Dhanendran Rajagopal

Readministrator adds a “Read Only Administrator” role. Assign it to a user and they can browse the entire wp-admin like an administrator — Settings, Users, Plugins, Themes, content, comments and more — but they cannot change anything. Every write is blocked at the capability layer.
What read-only administrators can do:
<ul>
<li>View every admin screen an administrator can see.</li>
<li>Browse Settings, Tools, Users, Plugins, Themes and content lists.</li>
<li>Run a read-only export.</li>
</ul>
What they cannot do:
<ul>
<li>Save any Settings page (core or plugin Settings API).</li>
<li>Create, edit, publish, trash or delete posts, pages or media.</li>
<li>Add, edit, delete or promote users (including editing their own profile).</li>
<li>Activate, deactivate, install, update, delete or edit plugins.</li>
<li>Switch, install, update, delete or edit themes.</li>
<li>Edit menus, widgets or the Customizer.</li>
<li>Moderate or edit comments.</li>
<li>Make changes through the REST API (the block editor included).</li>
</ul>
<h4>Known limitations</h4>
Enforcement covers core write paths plus the REST API. A small residual surface remains: some third-party plugins that perform writes through their own custom <code>admin-ajax</code>/<code>admin-post</code> handlers, and Network Admin (multisite) screens, are not yet covered. These are on the roadmap.

Readministrator (Read Only Administrator)

A read-only administrator role — users can view the entire wp-admin like an admin but cannot change anything.

telchar

Read Only Mode – Telchar HiveLock freezes an already working site by restricting persistent WordPress actions while keeping the site online, browsable, and accessible to administrators.
While freeze mode is enabled:
<ul>
<li>Frontend browsing continues to work.</li>
<li>Administrators can still log in. All users can still log out.</li>
<li>Administrators can still access the dashboard.</li>
<li>Administrators can return to the plugin page and disable the freeze.</li>
<li>Standard WordPress-level persistent changes are blocked.</li>
</ul>
This plugin is designed for already-finished sites that should stay online and readable without allowing routine changes, uploads, updates, or content edits until an administrator intentionally unfreezes the site again.
It is not a maintenance mode plugin. Its purpose is to harden finished sites by reducing their WordPress-level attack surface and blocking persistent changes through standard WordPress write routes.
Blocked surfaces include:
<ul>
<li>post, page, attachment, and custom post type writes</li>
<li>taxonomy changes</li>
<li>comment creation and standard moderation changes</li>
<li>option and settings updates</li>
<li>user creation, deletion, and password reset flows</li>
<li>media uploads</li>
<li>plugin, theme, and core file modification flows handled through WordPress</li>
<li>REST write requests across all namespaces, including third-party plugin routes</li>
<li>admin AJAX restricted to a narrow allowlist of safe core read actions, while taxonomy creation requests return a visible error</li>
<li>XML-RPC publishing and pingback-style mutation routes</li>
</ul>
This plugin aims to provide a practical WordPress-level freeze mode. It does not claim to provide absolute immutability, server-level filesystem protection, or protection against every possible vulnerability or every custom plugin write path.

Read Only Mode – Telchar HiveLock

Put your WordPress site in read-only mode — block persistent changes while keeping the site browsable until an administrator disables the freeze.

Readministrator (Read Only Administrator) vs Read Only Mode – Telchar HiveLock