EffortLess Advanced Role Manager

Changelog

2.4.7

• Fixed the Users tab’s pagination links pointing to admin-ajax.php (showing “0” or empty results) because the tab content is loaded via AJAX, so the pagination link builder was picking up the AJAX request URL instead of the actual admin page URL.

2.4.6

• Added a “My Sites” item to the Admin Bar tab’s Multisite section (network installs only) — it was previously impossible to hide, since it wasn’t in the checklist at all.
• Clarified in the Admin Bar tab that the Search box is a front-end-only WordPress core item and will never appear inside wp-admin regardless of this setting.

2.4.5

• Added a warning on the Plugins tab when the selected role lacks WordPress’s own “activate_plugins” capability, since WordPress core never shows the Plugins menu to such a role regardless of this tab’s settings.

2.4.4

• Fixed: granting a custom role the “manage_options” capability didn’t actually exempt it from Admin Menu/Dashboard/Admin Bar/Plugins/Profile restrictions as the Roles & Capabilities tab’s own tooltip promised.
• Fixed: users assigned more than one role could bypass a restriction configured only for their non-primary role, since enforcement only ever checked the first role.
• Fixed: hiding just “Add New “, or a taxonomy screen belonging to a non-post post type, didn’t block direct URL access to that screen as promised.
• Fixed: bulk role assignment on the Users tab had no safeguard against an Administrator accidentally changing their own role and locking themselves out.
• Fixed: deleting a custom role left its hidden-menu/plugins/dashboard/profile/admin-bar settings behind, so a new role reusing the same slug would silently inherit them.
• Added the required Donate link (id7.dev) to the plugin header and readme, with the reusable donate notice wired up on the plugin’s Settings screen.
• Removed the unused, never-wired-up internal cache layer.
• Internal: consolidated six near-identical AJAX table-loading handlers into one shared method.

2.4.3

• Added “view_site_health_checks” as a grantable capability on the Roles & Capabilities tab. WordPress core only shows the “Site Health Status” dashboard widget to users with this capability (normally just Administrators, since core grants it automatically to whoever has install_plugins) — it was previously impossible to give any other role this capability through the plugin, since it isn’t stored on any role by default and so never appeared as a checkbox.

2.4.2

• Moved the “Force edit Administrator capabilities” checkbox off the Roles & Capabilities tab and into a new dedicated Settings tab. The Roles & Capabilities tab itself now only shows a plain grey/locked state for the Administrator role (with a link to the Settings tab), instead of an inline unlock form mixed in with the capability grid.

2.4.1

• The role selected in any tab’s “Select Role” dropdown (Plugins, Admin Menu, Dashboard, Profile Fields, Admin Bar, Roles & Capabilities) now carries over when switching tabs, instead of each tab resetting to its own default role. Makes editing several tabs for the same role much faster.

2.4.0

• Administrator capabilities are now locked (greyed out) by default on the Roles & Capabilities tab, replacing the previous approach of individually protecting a short list of capabilities. A new “Force edit Administrator capabilities” setting, unchecked by default, unlocks the entire grid for editing when you explicitly opt in — this removes the whole class of accidental-self-lockout risk rather than trying to enumerate every capability that could cause it.

2.3.11

• Deep review of the Roles & Capabilities tab found and fixed three issues:
  • A serious gap: nothing stopped manage_options from being unchecked for the Administrator role itself, which could lock every administrator (including the person doing it) out of Settings, Plugins, and this plugin’s own screen. It’s now locked the same way activate_plugins/manage_network already were, both in the UI and enforced server-side.
  • Creating a role with a slug that already exists silently did nothing while still showing “Role created successfully!” — it now shows a clear error instead.
  • Several real capabilities (edit_plugins, delete_plugins, edit_themes, edit_theme_options, etc.) were miscategorized under “Posts & Pages” instead of “Plugins”/”Appearance”, because the generic edit_/delete_ prefix patterns were checked before the more specific ones.

