Qaiyo Access Manager · Free WordPress plugin

Who sees what in your WordPress admin — you decide.

Qaiyo Access Manager brings fine-grained access control to WordPress: decide which role and which user can see your installed plugins and custom post types — across the admin, the REST API and the frontend at once.

Download Free — WordPress.orgPro (Coming in 2027)
Free forever15+ function11 built-in languages11 built-in languages
Admin access panel — Qaiyo mockup for Bricks
yoursite.com/wp-admin/admin.php?page=access-manager Saved via AJAX
Plugins Content Types Users Matrix
PluginEditorShopAuthor
WooCommerce eCommerce
Rank Math SEO
Advanced Custom Fields Fields
Access Manager< span class="pmeta">Admin-only · locked
DM Daniel Meyer Author · per-user override
Plugin & post-type access control

Decide who sees each plugin and post type

Hide WooCommerce from editors. Give a single freelancer access to one custom post type. Block contributors from your page builder. Rules are opt-in — if you haven’t set a rule, nothing changes.

  • Plugin-level access control per role
  • Custom post type rules — wp-admin, front end and REST API
  • Allow mode or Deny mode — whichever needs fewer clicks
  • User-level overrides that always win over role rules
  • Access Matrix — every plugin and post type against every role, on one screen
Qaiyo Access Manager — access matrixAccess MatrixITEMADMINEDITORSHOPAUTHORWooCommerceYoast SEOACF FieldsEvents CPTAllowedDeniedAdmin (always)No rule
Qaiyo Access Manager — front-end protectionLogin routing & front-endEditor/dashboard/editorialShop manager/shop/ordersRestricted404 page[qaiyo_protectrole="editor"cap="manage_woocommerce"]Order tools & bulk exports…[/qaiyo_protect]Sorry {user_name}, this area of {site_name}isn’t available to your role.
Login redirects & front-end protection

Beyond wp-admin

Access control shouldn’t stop at the dashboard door. Route roles after login, decide where blocked users land, and gate any piece of front-end content with a single shortcode.

  • Send each role to its own URL after login
  • Configure where restricted users land: home / 404 / login / custom
  • [qaiyo_protect] shortcode — show or hide any content by role, login state or capability
  • Fully customizable restricted-access notice with {user_name}, {site_name} placeholders
Admin & dashboard cleanup

A cleaner back end for everyone

Tidy every role’s dashboard down to what matters. Inspect native capabilities, trim the admin bar and widgets, and move rules between sites in seconds.

  • Read-only Capabilities inspector — which roles hold which WP capabilities
  • Dashboard summary widget — restricted items and active overrides at a glance
  • Hide the admin bar and individual admin-bar items per role
  • Hide dashboard widgets per role
  • Let non-admin roles update plugins or themes — runtime, fully reversible
  • JSON import / export — back up rules or migrate to another site
Qaiyo Access Manager — capabilities inspectorCapabilities inspectorCAPABILITYADMINEDITORAUTHORmanage_optionsedit_pagespublish_postsmanage_woocommerce12RESTRICTED PLUGINS7RESTRICTED CPTs4USER OVERRIDES
Every feature is a module

Fifteen features in the free plugin. Use only what you need.

Nothing is bundled behind an upsell — everything below ships in the free version on WordPress.org. Rules are opt-in, so an untouched site behaves exactly like stock WordPress.
Plugin accessPost type accessAllow / Deny modePer-user overridesAccess MatrixCapability hintsLogin redirectsRestricted redirectProtect shortcodeRestricted noticeCapabilities inspectorDashboard widgetAdmin bar controlUpdate permissionsUpdate permissions

Need more? Pro adds nine further modules on top — see what Pro adds.

Free vs Pro

What you get in Free, and what Pro adds

Access Manager
Feature Free $0 Pro Coming in 2027
Plugin-level access by role Tartalmazza Tartalmazza
CPT-level access (admin + REST + frontend) Tartalmazza Tartalmazza
Per-user allow / deny override Tartalmazza Tartalmazza
Native WordPress capability viewer Tartalmazza Tartalmazza
Administrator safety lock Tartalmazza Tartalmazza
JSON export & import Tartalmazza Tartalmazza
Dashboard widget (3 stats) Tartalmazza Tartalmazza
Read-only access matrix Tartalmazza Tartalmazza
AJAX saving & live search Tartalmazza Tartalmazza
5 built-in languages Tartalmazza Tartalmazza
WPML / Polylang / TranslatePress compatibility Tartalmazza Tartalmazza
Pro-only
Clickable (editable) matrix Nem tartalmazza Tartalmazza
Rule-set presets (save + apply) Nem tartalmazza Tartalmazza
Custom user groups Nem tartalmazza Tartalmazza
Bulk actions on plugins & CPTs Nem tartalmazza Tartalmazza
Automatic updates (Qaiyo Licensing Server) Nem tartalmazza Tartalmazza
Temporary access (expiry-dated rules) Nem tartalmazza Tartalmazza
Activity log with before/after diff + CSV Nem tartalmazza Tartalmazza
Admin page & submenu hiding Nem tartalmazza Tartalmazza
Email notifications & weekly summary Nem tartalmazza Tartalmazza
Admin tabs 6 13
Access layers 2 4
Editable matrix, presets & bulk actions

What Pro adds on top. Stop clicking row by row

Pro is a separate add-on installed alongside the free plugin — it extends the free version through its public hooks rather than replacing it. Deactivate Pro and every free rule keeps working.

