Skip to content

Early-bird lifetime licence: $199 once, for the first 200 buyers only. See the offer

All docs

Team access Pro

Pro · This feature is part of Snipfire Pro. Plans

By default only administrators can use Snipfire. Team access lets you give other WordPress roles a level of their own: a designer who edits CSS and JavaScript without touching PHP, or a client who can see what's running but change nothing.

The four levels

Level Can do
No access (default) Nothing. Snipfire doesn't appear for them
View only See snippets, their history and the activity log. Good for clients
CSS, JS and HTML (no PHP) Create and edit stylesheets, scripts and HTML on the public site. PHP snippets, HTML containing PHP, admin-area and login-page locations, and custom hooks stay read-only. No imports or settings
Full, including PHP Everything, including PHP, imports and settings

Administrators always have full access, so nobody can lock the site owner out.

Set it up

Go to Snipfire → Tools & Safe Mode → Team access, pick a level for each role, and click Save team access.

Want a level for one person rather than a whole role? Create a role for it with a role-editor plugin, or see the snipfire_user_access filter in PHP hooks.

Only give editing access to people you trust like an administrator. JavaScript on the public site also runs for administrators who visit it, so it can be used to act as them. Full access runs PHP on your server.

What each person sees

The editor adapts to the level:

  • View only: everything is read-only. The editor says You can view snippets but not change them.
  • CSS, JS and HTML: new snippets can only be HTML, CSS or JavaScript, and only public-site locations are offered. A read-only snippet says why, for example PHP snippets can only be changed by people with full Snipfire access. or This HTML snippet contains PHP, which only people with full Snipfire access can change.
  • CSS, JS and HTML people can also use the Header & Footer screen (without PHP) and install the CSS, JavaScript and HTML snippets from the snippet library. Tools & Safe Mode is for full access only.
  • Menus and buttons they can't use are hidden.

Enforced on the server

The editor only hides what people can't do; the server decides. Every change through the editor, the classic screens and the REST API is checked against the person's level, for the snippet as it is and as it would be after the change. So someone with CSS, JS and HTML access can't:

  • paste <?php (or <?=, <?) into an HTML snippet,
  • change a CSS snippet's type to PHP,
  • restore an old version that was PHP,
  • move a snippet to an admin or login location, or a custom hook,
  • switch on, delete or duplicate a PHP snippet.

WP-CLI and Snipfire's own automatic actions (such as switching off a snippet after an error) aren't limited.

Multisite

On a multisite network, full access is only for super admins. Every role, including Administrator, can be given No access, View only or CSS, JS and HTML: Site administrators get the level you set for the Administrator role.

Changes are logged

Changes to team access are recorded in the activity log, with who made them.

From the command line 

wp snipfire access                     # the level of each role
wp snipfire access set editor design   # none, view, design or full
wp snipfire access check jane          # what a user can do

Something unclear or missing? Tell us