2.3.10

• Fixed the Plugins tab never exempting the Administrator role from its own hide list (present since the very first release): every other tab (Admin Menu, Dashboard, Admin Bar, Profile Fields) skips filtering for Administrators, but the Plugins tab’s filter had no such check — an Administrator account could end up with plugins hidden from their own Plugins screen. Full state/polarity audit of every hide/show toggle, exemption check, and mutual-exclusion rule in the plugin found no other inversions.

2.3.9

• Restored the Delete Role feature, which was unreachable since the very first release: the confirmation dialog and server handler existed, but no button ever opened the dialog. The Roles & Capabilities tab now shows a “Delete This Role” button when a non-default role is selected (default WordPress roles cannot be deleted, and roles with assigned users are still protected server-side).
• Added the missing security nonce to the Dashboard tab’s “Rescan All Widgets” button.
• Fixed a duplicate HTML element ID: the Roles tab rendered a second, non-functional “Loading…” element with the same ID as the page’s main loading indicator.

2.3.8

• Fixed the “After Logout Redirect To” setting never applying: WordPress fires the logout hook after it has already cleared the current user, so the plugin always saw a role-less visitor and did nothing. The logged-out user is now looked up from the user ID the hook provides.
• Fixed “Custom URL” login/logout redirects pointing to another domain being silently ignored: WordPress validates redirects against an allowed-hosts list that only contains this site by default, so external URLs fell back to wp-admin. Hosts from configured custom redirect URLs are now added to that list.
• Replaced the last remaining inline JavaScript event handlers (the Users tab’s select-all checkbox and the Profile Fields tab’s Hidden/Read-Only mutual exclusion) with handlers in the plugin’s script file, consistent with the rest of the plugin.
• Added accessible labels to the “select all” checkboxes for screen readers.

2.3.7

• Changed the “who is exempt from restrictions” rule on the Admin Menu, Dashboard, Admin Bar, and Profile Fields tabs back to checking the literal Administrator role, instead of the manage_options capability. Under the capability-based check, any role granted manage_options (even by accident, from the Roles tab) became fully exempt from every restriction this plugin applies — which is confusing and easy to trigger unintentionally. A role is now only exempt if it’s actually named “administrator”.

2.3.6

• The “read” capability (required just to open wp-admin at all, for any role) is now locked/always-checked in the Roles & Capabilities list, with a lock icon and tooltip explaining why, instead of being an easy-to-lose checkbox buried alphabetically inside the “Other” group. This is also enforced server-side on save as a safety net, so this capability can no longer be accidentally stripped from a role.

2.3.5

• Fixed a real bug on the Roles & Capabilities tab that could strip capabilities from a role every time you clicked Save Changes, even ones you didn’t touch: saving worked by removing every known capability and re-adding only the ones submitted, but legacy level_0–level_10 capabilities (and Administrator’s locked/disabled activate_plugins/manage_network checkboxes) were never part of the submitted set, so they were silently and permanently removed on every save. Also switched the capability list to submit as a single consolidated field instead of one native field per checkbox, since a role/site with many capabilities (multiple custom post types, WooCommerce, Yoast, etc.) could exceed PHP’s max_input_vars limit and have capabilities silently dropped by PHP itself.
• Added a warning icon next to manage_options in the capability list for non-Administrator roles: granting it exempts that role from every restriction this plugin applies elsewhere (Admin Menu, Dashboard, Admin Bar, Profile Fields), the same as an Administrator.

2.3.4

• Temporary diagnostic build: adds a debug line to the Admin Menu and Dashboard tabs showing the raw saved hidden-items option for the selected role, to help track down a reported hide/show enforcement issue. To be removed once the issue is confirmed fixed.

2.3.3

• Fixed the Dashboard tab’s Callback column (and Widget ID) being unreadable: both hold long, unbroken strings like “My_Class::render_widget” that don’t naturally wrap, so in the table’s fixed layout they overflowed their cell instead of shrinking. The Widget Title and Context columns are narrower now, freeing space for a wider Callback column, and long values in both columns wrap instead of overflowing.

2.3.2

• Rebuilt the hide/show toggle switch on WordPress core’s own toggle component (the same markup/stylesheet core uses for things like the plugin list’s auto-update toggle) instead of a hand-rolled switch, so it renders at core’s compact, centered size everywhere rather than risking a specificity conflict with core’s checkbox styling. Colors and thumb position are customized so Visible (default) still shows green on the right and Hidden shows red on the left.

