1M Restrict Plugin Install

A lightweight WordPress plugin that lets a single "owner" administrator control which other administrators are allowed to install new plugins. Unchecked administrators can still update existing plugins, but cannot install, upload, delete, or edit plugin files.

• Contributors: 1M Studios
• Requires at least: WordPress 5.0
• Tested up to: 6.6
• Requires PHP: 7.4
• Version: 1.0.0
• License: GPL v2 or later
• License URI: https://www.gnu.org/licenses/gpl-2.0.html

Why this plugin exists

WordPress ships with a single administrator role, and every admin can install any plugin they like. On multi-admin sites this is a problem: any admin can introduce untested, insecure, or unlicensed code with two clicks. This plugin locks new-plugin installation to an explicit allow-list, while keeping the site's security posture healthy by not blocking plugin updates.

What it does

For any administrator not on the allow-list, the following capabilities are revoked:

UI is also cleaned up: the "Upload Plugin" button and tab on Plugins → Add New are hidden for unauthorised admins.

Owner model

The first administrator to activate the plugin becomes its "owner". Only the owner can:

• See the Settings → Plugin Install Access menu item.
• Load the settings page (direct URL access is denied for other admins).
• Modify the allow-list.

The owner is always retained on the allow-list on save, preventing accidental lockout.

If the plugin was activated before the owner logic was introduced, the first administrator to visit the settings page after the update is claimed as the owner.

Installation

1. Copy the 1m-restrict-plugin-install folder into wp-content/plugins/.
2. In the WordPress admin, go to Plugins → Installed Plugins.
3. Activate 1M Restrict Plugin Install while logged in as the administrator who should be the owner.
4. Go to Settings → Plugin Install Access.
5. Check the administrators who should be allowed to install new plugins, and save.

Usage

• Visit Settings → Plugin Install Access (owner only).
• All accounts with the administrator role are listed with a checkbox, name, username, and email.
• Ticked admins retain full plugin management. Unticked admins are restricted per the table above.
• Save changes to apply immediately — no cache flush or logout required.

Safety notes

• Empty allow-list disables restrictions. If no boxes are checked and the list is saved as empty (or the plugin has just been activated and never configured), the capability filter takes no action. This is a deliberate lockout safeguard for fresh installs.
• The owner is always kept on the allow-list on save.
• On uninstall (delete via Plugins → Installed Plugins → Delete), both the allow-list and owner options are removed cleanly.

Frequently asked questions

What happens if the owner is deleted from WordPress? The settings page becomes inaccessible via the menu. To recover, delete the rpi_owner_user_id option from the wp_options table (via phpMyAdmin, WP-CLI, or a snippet). The next administrator to visit the settings page will be claimed as the new owner.

Can a non-owner admin bypass this by editing plugin files or the database? Any administrator with database or filesystem access can bypass any WordPress-level capability restriction. This plugin is a guardrail against accidental or casual misuse, not a hard security boundary against an already-privileged actor with server access.

Does this affect Must-Use (MU) plugins or drop-ins? No. MU plugins live in wp-content/mu-plugins/ and are installed via the filesystem — they don't use install_plugins.

Does this work in Multisite? It hasn't been tested against Multisite (network admin caps differ). Use with caution on network installs.

Changelog

1.0.0

• Initial release.
• Per-admin allow-list stored in rpi_allowed_admin_ids.
• Owner model stored in rpi_owner_user_id, seeded on activation or first settings-page visit.
• Capability filter revokes install_plugins, upload_plugins, delete_plugins, and edit_plugins for unchecked admins while preserving update_plugins.
• "Upload Plugin" button and tab hidden on plugin-install.php for unauthorised users.
• Clean uninstall via register_uninstall_hook.

License

This plugin is licensed under the GNU General Public License v2.0 (or later). See LICENSE for the full text, or https://www.gnu.org/licenses/gpl-2.0.html.