← Back to modules

nexya roles Manage WordPress user roles and capabilities

WordPress rights organized under the content type they belong to, finally readable. And the menu reduced to what the person in front of it actually needs to do there.

  • Capabilities you can read WordPress stacks permissions into a single flat list, where your theme's permissions sit right alongside those of six plugins. Here, they are grouped under the content type or taxonomy they belong to, with clear labels.
  • The menu only shows what is useful Each entry can be removed starting from a specific role level — editor, author, contributor... —, including those from plugins that didn't provide their own permission, and role by role with Pro. And the hidden page also rejects its direct address, not just its link.
  • Check before delivery Take over your client's account for a quick glance, see their dashboard as they will see it, and switch back. Without a password, without a second browser, without guessing
  • Roles that match the job With Pro, a "news writer" or "shop manager" role can be created by starting from an existing role and then removing what doesn't concern them.
  • Restricted pages A page can be restricted to logged-in users, specific roles, or specific accounts. Others are sent to the login page or read a message, and the page is removed from the sitemap, search, and lists.
nexya roles on video: Manage WordPress user roles and capabilities 0:24

What it can do

Manage WordPress user roles and capabilities, readable at last

WordPress stacks capabilities in a flat list several hundred lines long. Here they are grouped under the content they belong to, the menu shrinks to what each person needs, and you check before delivering.

Capabilities

Capabilities grouped under their post type

Read, create, edit, publish, delete: each capability has a plain label and is ticked role by role, under the relevant post type or taxonomy. Capabilities added by the theme and plugins find their place in the same spot.

  • Test an account without its password, then switch back
  • With Pro, custom roles built from an existing one
  • Pages reserved for logged-in users, roles or accounts
Permissions, role by role nexya roles
Role

Pages

A permission is cut per content type, not in one block: that is what lets you say “they publish the news, they do not touch the pages”.

The menu

Everyone sees only what they have to do

Each menu entry can be hidden from a given role level, including those of plugins that did not plan a capability of their own. The hidden page also refuses its direct address, not just its link.

  • Editor, author, contributor or subscriber
  • With Pro, exceptions role by role
  • The direct address refused, not just the link
The menu, hidden from one level down nexya roles
The rule 2 Editor Pro Author Pro Subscriber Pro
Hidden from
Menu entry No one Editor Author Subscriber
Dashboard index.php 1 always visible
Posts edit.php 2
Appearance themes.php 3

The section is hidden: everything it holds goes with it, from the same level on.

Themes themes.php
Customise customize.php
Menus nav-menus.php
Plugins plugins.php 2
Tools tools.php
Settings options-general.php 4

The solid green notch is the level chosen; the pale green notches to its right are hidden along with it — hiding from the editor hides from the subscriber too. The rule by level is free; departing from it role by role takes a licence.

Reserved pages

A client area without a membership plugin

A page can be reserved for logged-in people, certain roles or a few chosen accounts. Others are sent to the login or read a message instead, and the page disappears from the sitemap, search and the site’s lists.

  • By role or account by account
  • Message or login, as you prefer
  • Out of the sitemap and search
Reserved pages nexya roles
Page Access
Client area /espace-client/ Logged in
Reseller prices /revendeurs/ Reseller role
Board documents /conseil/ 3 accounts
Contact /contact/ Everyone

Others go to the login or read a message; the page leaves the sitemap and search.

And everything else, already included

  • Reserved pages Others go to the login or read a message.
  • Out of search A reserved page leaves the sitemap, search and lists.
  • Plugin roles With Pro, roles from WooCommerce and others sorted into place.
  • Back in one click After testing an account, the bar takes you back to the admin.

The problem it solves

On a site with ten plugins, a role easily carries two hundred permissions, written in English, with no indication of who created them or what they unlock. Modifying them amounts to checking boxes blindly. The module groups them by content type and gives them clear names, turning an unreadable list into a series of understandable decisions.

The menu and the direct address

Removing a menu entry is not enough: the page address can still be typed in, and most solutions stop there. Here, a page removed for a role also rejects the request. What the person cannot see, they cannot reach by knowing the URL either.

How account testing works

The mechanism relies on a token signed with the site’s keys, verified against a live session. It cannot be forged, it does not survive your logout, and if your account loses its rights during the test, the door closes. You can therefore use it on a production site without a second thought.

Free

Capabilities by content type and role, account testing, restricted pages, menu hiding by level

Pro

Custom roles, menu exceptions by role, placement of roles added by plugins

On the blog

Our guides: WordPress user roles

Guides · 5 min read

Hacked WordPress site: steps to clean it and prevent reinfection

Your WordPress site has been hacked: this guide gives you the order of operations to clean it up without leaving a backdoor, and then to prevent it from being reinfected. It also details what nexya does to secure the site afterward, and what it does not do, since it does not clean up malware.

  • nexya does not clean up malware: cleanup is done manually, with your host, a specialized tool, or a professional.
  • Close the site and export the database before touching the files; the Maintenance module does both.
  • Replace the core, plugins, and themes with official copies rather than searching for infected files one by one.