2.3.1

• Fixed the new hide/show toggle switches rendering oversized and with the native checkbox square showing through: WordPress core’s checkbox styling (border, background, forced width/height, larger still on mobile) has the same CSS specificity as a plain override and could win the cascade depending on stylesheet order. The switch’s checkbox is now fully reset with a guaranteed-specificity selector so only the intended switch renders, at its correct compact size.

2.3.0

• Replaced the bare hide/show checkboxes on the Plugins, Admin Menu, Dashboard, and Admin Bar tabs with a labeled toggle switch showing “Visible” or “Hidden” directly on the row, so the current state is clear at a glance instead of relying on remembering which way the checkbox goes.

2.2.3

• Fixed uneven left/right spacing around the plugin’s content: WordPress core’s .wrap class sets an asymmetric default margin (2px on the left, 20px on the right), which made the cards look off-center. The page wrapper now overrides this with equal margins on both sides.

2.2.2

• Fixed the Users tab’s “New Role” dropdown visually overflowing outside its card: the table uses a fixed layout, and a with no width constraint sizes to fit its longest option (long role names), which could render wider than its column and spill past the card’s edge. Form controls inside the plugin’s tables are now capped to their cell’s width.

2.2.1

• The “Select Role” dropdown on every tab now defaults to the current logged-in user’s own role (Administrator, for most people configuring the plugin) instead of inconsistent hardcoded defaults — previously Admin Menu/Dashboard defaulted to Administrator, Admin Bar/Profile Fields defaulted to Subscriber, and Roles/Plugins defaulted to whichever role happened to be registered first.

2.2.0

• Fixed an inconsistency found in a deep code review: Dashboard widgets, Admin Bar items, and Profile field restrictions still checked the literal “administrator” role (like Admin Menu used to) instead of the manage_options capability, so a Super Admin holding a lesser role on a specific site could be incorrectly restricted there. All restriction/enforcement checks across every tab are now consistent.
• Fixed real bugs in the Admin Bar’s Branding & Logo checklist: “WordPress Logo – About WordPress” targeted a node ID that doesn’t exist in WordPress core (checking it had no effect), the actual WordPress.org and Learn WordPress links were missing from the list entirely, and “Edit My Profile” targeted a node that also doesn’t exist as a separate, removable item (it’s inline text inside the “User Info” item, and is now hidden together with it).

2.1.6

• Fixed the Users tab’s Search Users box looking like a nested box-within-a-box: it was placed inside .erm-card, which already has its own border/background, creating a double-boxed appearance. It’s now a standalone box above the card, styled and positioned the same way as the “Select Role” selector on the Plugins/Admin Menu/Dashboard/Admin Bar tabs.
• Removed the now-unused .search-form/.search-box CSS rules.

2.1.5

• Fixed “Rescan All Widgets” stranding the user on the real WordPress Dashboard after scanning; it now redirects back to Settings > Advanced Role Manager > Dashboard automatically, with a confirmation message.
• Fixed the Users tab’s Search Users box sitting outside the same card as the rest of the tab’s content; it’s now inside the same .erm-card as everything else.
• Fixed save/error notices appearing below the tab navigation instead of above it: WordPress core automatically repositions notices to the .wp-header-end marker, which was placed after the tabs instead of right after the page title. Moved it to the correct place, immediately after the title.

2.1.4

• Fixed checkboxes appearing flush against the left edge on the Admin Bar, Profile Fields, Dashboard, Plugins, and Users tables. Only the Admin Menu table had the custom cell padding that gives checkboxes proper spacing; that rule now applies to every table in the plugin.

2.1.3

• Fixed Users, Plugins, and Admin Menu tab descriptions not being wrapped in the same content card as the other five tabs — they’re now inside .erm-card, matching Dashboard/Profile Fields/Admin Bar/Login & Logout/Roles & Capabilities exactly.
• Fixed checkbox column misalignment across tables: the Users tab had its header/body checkbox cells reversed ( in the header, in the body — the wrong way around), and the Users/Plugins tabs were missing the explicit width used by the other tables.
• Save/create/delete confirmation messages (e.g. “Capabilities saved successfully!”) now actually display after a normal (non-AJAX) redirect — they were only ever shown when switching tabs via AJAX.

