Pages by User Role for WordPress Utilities is a CodeCanyon plugin that adds role-based access control to a WordPress site, letting an administrator decide which user roles can see specific pages, posts, categories, custom post types and WooCommerce products. It also removes restricted content from menus, search results and blog rolls, and can redirect anyone who lacks the required role. It is aimed at WordPress developers, freelancers and agencies building client sites where different audiences need to see different things, rather than at bloggers who just want a simple membership gate.
The plugin is sold by an author trading as RightHere, costs $20 as a one-off licence, and has been downloaded 2,353 times with an average rating of 4.62 out of 5 across 149 reviews. The vendor last updated it in April 2024, and it declares compatibility back to WordPress 5.0 as well as with bbPress, BuddyPress and WooCommerce.
What the plugin actually does
Access control is the core of the product. Every page, post, custom post type and taxonomy term gets an Access Control meta box, and inside it the administrator ticks which roles may view that item. The standard WordPress roles are all supported — Subscriber, Contributor, Author, Editor and Administrator — and custom roles created by other tools can be used too. The vendor notes that creating those custom roles requires its separate White Label Branding product, so teams relying on a different role editor should confirm compatibility before buying.
Restriction is not limited to hiding a page body. The plugin also strips the item from the site menu, from search results and from the blog roll, which matters because a link that returns a “no access” message is still a link that reveals the page exists. Hiding is handled per item, so a private client area and a public marketing menu can coexist without duplicating content.
Redirects are configurable at two levels. A global default URL catches anyone who lands on restricted content, and each page, post or custom post type can carry its own destination instead. There is also a redirect-to-login option, and a forced login mode that makes an entire site private, with whitelists for pages, posts, custom post types and raw URLs so that archives, categories and a public homepage can stay open.
Several features go beyond straightforward gating. The plugin can set a different front page for logged-in and logged-out visitors, restrict access to wp-admin by role, and restrict WooCommerce products and the shop itself. Shortcodes allow inline restriction inside post content, with the vendor supplying pur_restricted, pur_restricted_alt and pur_not_logged_in. Comment filtering is available as an option, and the 2024 release added always-allow and always-disallow lists for individual usernames, which take priority over role rules — useful for giving one contractor access without inventing a role for them.
Two details suggest the author has used the plugin on real projects. The first is a panic option that undoes a restriction if an administrator locks themselves out of a custom post type. The second is a setting that hides content on the front end while leaving it visible in wp-admin, Ajax and the REST API, which the changelog describes as a way to keep a course out of the website while still serving it inside a mobile app.
Where it fits, and where it does not
The clearest fit is an agency or freelancer maintaining several client sites where content visibility follows job function. A trade association might show committee documents to one role and public resources to everyone else. A publisher might keep an editorial category out of the public blog roll. A B2B wholesaler running WooCommerce might show trade pricing and products only to approved accounts, while retail visitors see a reduced catalogue.
It is also a reasonable choice for staged launches. Because visibility is controlled by role rather than by publish status, a team can build a full site, leave everything published, and reveal sections role by role as each client department signs off. Forced login with URL whitelisting covers the “private intranet with a public front door” pattern without a separate membership plugin.
It is the wrong choice for paid membership. There is no subscription handling, no payment gateway, no expiry date and no per-user purchase record. Anyone expecting to sell access to a course or a download area should look at a membership platform and treat this as a complementary tool at best. It is equally unsuited to complex editorial workflows, because it controls who can see content, not who can edit, review or publish it — WordPress capabilities and a role editor handle that job. Sites with heavy personalisation, where two logged-in users with the same role must see different content, will find role-level rules too coarse.
Strengths and limitations
Strengths
- Restriction is applied consistently across the menu, search results and blog roll, not just the page body, which avoids leaking titles and URLs.
- Custom post types and custom taxonomies registered by third-party plugins are supported, so the plugin is not confined to WordPress’s built-in content types.
- Redirect targets can be set globally or per item, which allows a tailored message or a targeted upsell page rather than one generic error.