The free matrix is a read-only overview. In Pro it becomes the place you actually work — flip any cell, select many items at once, and save whole rule-sets you can reapply on the next site.

  • Click-to-toggle matrix — flip any role/item cell straight in the grid
  • Bulk select — apply roles to, or clear rules from, many items at once
  • Rule presets — save a named rule-set and apply it in one click
  • Every change still saves over AJAX, with no page reload
Qaiyo Access Manager Pro — editable matrix & bulk actionsAccess Matrix · editable3 items selectedApply rolesClear rulesITEMADMINEDITORSHOPAUTHORWooCommerceYoast SEOACF FieldsClick any cell to flip it — outlined cells are the current selection.
Qaiyo Access Manager Pro — user groups & temporary accessGroups & temporary accessFreelance editorsDMKSAL+2ACF FieldsEvents CPTYoast SEOWooCommerceDaniel Meyeryoast-seoexpires in 3 daysKata Soóswoocommerceexpires in 6 hoursTemporary grants outrank group rules — admins are never affected.
User groups & temporary access

Permissions that fit real teams

WordPress roles are a blunt instrument for a freelance crew or a seasonal contractor. Pro adds a layer of your own — and access that hands itself back when the job is done.

  • Custom user groups beyond WordPress roles, with their own plugin and post-type rules
  • Temporary access — an allow or deny rule with an expiry date
  • Expired grants are cleaned up nightly by WP-Cron — no orphaned permissions
  • The affected user is emailed 24 hours before their access lapses
  • Group rules resolve before role rules, after per-user overrides
Activity log, admin pages & notifications

Know what changed, and who changed it

On a site several people administer, „who took this away?” is the expensive question. Pro records every rule change with a before/after diff — and lets you hide the admin pages that shouldn’t be reachable at all.

  • Activity log in its own table — user, timestamp and a before/after diff per change
  • Filterable, paginated, exportable to CSV, with configurable retention (90 days by default)
  • Admin page hiding — menus and submenus per role, with direct-URL access blocked
  • Admin menu order & labels — drag to reorder, rename any top-level item
  • Meta box control — hide post-editor panels per role and post type
  • Email notifications on rule changes and expiries, plus an optional weekly digest
  • Licensing & automatic updates through the Qaiyo SDK
Qaiyo Access Manager Pro — activity logActivity logAKAnna Kovács changed Yoast SEO2 hours ago · allow mode · plugin ruleeditor, authoreditorTBTamás Balogh granted temporary accessyesterday · expires 12 Mar · user ruleno ruleallow · 7 days90-day retention by default · one-click CSV export
Pricing

Simple, transparent pricing — not per-feature, not per-user

No hidden fees. No per-user pricing. No „Agency tier” at triple the price.

Free
$0
Forever free · WordPress.org
Unlimited sites
  • Plugin & post-type access per role
  • Allow / Deny mode per rule
  • Per-user allow / deny overrides
  • Read-only Access Matrix
  • Capabilities inspector
  • Login redirects + [qaiyo_protect]
  • Admin bar & dashboard widget control
  • JSON import / export
  • 11 bundled languages
Download from WordPress.org
Pro Yearly
$80
Per year · Renews annually
8 sites
  • Everything in Free, plus:
  • Click-to-toggle editable matrix
  • Rule presets & bulk actions
  • Custom user groups
  • Temporary access with auto-expiry
  • Activity log + CSV export
  • Admin page hiding, order & labels
  • Meta box control per role
  • Email notifications & weekly digest
  • Licensing & automatic updates
Coming in 2027
Pro Lifetime
$240
One time · Pay once, keep forever
24 sites
  • Everything in Pro Yearly, plus:
  • Pay once — no renewals, ever
  • All future Pro modules included
  • Updates for the lifetime of the plugin
  • 3× the site allowance of Yearly
  • Best value from ~3 years on
Coming in 2027
FAQ

Frequently asked questions

The item stays available to everyone by default. Rules are opt-in: the moment you tick at least one role, the item is restricted to those roles (and any per-user exceptions) only.

No. The Administrator role always has full access — it’s a hardcoded safety protection that can’t be overridden.

User rules take priority over role rules. A user on the deny list has no access even if their role is allowed. A user on the allow list has access even if their role is blocked.

Yes. The plugin excludes the translation plugins’ internal post types from the managed list, and never interferes with the lang / polylang_lang / trp_lang query variables.

Every registered custom post type — WooCommerce products, WooCommerce orders, ACF field groups, your own CPTs. Restrictions apply to the admin menu, list views, the editor, the REST API and frontend pre_get_posts queries at once.

Pro is a standalone, optional add-on. The free version is fully functional on its own. Pro requires the free version to be active.

