_style() and wp_add_inline_script() (WordPress.org requirement)
* Improved: Plugin Access Deny now uses explicit slug patterns for Rank Math, Yoast, AIOSEO, WooCommerce and other major plugins — all their admin pages reliably appear in the deny list
* Added: Author URI field in plugin header
* Updated: Contributors field in readme.txt

= 2.1.0 =
* Fixed: SEO plugins (Rank Math, Rank Math Pro, Yoast SEO, Yoast Premium, AIOSEO, AIOSEO Pro) now fully unrestricted — all caps pass through freely
* Added: SEO Plugins capability category with 15 caps across all supported plugins
* Added: Auto-detection of active SEO plugins shown on General tab
* Fixed: WordPress.Security.EscapeOutput errors (escaped $found with wp_kses, $bg with esc_attr)

= 2.0.0 =
* Added full capabilities registry with 15 categorized sections
* Added per-capability checkbox grid in settings UI
* Added Plugin Access Deny submenu for per-plugin admin page blocking
* Added Grant All / Deny All per category, search/filter, Restore Defaults
* Added toggle switches for quick access blocks
* Added unsaved-changes warning in settings
* Rebuilt settings page with tabbed UI
* All v1 features preserved

= 1.1.0 =
* Added plugin view-only mode (can see installed plugins list, all actions blocked)
* Added CSS hiding of plugin action links and bulk-action controls
* Removed Plugins menu from sidebar (now kept visible as read-only)

= 1.0.0 =
* Initial release
* Custom Admin Panel Manager role
* WooCommerce Orders, Customers, Users, Reports blocking
* 12-hour session timeout with configurable settings page
* REST API blocking for orders, customers, users
* Compatible with Rank Math, Yoast SEO, WooCommerce HPOS

== Upgrade Notice ==

= 2.9.3 =
Preset builder, new WooCommerce blocks (coupons, download permissions, marketing, status), redesigned access screens, safer Hidden plugins and a role-editor lockdown. Includes the 2.9.2 security fix — update now if you are on 2.9.1 or older.

= 2.9.2 =
Security release: fixes a REST API privilege escalation for the Admin Panel Manager role — update immediately. Also adds presets, custom JSON presets, WooCommerce controls, preview, history and a new design. Your settings are kept.

= 2.0.0 =
Major update. After upgrading, visit Limited Admin Role → Settings → Capabilities to review and save your capability preferences. Existing block settings (Orders, Customers, Users, Reports) are preserved.

== License ==

This plugin is licensed under the GNU General Public License v2.0 or later.

Full license text: https://www.gnu.org/licenses/gpl-2.0.html