2.1.2

• Fixed a fatal error (“Call to undefined function populate_roles()”) when clicking “Repopulate Default WordPress Roles.” populate_roles() lives in wp-admin/includes/schema.php, which isn’t loaded during a normal admin-post.php request; that file is now required first.

2.1.1

• Added a self-service “Repopulate Default WordPress Roles” safety net on the Roles & Capabilities tab: if a site has no roles at all (can happen on sites that weren’t fully initialized), a notice with a one-click button now offers to safely add the missing default roles via populate_roles(), without touching any custom roles or existing capabilities.

2.1.0

• Fixed a multisite capability mismatch: every action and the admin menu itself required manage_network_options (Super Admin only), even though all settings are stored per-site. Ordinary site administrators can now use the plugin on their own site as expected.
• Fixed the Users tab listing every user in the network instead of just the current site’s members, which made unrelated users show “no role.”
• Removed the broken Network Admin menu registration (it tried to attach to a Settings page that doesn’t exist in Network Admin).
• Fixed the admin-menu restriction exemption to check actual manage_options capability instead of the literal “administrator” role, so a Super Admin holding a lesser role on a given site is never accidentally locked out.

2.0.4

• Removed all domclic.fr links (Plugin URI, Author URI, Donate link, and the two support-section mentions) from the plugin header and readme.

2.0.3

• Added an explanatory description to the Roles & Capabilities, Users, Plugins, and Admin Menu tabs, matching the ones already present on Dashboard, Profile Fields, Admin Bar, and Login & Logout. (Note: version 2.0.2 was skipped — an earlier attempt at this had placement issues and was reverted; this release redoes it correctly, with no other changes.)

2.0.1

• Moved the admin page from a top-level menu (“Roles & Menus”) into Settings > Advanced Role Manager, in every language. The menu name itself is kept as “Advanced Role Manager” untranslated across all locales.

2.0.0

• Renamed the plugin to EffortLess Advanced Role Manager (slug: effortless-advanced-role-manager).
• Removed the redundant load_plugin_textdomain() call (discouraged since WP 4.6).
• uninstall.php now cleans up options on every site in a multisite network, not just the active one.
• Role deletion is now blocked while any user is still assigned to that role.
• Admin Menu restrictions are now enforced at the request level (direct URLs return a 403) and at the REST API level for restricted post types, not just hidden from navigation.
• Moved profile-field CSS/JS from inline output to properly enqueued assets, and fixed a latent value-escaping issue in the hidden-field-preservation script.
• Added French (fr_FR), Spanish (es_ES), and Chinese Taiwan (zh_TW) translations.

1.0.0 – 2024-12-02

Initial Public Release

• Feature: Roles & Capabilities management
• Feature: Create, edit, and delete custom roles
• Feature: Group capabilities by category (Posts, Media, Plugins, etc.)
• Feature: User role assignment with bulk actions
• Feature: Search and filter users
• Feature: Plugin visibility control per role
• Feature: Admin menu management with auto-detection
• Feature: Dashboard widgets control with auto-scanning
• Feature: Profile fields restrictions (hide/read-only)
• Feature: Admin bar item customization
• Feature: Performance caching system
• Feature: WordPress Multisite support
• Feature: WooCommerce integration
• Feature: Yoast SEO integration
• Feature: AJAX-powered interface
• Security: Nonce verification on all forms
• Security: Capability checks throughout
• Security: Input sanitization and output escaping
• Security: Server-side validation
• Performance: Smart caching system
• Performance: Optimized database queries
• Performance: Lazy loading of resources
• Compatibility: Tested with WordPress 6.4
• Compatibility: Tested with PHP 7.4 – 8.2
• Compatibility: Works with Gutenberg
• Compatibility: Works with Classic Editor
• Documentation: Complete user guide
• Documentation: Developer guide with code examples
• Accessibility: WCAG 2.1 AA compliant interface