Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/uams-web/uamswp-auditor-role/archive/refs/heads/main.zipA must-use WordPress plugin that registers a read-only Auditor role, so a person can review content, site structure, templates, plugins and settings on a UAMS install without Administrator or Super Admin rights.
Viewing is not the same as changing. The role holds enough capabilities to open settings screens, so a default-deny guard refuses every write the role could make, and an activity log records what each auditor opened. The design decisions are in docs/DECISIONS.md; the work is tracked in this repository's issues.
Status: built and verified on a local multisite. Not yet rolled out (#23). Deploy with docs/DEPLOY.md.
How it works
The role holds manage_options so settings screens open, which means capabilities alone cannot keep it read-only. Four guard layers do, each default-deny:
| Layer | Where | What it refuses |
|---|---|---|
| Requests | RequestGuard |
Every non-read request (POST, PUT, PATCH, DELETE), anywhere on the site, including the REST API after a _method override; admin-post.php; options.php; XML-RPC sign-in; admin GETs carrying an acting action or a nonce outside a list table's filter form; screens that write on load (post-new.php, update.php); the network admin. |
| AJAX | RequestGuard |
Every admin-ajax.php action not on a short list verified read-only in core. |
| Capabilities | MetaCaps |
Every never-granted capability and every acting meta capability (activate_plugin, delete_post, create_app_password, ...), mapped to do_not_allow. |
| Database | DatabaseGuard |
Every statement that is not a read, through the query filter, during an Auditor session. The plugin's own writes (its log, the session token, adding a configured login) pass through DatabaseGuard::bypass(). |
Screens whose viewing is the exposure (raw options, exports, form entries, mail and deploy settings, license keys, the Site Health info tab) are hidden from the menu and refused by URL (Screens).
The compensating controls: an activity log per site (Log), an administrator-only viewer under Tools > Auditor log with filters, CSV export and a retention setting (LogViewer, Retention), an optional end date per account (Account), and a Read-only audit mode badge in the admin bar (AdminBar).
Filters
| Filter | Changes |
|---|---|
uamswp_auditor_role_capabilities |
The capabilities the role holds. A never-granted one is dropped. |
uamswp_auditor_role_denied_caps |
Adds capabilities denied to the role. |
uamswp_auditor_role_hidden_screens |
The hidden screens: page:<slug> or ` |