Every plugin and CPT rule — role checkboxes and per-user overrides. Ideal for staging → live migration and backups.

Each allow/deny rule can carry an expiry date. A WP-Cron job removes expired rules automatically, and the affected user receives an email 24 hours before their access lapses. No manual cleanup, no orphaned permissions.

Yes — every access change is logged with the user, timestamp, and a before/after diff of the rule. The log is filterable, paginated and exportable to CSV, with configurable retention (90 days by default).

Both. Admin Page Hiding removes the menu and submenu items per role or user and blocks direct-URL access to those pages — so typing the URL by hand won’t get around it.

Through the Qaiyo Licensing Server and the Qaiyo SDK included in Pro. Updates appear on the WordPress Plugins page exactly like any other premium plugin.

Changelog

v1.3.0

Latest
  • Compatibility: verified against WordPress 7.1. Checked the areas 7.1 changes — the persistent editor toolbar (admin-bar rules), jQuery UI 1.14.2 and the updated editor components. No code changes were required.

v1.2.0

  • Accessibility: added programmatic labels (aria-label / fieldset+legend / header scope) to the login-redirect inputs, admin-bar and dashboard matrices, capabilities search and update-permission groups.
  • i18n: added an explicit translation loader so the bundled languages load reliably across environments; the new interface strings are translated in all 11 languages.
  • Code quality: moved every remaining inline style into the enqueued admin stylesheet; verified clean with PHPStan (level 5) and PHP 7.4+ compatibility.
  • Compatibility: normalized the license header to "GPLv2 or later" and replaced a hardcoded example URL with a site-derived one.

v1.1.0

  • UX: friendly personalized greeting at the top of the Access Manager screen (uses the current user's first name, falling back to their display name).
  • Security: custom post type rules now also block logged-out visitors. Previously guests were treated as allowed, so allow-list rules did not protect single front-end views or the REST API against them.
  • Security: plugin-level rules now remove and block (including direct-URL access) a restricted plugin's own admin menu pages — not just hide it from the Plugins screen. Single-file plugins are covered too.
  • Hardening: CPT capability enforcement now applies only to content types with their own custom capabilities, and resolves the real post type from the target object — preventing over- or under-blocking of content types that share the core post/page capabilities.
  • Correctness: JSON payloads (rule save, import, options) are now decoded before sanitization instead of after, so multi-line and special characters are preserved.
  • UX: added a clear security warning to the plugin/theme update-permissions setting.
  • Performance: cached admin-menu ownership resolution and bulk-loaded override users to avoid per-row queries.
  • Docs: corrected developer-hook names (qaiyo_access_manager_* prefix) and clarified the scope of plugin- and CPT-level access.

v1.0.0

  • Initial release.
  • Plugin-level access control per role.
  • Custom post type access control per role (wp-admin, front end and REST API).
  • Allow / Deny mode for every rule.
  • User-level overrides (allow/deny per user), taking priority over role rules.
  • Access Matrix overview of every plugin and post type against every role.
  • Read-only Capabilities inspector (core vs plugin capabilities flagged).
  • Native capability hints shown next to each plugin and post type.
  • Dashboard summary widget (restricted plugins / post types / active user overrides).
  • `[qaiyo_protect]` frontend content protection shortcode (role / deny / logged_in / cap / message).
  • Login redirect by role.
  • Restricted content frontend redirect (home / 404 / login / custom URL).
  • Customizable restricted-access notice (style + text with placeholders).
  • Hide the frontend admin bar, individual admin bar items and dashboard widgets per role.
  • Plugin / theme update permissions for non-admin roles (runtime, reversible).
  • JSON import / export of all rules.
  • "Explore Qaiyo plugins" overview with update notices for installed Qaiyo plugins.
  • 11 bundled languages: English, Hungarian, German, French, Spanish, Japanese, Portuguese, Italian, Russian, Turkish, Polish.
  • Compatible with WPML, Polylang and TranslatePress.
Explore Qaiyo plugins

One family of plugins, one design system, built the same way

Every Qaiyo plugin is GPL licensed, ships 11 languages and looks and behaves the same inside your admin. Install only what you need.

Qaiyo Access Manager

Decide which role and which user sees each plugin and post type — in wp-admin, the REST API and the front end.

Qaiyo Admin Booster

Page collections, smart filters, bulk page creation and upload controls — a back end that keeps up with you.

Qaiyo Clean Gallery

Dependency-free galleries: five layouts, a built-in lightbox, HappyFiles live-link and one-click ZIP export.

Qaiyo Smart Appointment

Booking with fluid, gap-based slots — mixed durations pack into the time you actually have free.

Qaiyo Social Video Embed

TikTok, YouTube Shorts and Vimeo in one mixed gallery — click-to-play, channel feed import, no API key.

Qaiyo Testimonials

Six built-in testimonial layouts with a visual Display Builder, Schema.org rich snippets and a Gutenberg block.

Qaiyo Text Marquee Slider

Infinite scrolling ticker strips: up to three rows, per-row direction, icons, separators and fade edges.

Qaiyo Web Performance Surgeon

File- and function-level performance diagnostics on a real visitor render, with safe one-click fixes.