Weston Ruter

This plugin enforces a <a href="https://web.dev/articles/strict-csp" rel="nofollow ugc">Strict Content Security Policy</a> (CSP) on the frontend and login screen. This helps mitigate <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS" rel="nofollow ugc">cross-site scripting</a> (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see <a href="https://core.trac.wordpress.org/ticket/59446" rel="nofollow ugc">#59446</a>).
In <a href="https://core.trac.wordpress.org/ticket/58664" rel="nofollow ugc">#58664</a>, the manual construction of script tags was eliminated from <code>WP_Scripts</code> and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in <a href="https://core.trac.wordpress.org/ticket/39941" rel="nofollow ugc">#39941</a>. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing <code><script></code> tags. Some bundled WordPress core themes <a href="https://github.com/search?q=repo%3AWordPress%2Fwordpress-develop+path%3A%2F%5Esrc%5C%2Fwp-content%5C%2Fthemes%5C%2F%2F+%2F%3Cscript%5B%5E%3E%5D*%3E%2F&type=code" rel="nofollow ugc">still do this</a> incorrectly (which has been reported in Trac as <a href="https://core.trac.wordpress.org/ticket/63806" rel="nofollow ugc">#63806</a>). For example, do not do this:
<pre>function my_theme_supports_js() {
 echo '<script>document.body.classList.remove("no-js");</script>'; // ❌
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
Instead, do this:
<pre>function my_theme_supports_js() {
 wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅
}
add_action( 'wp_footer', 'my_theme_supports_js' );</pre>
So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script/" rel="nofollow ugc"><code>wp_enqueue_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_add_inline_script/" rel="nofollow ugc"><code>wp_add_inline_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_localize_script/" rel="nofollow ugc"><code>wp_localize_script()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_script_tag/" rel="nofollow ugc"><code>wp_print_script_tag()</code></a>, <a href="https://developer.wordpress.org/reference/functions/wp_print_inline_script_tag/" rel="nofollow ugc"><code>wp_print_inline_script_tag()</code></a>, and <a href="https://developer.wordpress.org/reference/functions/wp_enqueue_script_module/" rel="nofollow ugc"><code>wp_enqueue_script_module()</code></a>. Otherwise, a script’s execution will be blocked and an error will appear in the console, for example:
<blockquote>
Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list.
</blockquote>
This also blocks scripts inside of <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes#event_handler_attributes" rel="nofollow ugc">event handler attributes</a>, such as <code>onclick</code>, <code>onchange</code>, <code>onsubmit</code>, and <code>onload</code>. As noted on MDN:
<blockquote>
Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies.
</blockquote>
This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the <code>nonce</code> attribute added.

Strict CSP

Enforces a Strict Content Security Policy on the frontend and login screen to help mitigate any XSS vulnerabilities.

Vladimir Garagulya

User Role Editor WordPress plugin allows you to change user roles and capabilities easy. 
Just turn on check boxes of capabilities you wish to add to the selected role and click “Update” button to save your changes. That’s done. 
Add new roles and customize its capabilities according to your needs, from scratch of as a copy of other existing role. 
Unnecessary self-made role can be deleted if there are no users whom such role is assigned. 
Role assigned every new created user by default may be changed too. 
Capabilities could be assigned on per user basis. Multiple roles could be assigned to user simultaneously. 
You can add new capabilities and remove unnecessary capabilities which could be left from uninstalled plugins. 
Multi-site support is provided.
To read more about ‘User Role Editor’ visit <a href="https://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">this page</a>
Do you need more functionality with quality support in a real time? Do you wish to remove advertisements from User Role Editor pages? 
<a href="https://www.role-editor.com" rel="nofollow ugc">Buy Pro version</a>. 
<a href="https://www.role-editor.com" rel="nofollow ugc">User Role Editor Pro</a> includes extra modules:
<ul>
<li>Block selected admin menu items for role.</li>
<li>Hide selected front-end menu items for no logged-in visitors, logged-in users, roles.</li>
<li>Block selected widgets under “Appearance” menu for role.</li>
<li>Show widgets at front-end for selected roles.</li>
<li>Block selected meta boxes (dashboard, posts, pages, custom post types) for role.</li>
<li>“Export/Import” module. You can export user role to the local file and import it to any WordPress site or other sites of the multi-site WordPress network.</li>
<li>Roles and Users permissions management via Network Admin for multisite configuration. One click Synchronization to the whole network.</li>
<li>“Other roles access” module allows to define which other roles user with current role may see at WordPress: dropdown menus, e.g assign role to user editing user profile, etc.</li>
<li>Manage user access to editing posts/pages/custom post type using posts/pages, authors, taxonomies ID list.</li>
<li>Per plugin users access management for plugins activate/deactivate operations.</li>
<li>Per form users access management for Gravity Forms plugin.</li>
<li>Shortcode to show enclosed content to the users with selected roles only.</li>
<li>Posts and pages view restrictions for selected roles.</li>
<li>Admin back-end pages permissions viewer</li>
</ul>
Pro version is advertisement free. Premium support is included.
<h3>Additional Documentation</h3>
You can find more information about “User Role Editor” plugin at <a href="http://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">this page</a>
I am ready to answer on your questions about plugin usage. Use <a href="http://www.shinephp.com/user-role-editor-wordpress-plugin/" rel="nofollow ugc">plugin page comments</a> for that.

User Role Editor


Más sencillo de usar que otros plugins similares y me ha solucionado un problema que no podía solucionar con otro plugin similar.



Con otro plugin muy parecido tuve el problema de que no distinguía entre mayúsculas y minúsculas, con lo que asignaba mal las "capabilities" si estás tenían mayúsculas.



Con este plugin, problema resuelto.


Ha funcionado donde otros no


A powerfull, logical, native approach to capabilities and roles, without the need to code it all. Great stuff. Probably the best solution out there.


Amazing plugin


Really awesome plugin. I use it for my website. Where lot of customer of CodeAstrology.


Awesome plugin - I use it for my site

User Role Editor WordPress plugin makes user roles and capabilities changing easy. Edit/add/delete WordPress user roles and capabilities.

Strict CSP vs User Role Editor