User capability checks in Wordpress - Step-by-Step Execution

Concept Flow - User capability checks

Start: User requests action

↓

Check user logged in?

No→Deny access or redirect

Yes↓

Check user capability with current_user_can()

↓

Allow action

↓

End

This flow shows how WordPress checks if a user is logged in and has the right capability before allowing an action.

Execution Sample

Wordpress

<?php
if ( is_user_logged_in() && current_user_can('edit_posts') ) {
  echo 'You can edit posts.';
} else {
  echo 'Access denied.';
}
?>

This code checks if the user is logged in and can edit posts and shows a message accordingly.

Execution Table

Step	Action	Evaluation	Result
1	Check if user is logged in	User logged in = true	Proceed to capability check
2	Call current_user_can('edit_posts')	User has 'edit_posts' capability = true	Allow action
3	Execute echo 'You can edit posts.'	Output message	Message shown to user
4	End	No more code	Execution stops

💡 Execution stops after showing message based on capability check

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
user_logged_in	unknown	true	true	true
user_can_edit_posts	unknown	unknown	true	true
output_message	empty	empty	'You can edit posts.'	'You can edit posts.'

Key Moments - 2 Insights

Why does the code check if the user is logged in before checking capabilities?

Because capabilities only apply to logged-in users. The execution_table row 1 shows the login check before capability check.

What happens if current_user_can() returns false?

The else branch runs, showing 'Access denied.' as in the execution_table rows 2 and 3 if the condition was false.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of user_can_edit_posts at Step 2?

A false

B true

C unknown

D null

💡 Hint

Check the variable_tracker row for user_can_edit_posts at After Step 2

At which step does the code decide to show 'You can edit posts.'?

A Step 3

B Step 2

C Step 1

D Step 4

💡 Hint

Look at execution_table row 3 where echo is executed

If the user was not logged in, what would happen according to the concept_flow?

A Show 'You can edit posts.' message

B Allow action anyway

C Deny access or redirect

D Skip capability check and continue

💡 Hint

See concept_flow step after 'Check user logged in?' with No branch

Concept Snapshot

Use current_user_can('capability') to check if a logged-in user has permission.
Always check if user is logged in before capability.
If check passes, allow action; else deny or show error.
Common capabilities: 'edit_posts', 'publish_posts', 'manage_options'.
This protects sensitive actions from unauthorized users.

Full Transcript

This lesson shows how WordPress checks if a user can do something using user capability checks. First, WordPress checks if the user is logged in. If not, it denies access or redirects. If logged in, it uses current_user_can() to check if the user has the needed capability, like 'edit_posts'. If yes, the action is allowed and a message is shown. If no, access is denied. The example code checks if the user can edit posts and shows a message accordingly. Variables like user_logged_in and user_can_edit_posts track the state. Key points include always checking login before capabilities and handling both allowed and denied cases. The quizzes test understanding of variable values at steps and flow decisions. This helps keep WordPress sites secure by controlling user permissions carefully.