JM Admin Role Lock

Description

JM Admin Role Lock stops new Administrator accounts. Users who are already Administrators stay Administrators. Nobody else can be given that role.

The plugin blocks the role when WordPress saves it:

• The Users screens and the users REST API no longer offer Administrator, except while editing a user who already has it.
• A new user cannot be created as an Administrator. If other code requests that role anyway, the account is created as Subscriber.
• An existing user who is not an Administrator cannot be promoted, from the admin screens, the REST API, or code that assigns the role.
• The default role for new users cannot be Administrator. If it already was, activation changes it to Subscriber.
• An Administrator can still be demoted. After that, the role cannot be given back.

On activation the plugin writes the current Administrator user IDs to administrators.json in a jm-admin-role-lock folder inside the uploads directory. On every request it compares that file with the database. A user who has the Administrator role in the database but is not listed in the file loses the role before the request continues. When an allowed Administrator is demoted, their ID is removed from the file.

There is no settings screen.

Multisite Super Admin is a network privilege, separate from the Administrator role on a site. This plugin does not change Super Admin.

What a direct database edit can still do

A SQL query can write the role into the database. The next WordPress request removes it again, as long as administrators.json is still the list created by the plugin.

Deleting that file makes the plugin take a new snapshot from whoever is an Administrator in the database at that moment. Anyone who can edit files on the server can edit the JSON and add an ID.