Read the post

Behind the scenes · 5 min read

WordPress file integrity, IndexNow, restricted pages: what nexya 1.2.34 brings

nexya 1.2.34 checks the integrity of WordPress core files daily and emails you as soon as a file is modified, missing, or out of place. It also answers several frequently asked questions on the forums: a hacked site, search engines notified too late, a multilingual homepage that no longer bypassed the cache.

  • Every day, the Security module compares WordPress core files to the originals from wordpress.org and sends an email in case of a discrepancy.
  • nexya reports modified, missing, or foreign files, but does not clean up malware.
  • IndexNow notifies Bing, Yandex, and other participating engines. Google is not part of it, and nothing can force its indexing.

Read the post

Guides · 3 min read

WordPress Activity Log: knowing who changed what, with before and after

A WordPress activity log tells you who modified what on the site, and shows you the before value next to the after value. This lets you know what happened in seconds, without digging through revisions or questioning the whole team.

  • nexya's activity log indicates who modified what, with the before and after values.
  • ACF fields are tracked like the rest of the content.
  • The log is free. Rollback from the log and longer retention are part of nexya Pro.

Read the post

Get started

nexya roles in three steps

  1. Switch on nexya roles In the nexya hub.
  2. Read the capabilities by content type Each capability sits under what created it, with its real name.
  3. Test the client’s account See the site through their eyes for a click, then come back to yours.

nexya roles is in the free extension, on as many sites as you want.

Get the free version View pricing

FAQ

Everything about nexya roles

Open nexya roles: permissions are grouped by content type and taxonomy, and each box is checked role by role. No more guessing what "edit_others_posts" means.

Account testing opens the site with the chosen account, without a password and without a second browser. A button brings you back to your own account.

Yes: each entry is hidden starting from a role level, including menus from plugins that didn't provide their own permission. The hidden page also rejects its direct address, not just its link. With Pro, you can add role-by-role exceptions.

These plugins display a long, flat list of permissions. nexya roles organizes them under the content type they belong to, and adds account testing and menu hiding in the same screen.

Yes, with Pro: start from an existing role and remove what does not concern the job, for example a “shop manager”.

Yes, or to certain roles or accounts. Others go to the login or read a message, and the page leaves the sitemap and search.

Yes: the hidden page also refuses its direct address, not just its link in the menu.

Yes, with nexya activities: the start and end of each test appear in the log, with the admin who did it.

The suite

Other modules

nexya Checkout

Pro

A step-by-step WooCommerce order, on a page of its own, with the cart on the side and suggestions at the right moment.

nexya Invoice

Pro

WooCommerce PDF invoices in your colours, attached to the e-mails, with the Swiss QR-bill at the bottom of the page.

nexya forms

Pro

Forms built field by field, with conditions and in multiple steps — paid online if needed, and every response saved on the site.

nexya translate

The site in several languages, WooCommerce shop included: every content with its versions, one address per language, and the site’s texts translated in one place.

nexya popup

Popups built section by section, opening at the right time — and which, with Pro, can close the shop and forms while they are active.

nexya custom fields

Fields that belong to you, stored in their own tables — and read in a single query per page.

nexya aris

Audience figures measured by the site itself — without Google, without Matomo, without any stored IP address.

nexya mailya

Pro

Newsletters written on the WordPress site, with your articles inside — sent in the background, at the pace your server can handle.

nexya media

Background thumbnail regeneration, in batches, that continues even when you close the tab — and notifies you when it's finished. With Pro, folders to organize your media library.

nexya hub

The dashboard that brings together all nexya extensions. One module you turn on, one module you turn off — and nothing runs on the WordPress site while it's off

nexya dashboard

The WordPress administration as the client sees it: menus reduced to the essentials, the admin bar tidied up — and, with Pro, dashboard colors all the way to the login page

nexya shortcuts

Duplicate, reorder, add — three actions performed on WordPress content lists so you never have to do them by hand again

nexya activities

Who changed what on the WordPress site, and when. Down to the ACF fields, with the before and after values — and, with Pro, the rollback button

nexya cookie

Cookie consent, and the blocking that goes with it. Nothing runs before the visitor agrees — no scripts, no embedded videos, no remote fonts

nexya seo

What the WordPress site tells search engines about itself — and what it displays when you paste its address somewhere. Written once, applied everywhere, verifiable before publishing

nexya mail

WordPress site emails actually get sent — and we know which ones didn't, with the exact reason provided by the SMTP server

nexya redirects

404 errors identified during visits, along with the number of hits to know which ones matter, and the 301 redirection that fixes them. With Pro, the target is suggested before you even look for it.

nexya security

Setting up HTTP security headers without breaking the site, monitoring vulnerabilities in active WordPress extensions, and tracking file changes

nexya maintenance

Operations performed on the WordPress site, but not within it: closing it during maintenance, streamlining its database, making a backup

nexya performance

What each page costs the site, and the settings that lighten it: a query monitor on every page, options loaded on each visit, the Heartbeat, revisions

nexya cache

Pro

Every page kept as a file and served to the next visitor before WordPress loads — then discarded as soon as something changes it.