You can grant non-administrator users access to WP Ghost settings by assigning the hmwp_manage_settings capability to their user role. By default, only administrators can see and configure WP Ghost. Using the User Role Editor plugin, you can extend access to editors, shop managers, or any custom role, allowing them to manage security settings without full administrator privileges.
Granting WP Ghost access to non-admin roles is useful in several situations: a dedicated security team member who operates with an Editor role but needs to manage security settings, a WooCommerce shop manager who handles site security alongside store management, or a multisite setup where sub-site administrators need path security control without super-admin access. This approach follows the principle of least privilege: users get exactly the access they need, nothing more.
This guide grants access to additional roles. If you want the opposite (hiding WP Ghost from administrators and showing it to only one specific user), see Hide and Show WP Ghost in the WordPress Menu.
The user now has permission to see and manage WP Ghost settings when they log in.
Only grant this capability to trusted users. The hmwp_manage_settings capability gives full control over WP Ghost’s security configuration, including path changes, firewall settings, and brute force rules. A user with this capability can disable security features or change settings that affect the entire site. Only assign it to users you trust with security decisions.
Yes. In User Role Editor, go to Users > User Role Editor, select the role from the dropdown (for example, Editor), find hmwp_manage_settings, check it, and click Update. All users in that role will then have access to WP Ghost settings.
Everything an administrator can do in WP Ghost: change paths, configure firewall rules, manage brute force settings, enable/disable 2FA, set security headers, and access security logs (Premium). The capability gives full WP Ghost management access. It does not grant any other WordPress admin capabilities.
This guide adds WP Ghost access to users who don’t have it (granting access to non-admin roles). The Hide and Show WP Ghost in the WordPress Menu guide does the opposite: it removes access from administrators and restricts it to one specific user. Both use the same hmwp_manage_settings capability.
Yes. Any WordPress capabilities plugin that can manage user-level or role-level capabilities works. PublishPress Capabilities, Members, and User Role Editor all support editing the hmwp_manage_settings capability. The process is the same: find the capability, enable it, save.
No. WP Ghost menu visibility is controlled through WordPress capabilities. All security features use rewrite rules and hooks. No core files are modified.
User access and admin control:
Replace the default wp_ database prefix with a random one to protect against SQL injection…
Change the WordPress uploads directory path with WP Ghost (rewrite rules, no files moved) or…
Configure WP Ghost with WP Rocket cache. Enable file optimization, Change Paths in Cache Files.…
https://youtu.be/6ylhojSi-_E In this video, we’ll explore why website security matters and what can happen if…
The security of your WordPress site depends on multiple factors, such as the strength of…
Step-by-step guides to connect WP Ghost 2FA with Google Authenticator, Authy, Microsoft Authenticator, or LastPass.…
I tried it, but What i saw is ” Hide my wp trusted” Capabilities, i did not see hmwp_manage_settings how can i delete the plugin database files? to see if it will be resolved!