Mandate App Security vs User Access Blocker

WordPress Application Passwords prove identity. They do not limit what an authenticated request can do. If the user behind a password is an admin, every tool that authenticates as that user has admin-level access — with no native way to narrow it. Today, REST clients, automation platforms, AI agents, management tools, and MCP connectors all authenticate with Application Passwords. Any of them, if misconfigured or compromised, can do anything that user can do. Mandate App Security adds the missing layer: a capability policy per Application Password. You define what each credential is allowed to do. Mandate App Security enforces it on every request. Normal wp-admin sessions and user roles are unaffected. Instead of treating every Application Password as equally trusted, Mandate App Security lets administrators and password owners save a capability allowlist per password. An administrator can choose: a WordPress user one of that user’s Application Passwords the capabilities that password should be allowed to use an optional expiration date for that password whether the scope is locked so the password owner can view it but not edit it Users can scope their own Application Passwords when WordPress allows Application Passwords for their account. Only administrators can edit another user’s scope or lock a scope against owner edits. When a request is authenticated with that Application Password, Mandate App Security checks the saved allowlist and removes capabilities that are not allowed for that password. Mandate App Security never grants new permissions. It only narrows an Application Password to capabilities the selected user already receives from assigned roles. If the selected Application Password is past its saved expiration date, Mandate App Security removes all capabilities for that request. Normal browser and wp-admin sessions for the same user are not changed. Example scopes A reporting dashboard that only needs to read posts and media should never be able to edit settings or manage users. A content automation tool that publishes posts has no reason to access WooCommerce orders. An AI writing assistant does not need plugin management access. With Mandate App Security, each of those tools gets a dedicated Application Password scoped to exactly what it needs. Nothing more. Source Code Mandate App Security is available at https://wpmandate.com. The public development repository, release packages, and build documentation are at https://github.com/FernleafSystems/Mandate-for-WordPress.

User Access Blocker is a simple yet powerful WordPress plugin that allows administrators to temporarily or permanently block user access without deleting their accounts. This is perfect for situations where you need to: Suspend user access during investigations Temporarily disable accounts for non-payment Block problematic users while preserving their content Manage user access during maintenance or transitions Key Features Easy Toggle: Simple “Block Access” / “Unblock Access” button on user profiles Instant Effect: Blocked users are immediately prevented from logging in, and any active session is terminated on the spot AJAX Powered: Block/unblock users without page refresh Secure: Multiple permission checks and nonce verification Non-Destructive: User accounts, posts, and data remain intact Admin Only: Only administrators can block/unblock users Self-Protection: Administrators cannot block themselves Activity Logging: All block/unblock actions are logged for security audits Clean Uninstall: Removes all plugin data when deleted How It Works Navigate to any user’s profile page in WordPress admin Scroll to the “User Access Blocker” section Click “Block Access” to prevent the user from logging in — if they are currently logged in, they will be logged out immediately Click “Unblock Access” to restore their access Blocked users will see: “Your access has been blocked by an administrator.” Security Features Administrator-only functionality Nonce verification on all actions Permission checks at multiple levels Data sanitization and validation Secure AJAX implementation XSS protection through proper escaping Activity logging for audit trails Developer Information Hooks and Filters The plugin uses standard WordPress hooks: authenticate – To check if a user is blocked during login show_user_profile / edit_user_profile – To add the block button personal_options_update / edit_user_profile_update – To save block status wp_ajax_uabx_toggle_user_block – For AJAX functionality Database The plugin stores block status in user meta: * Meta key: uabx_user_blocked * Meta value: ‘1’ (blocked) or ‘0’ (not blocked) Uninstall The plugin includes a proper uninstall routine that removes all plugin data from the database when deleted through the WordPress admin. Support For support, feature requests, or bug reports, please visit plugin support forum or GitHub repository. Privacy Policy This plugin does not collect any personal data. It only stores block status as user metadata within your WordPress database. No data is sent to external servers. The plugin logs block/unblock actions to your server’s error log for security audit purposes. These logs remain on your server and are not transmitted elsewhere.