Explicitly Deny Capabilities

How denied capabilities work

Suppose the Super role is granted these capabilities:

• edit_posts

Then, suppose the Duper role is granted these capabilities:

• publish_posts
• edit_products

Now, further suppose User A has the Super role because you want them to edit posts. However, you also want User A to be able to edit products so you assign them the Duper role. Suddenly, User A is granted the following capabilities:

• edit_posts
• publish_posts
• edit_products

For whatever reason you don’t ever want users with the Super role to be able to publish posts. Now you have a problem. One way to solve this is to create a third role with just the caps that you want and give that single role to User A. However, that becomes cumbersome on larger sites with many roles.

Instead, you could explicitly deny the publish posts capability to the Super role. When you do that, User A is only granted the following capabilities:

• edit_posts
• edit_products

And is denied the following capabilities:

• publish_posts

Turning it on

Denied capabilities only overrule granted ones when Denied capabilities should always overrule granted capabilities is ticked under Members → Settings → Roles and Capabilities. It’s on by default. It only matters for users with more than one role; on a single role, a denied capability is simply not granted.

Use deny sparingly

Leave a capability unset unless you need one role to override another. Denying many capabilities on a role (including read) can stop its users from reaching the dashboard at all. See the Capabilities Guide.