User capability checks in Wordpress - Mini Project: Build & Apply

User Capability Checks in WordPress

📖 Scenario: You are building a WordPress plugin that shows a special message only to users who have the capability to edit posts. This is common when you want to restrict certain features to editors or administrators.

🎯 Goal: Create a simple WordPress plugin that checks if the current user has the edit_posts capability and displays a message accordingly.

📋 What You'll Learn

Create a function to check user capability

Use the WordPress function current_user_can()

Display a message only if the user can edit posts

Hook the function to the the_content filter to modify post content

💡 Why This Matters

🌍 Real World

Many WordPress sites need to show or hide features based on what the user is allowed to do. This project teaches how to check those permissions safely.

💼 Career

Understanding user capability checks is essential for WordPress developers creating plugins or themes that respect user roles and security.

1

Create the plugin header and basic function

Create a PHP file with the plugin header comment and define a function called show_edit_post_message that accepts one parameter $content. For now, just return the $content unchanged.

Wordpress

<?php
/*
Plugin Name: User Capability Check
Description: Shows a message if user can edit posts.
Version: 1.0
Author: Your Name
*/

function show_edit_post_message($content) {
    // Your code here
    return $content;
}

Hint

Start by creating the plugin header comment and a function that returns the content unchanged.

2

Add a capability check variable

Inside the show_edit_post_message function, create a variable called $can_edit and set it to the result of current_user_can('edit_posts').

Wordpress

<?php
/*
Plugin Name: User Capability Check
Description: Shows a message if user can edit posts.
Version: 1.0
Author: Your Name
*/

function show_edit_post_message($content) {
    $can_edit = current_user_can('edit_posts');
    // Your code here
    return $content;
}

Hint

Use current_user_can('edit_posts') to check if the user can edit posts and store it in $can_edit.

3

Add conditional logic to modify content

Use an if statement to check if $can_edit is true. If yes, append the string '

You can edit posts!

' to the $content variable before returning it.

Wordpress

<?php
/*
Plugin Name: User Capability Check
Description: Shows a message if user can edit posts.
Version: 1.0
Author: Your Name
*/

function show_edit_post_message($content) {
    $can_edit = current_user_can('edit_posts');
    if ($can_edit) {
        // Your code here
    }
    return $content;
}

Hint

Use if ($can_edit) and append the message to $content using .=.

4

Hook the function to the content filter

Add a line after the function to hook show_edit_post_message to the the_content filter using add_filter.

Wordpress

You can edit posts!';
    }
    return $content;
}

// Your code here

Hint

Use add_filter('the_content', 'show_edit_post_message'); to connect your function to WordPress content display.

Practice

1. What is the main purpose of the current_user_can() function in WordPress?

easy

A. To check if the current user has a specific capability

B. To create a new user role

C. To delete a user from the database

D. To update the user's profile information

Solution

1. Step 1: Understand the function's role

   current_user_can() is designed to check permissions for the current user.

2. Step 2: Identify correct usage

   It returns true if the user has the capability passed as an argument, otherwise false.

3. Final Answer:

   To check if the current user has a specific capability -> Option A

4. Quick Check:

   Permission check = A [OK]

Hint: Remember: current_user_can checks permissions, not user creation [OK]

Common Mistakes:

• Confusing capability check with user creation
• Thinking it modifies user data
• Assuming it deletes users

2. Which of the following is the correct syntax to check if the current user can edit posts?

easy

A. current_user_can(edit_posts);

B. current_user_can['edit_posts'];

C. current_user_can('edit_posts');

D. current_user_can->edit_posts();

Solution

1. Step 1: Identify correct function call syntax

   WordPress functions use parentheses and string arguments in quotes.

2. Step 2: Check each option

   Only current_user_can('edit_posts'); uses parentheses and quotes correctly.

3. Final Answer:

   current_user_can('edit_posts'); -> Option C

4. Quick Check:

   Function call with string argument = B [OK]

Hint: Use parentheses and quotes for capability strings [OK]

Common Mistakes:

• Omitting quotes around capability
• Using square brackets instead of parentheses
• Using arrow notation incorrectly

3. What will the following code output if the current user cannot delete posts?

if (current_user_can('delete_posts')) {
  echo 'Can delete posts';
} else {
  echo 'Cannot delete posts';
}

medium

A. Can delete posts

B. No output

C. Error: function not found

D. Cannot delete posts

Solution

1. Step 1: Understand the condition

   The if checks if the user has 'delete_posts' capability.

2. Step 2: Evaluate the condition result

   If the user cannot delete posts, the condition is false, so the else block runs.

3. Final Answer:

   Cannot delete posts -> Option D

4. Quick Check:

   False condition triggers else = D [OK]

Hint: If user lacks capability, else block runs [OK]

Common Mistakes:

• Assuming output is always 'Can delete posts'
• Confusing capability names
• Expecting errors if capability missing

4. Identify the error in this code snippet:

if (current_user_can('edit_post')) {
  echo 'User can edit post';
}

medium

A. Missing semicolon after echo statement

B. The capability name should be 'edit_posts' not 'edit_post'

C. current_user_can() requires two arguments

D. The function should be called as currentUserCan()

Solution

1. Step 1: Check capability name correctness

   WordPress uses 'edit_posts' (plural) as the capability, not 'edit_post'.

2. Step 2: Verify syntax and function usage

   Semicolon is present, function takes one argument, and function name is correct.

3. Final Answer:

   The capability name should be 'edit_posts' not 'edit_post' -> Option B

4. Quick Check:

   Correct capability string = A [OK]

Hint: Check exact capability names in WordPress docs [OK]

Common Mistakes:

• Using singular instead of plural capability names
• Assuming function needs multiple arguments
• Incorrect function name casing

5. You want to show a special admin menu only to users who can manage options and edit themes. Which code correctly checks both capabilities before showing the menu?

hard

A. if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); }

B. if (current_user_can('manage_options' || 'edit_themes')) { show_menu(); }

C. if (current_user_can(['manage_options', 'edit_themes'])) { show_menu(); }

D. if (current_user_can('manage_options') || current_user_can('edit_themes')) { show_menu(); }

Solution

1. Step 1: Understand logical AND for both capabilities

   To require both permissions, use && between two separate current_user_can() calls.

2. Step 2: Evaluate each option's logic

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } correctly uses && with two calls; A and B misuse syntax; D uses || which allows either permission.

3. Final Answer:

   if (current_user_can('manage_options') && current_user_can('edit_themes')) { show_menu(); } -> Option A

4. Quick Check:

   Both capabilities require && = C [OK]

Hint: Use && with separate calls to check multiple capabilities [OK]

Common Mistakes:

• Using || instead of && when both permissions are needed
• Passing multiple capabilities as one argument
• Using incorrect syntax for logical operators