Description

Arabdown Permissions gives you full visual control over what each user role sees inside WordPress, without editing WordPress core capabilities and without writing code. It is RTL-first (built for Arabic) and works with any theme.

Free features

Admin menu control — hide any menu or submenu from the sidebar per role.
Plugins screen — hide specific plugins from the Plugins screen per role (visual only; the plugin stays active).
Dashboard widgets — control dashboard widgets per role.
Admin Bar — hide specific admin-bar items (WP logo, comments, updates…) or the whole admin bar on the front end, per role.
Custom roles — create new roles by cloning existing ones, edit their capabilities, and delete safely by moving users to another role.
Activity log — every sensitive change is logged (who, when, what), with advanced filtering and CSV export.
Preview as role — preview the site as another role without logging out, with a persistent banner.
Backup / Restore — export all settings and rules as JSON, then restore or move them to another site.
Default-safe — first activation hides nothing; every rule is added explicitly. Administrator sees everything by default, and the plugin cannot hide itself (lockout protection).

A note on the separate security add-on

Everything listed above is free and fully functional: nothing in this plugin is limited, time-boxed or locked behind a key.

Advanced security features (two-factor authentication, login protection, time-based access rules, security alerts and emergency access) are developed as a separate commercial plugin. Its code is not part of this download and this plugin contains no licence check, no upgrade prompt and no reference to it in the admin.

بالعربية

عرب داون للصلاحيات: تحكّم بصريّ كامل بما يراه كل دور مستخدم في ووردبريس — إخفاء قوائم لوحة التحكّم، الإضافات، الودجت، وعناصر شريط الأدوات حسب الدور، عبر مفاتيح تبديل وبلا كود. عربيّ وRTL أوّلًا، ويعمل مع أيّ قالب. لا يعدّل صلاحيات ووردبريس الأساسية، والمدير محميّ من الإقفال.

External services

This plugin uses no external or third-party services.

It runs entirely on your own server: it makes no remote HTTP requests of any kind, sends no data anywhere, contacts no licence server, and includes no analytics or tracking. This is verifiable in the source — the package contains no call to wp_remote_* and no external endpoint.

Installation

Install from the WordPress plugin directory, or upload the arabdown-permissions folder to wp-content/plugins/.
Activate it from the Plugins screen.
Open “Arabdown Permissions” and start hiding menus / plugins / widgets per role with toggles.

FAQ

Does it modify WordPress core capabilities?: No. The visual hiding is applied per role without changing core capabilities, so nothing breaks if you deactivate the plugin.
Can I lock myself out?: No. Administrator sees everything by default, and the plugin cannot hide itself.
Does it work with any theme?: Yes — it is theme-independent and fully supports RTL.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Arabdown Permissions” is open source software. The following people have contributed to this plugin.

asemalkamel

Translate “Arabdown Permissions” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.1.16

Hardened settings import: every imported field is now sanitized recursively (keys via sanitize_key, strings via sanitize_text_field, scalars preserved) using the same sanitizer as the AJAX importer, instead of writing uploaded JSON values after a structural check only.

1.1.15

Fixed: with the “suspicious activity” filter on, the audit-log query passed literal % patterns to $wpdb->prepare(), which read them as placeholders and broke the query. Those patterns are now bound as placeholders.
Fixed a malformed PHP opening tag introduced while trimming the build.

1.1.14

This build contains no licence checks at all: every feature it ships is free and fully functional, including audit-log CSV export. The advanced security features are a separate plugin whose code is not included here.
The bundled Arabdown framework now ships in a lean form for this plugin: the AI-provider, Google-integration and licensing layers are not included, so the package makes no outbound HTTP request of any kind.
Sanitization: the audit export link is rebuilt from an explicit whitelist of sanitized filters, imported backup values are sanitized recursively, and the uploaded file name goes through sanitize_file_name().
AJAX actions now use the full arabdown_perm_ prefix.
All gettext calls in the package use the plugin’s own text domain.

1.1.12

First WordPress.org release. The free layer is complete and standalone (menu / plugins / widgets / admin-bar control per role, custom roles, activity log, preview-as-role, backup & restore). The optional Pro security layer (2FA, login protection, time rules, alerts, emergency access, audit export) is a separate purchase and is not bundled here — its features appear as clearly-labelled locked panels with an honest upgrade path.
Hidden tool pages register under a proper parent, fixing a PHP 8.1 deprecation notice from WordPress core’s admin-header on those screens.
Hardening pass: every remaining input read is sanitized or explicitly justified; SQL uses prepared placeholders throughout.

1.1.8

Unified premium upgrade experience: a central plans catalog, an upgrade popup, an honest plans-comparison table, and clearer “you have a key — activate” paths on the overview. No change to the free feature set or to how the plugin updates.

1.1.7

Hardening & WordPress.org compliance: inline scripts and styles are now enqueued; inputs are sanitized and outputs escaped. The free plugin makes no remote calls (it updates via WordPress.org). Optional Pro licence activation is opt-in and documented above.