- Username-level allow and deny rules override role rules, covering one-off exceptions without creating roles.
- WooCommerce product and shop restrictions are built in, which is unusual at this price point.
- The panic option and the front-end-only hiding mode both address problems that only appear after real deployment.
- A 4.62 average across 149 reviews, with more than 2,300 sales, indicates a product that has been used widely enough to surface its faults.
Limitations
- Custom user roles require the author’s separate White Label Branding plugin. Sites already using another role editor may not be able to target their custom roles without changing tools.
- The most recent release is April 2024. The changelog shows long gaps between updates — roughly two years separates the 2022 and 2024 entries — so buyers should weigh how quickly fixes would arrive if a future WordPress release broke something.
- Access is decided by role, so it cannot express per-user exceptions beyond the username allow and deny lists, and those lists are not a substitute for granular permissions.
- Forced login and front-page switching interact with caching and with other plugins that hook into template loading. The changelog records a past conflict where blocking a role from the front page crashed WooCommerce checkout Ajax, which is a reminder to test the checkout path after any configuration change.
- The vendor’s compatibility list names WordPress 7.0.x alongside 6.x and 5.x versions, which reads as a forward-looking claim rather than a tested one. Treat the upper end of that range as unverified.
- Restricting content by hiding it is not the same as protecting it. The plugin controls what WordPress renders for a given visitor; it is not a substitute for securing files, feeds or API endpoints that bypass the theme.
How it compares with the alternatives
Most competing approaches fall into three groups. General role and capability plugins change what users can edit inside wp-admin, which is a different problem: they govern the back end, not what a visitor sees on the front end. Membership plugins handle front-end visibility well but bundle payment, subscription and email features that a client site does not need, and they usually charge annually. Writing conditional logic into a theme is free and precise, but it lives in code, so every visibility change becomes a developer task and the rules are invisible to whoever inherits the site.
Pages by User Role sits between the first and third options. It brings front-end visibility rules into the WordPress admin as configuration rather than code, while leaving editing permissions to the tools built for that job. Against membership platforms it is cheaper and lighter, but it lacks paid access. Against custom theme code it is less flexible, but a non-developer can change a rule without a deployment. For sites where visibility follows job function rather than payment, that trade is usually the right one.
Frequently Asked Questions
Does Pages by User Role work with WooCommerce?
Yes. The plugin can restrict WooCommerce products and the shop page by user role, and the vendor lists WooCommerce 8.x.x as compatible. Restrictions apply to the front end, so a wholesale-only catalogue can be hidden from logged-out visitors while remaining manageable in wp-admin. Checkout should be tested after configuration, since the changelog records a past Ajax conflict.
Can it hide pages from the menu and from Google search results?
It removes restricted items from the site menu, the blog roll and WordPress’s internal search results, and it works with custom menus. That prevents titles and links from appearing to unauthorised visitors. It does not remove pages from external search engines, so a page that was previously public may still appear in Google until it is recrawled or excluded.
Do I need another plugin to use custom user roles?
Yes, in most cases. The plugin supports custom roles, but the vendor states that creating them requires its White Label Branding product. If a site already uses a different role editor, the custom roles it defines may not appear as options. Confirming this before purchase avoids a surprise for teams with established role structures.
Can the whole website be made private?
Yes. A forced login mode makes the entire site require authentication, with whitelists for specific pages, posts, custom post types and URLs so that a public homepage, archive or category can stay visible. A separate option sets different front pages for logged-in and logged-out visitors, and can be used with or without forced login.
Verdict
Pages by User Role is worth buying for developers, freelancers and agencies who need role-based visibility on client sites and want those rules editable from the WordPress admin rather than buried in theme code. The combination of menu, search and blog roll hiding, per-item redirects, custom post type support and WooCommerce restrictions covers more ground than most plugins at this price. It is not the right purchase for anyone selling access, since there is no payment or subscription handling, and the two-year gap between recent updates is a genuine consideration for sites that must stay current with WordPress releases. Teams already committed to a different role editor should verify that their custom roles will appear before spending the $20.
