Not every page is for public eyes — internal SOPs, server notes, draft policies. WordPress can lock content so only administrators see it, and the right method depends on whether you’re hiding a whole page, a whole category, or just one secret line inside an otherwise public post.
current_user_can('manage_options') shortcode. Match the method to the scope: whole page, whole category, or inline snippet.WordPress’s permission model already knows who’s an administrator; these three methods just decide where that check applies. Here they are, smallest scope of tooling first.
Built-in toggle. Hides a post from everyone below Editor. Fast, plugin-free — but visible to Editors too, not admin-only.
Members or User Role Editor + a content-permissions box. Role-precise (admins only, exclude Editors), whole categories at once.
Wrap one line in a current_user_can check. Post stays public; the secret shows only to admins.
Table of Contents
Method 1: the Private visibility toggle (no plugin)
The fastest way to hide a single document, built into WordPress:
- Open the post or page.
- In the sidebar under Status & Visibility, click the link next to Visibility (it says “Public”).
- Choose Private and confirm, then Update.
A Private post is visible only to Administrator and Editor roles; for everyone else it vanishes from search, feeds, and navigation. That’s the catch worth knowing: Private includes Editors, not admins only — if you must exclude Editors too, use Method 2.
“Private” hides a post from everyone below Editor — quick and plugin-free, but it’s not admin-only.
Method 2: a roles plugin (granular and bulk)
When you need role-precise control (admins only, excluding Editors) or you’re restricting many documents, install Members or User Role Editor from the plugin repository. Each adds a Content Permissions box to the editor:
- Open the document and scroll to the Content Permissions box.
- Check the role(s) allowed to view it — e.g. Administrator only.
- Optionally set a custom “access denied” message for anyone who hits the direct URL.
This is the right tool when “hide this” becomes “hide this whole class of documents from these specific roles” — a policy you don’t want to re-apply post by post.
Method 3: a shortcode for part of a public post
Sometimes the page is public but one line isn’t — a license key, an internal phone number. Wrap just that part in a capability-checked shortcode. Add the shortcode once (a code-snippets plugin, a site-specific plugin, or functions.php — a textbook snippet-over-a-plugin case):
// [admin_only]…[/admin_only] — shows the wrapped content only to users who can manage the site.
add_shortcode( 'admin_only', function ( $atts, $content = '' ) {
return current_user_can( 'manage_options' ) ? do_shortcode( $content ) : '';
} );
Code language: PHP (php)Then in the editor, sandwich the private text:
[admin_only]
Server key: (visible to admins only)
[/admin_only]Code language: CSS (css)manage_options is the capability only administrators have by default, so the wrapped block renders for them and disappears for everyone else — while the rest of the post stays public.
Public post, private line: a capability-checked shortcode hides one secret without hiding the whole page.
Which method to use
Match the method to the scope of what you’re hiding:
- One page, quickly → Private visibility.
- A whole category of documents, or role-precise rules → a roles plugin (Members / User Role Editor).
- A secret inside an otherwise public post → the
admin_onlyshortcode.
A note on expectations: these control display and access to rendered content, which is what you want for internal docs and secrets. They are not a substitute for real secrets management — genuine credentials belong in a password manager or vault, not in a post, even a Private one.
The short version
To restrict WordPress content to admins, pick by scope. A whole page: set Visibility → Private (built in; visible to Editors too, so not strictly admin-only). Many documents or role-exact rules: a roles plugin (Members or User Role Editor) and its content-permissions box. One secret line in a public post: an admin_only shortcode gated on current_user_can('manage_options'). And remember these gate content display, not secrets — real credentials belong in a vault, not a post.
Frequently Asked Questions
Does “Private” visibility make a post admin-only?
Not quite — a Private post is visible to both Administrators and Editors, and hidden from everyone below that (and from search and menus). If you need to exclude Editors too, use a roles plugin with a content-permissions rule for Administrator only.
How do I hide just part of a post from non-admins?
Wrap that part in a capability-checked shortcode. Register an [admin_only] shortcode that returns its content only when current_user_can('manage_options') is true, then sandwich the private text in the editor. The rest of the post stays public.
Do I need a plugin to restrict content to admins?
No, for simple cases. The built-in Private visibility handles a single page with no plugin, and a small shortcode snippet handles inline secrets. A roles plugin (Members, User Role Editor) is only needed for granular, role-precise, or bulk restrictions.
What’s the difference between Members and User Role Editor?
Both add role-based content permissions; Members leans toward managing roles and capabilities site-wide with a per-content permissions box, while User Role Editor focuses on editing what each role can do. For admin-only content either works — pick the one whose interface you prefer.
Is restricting content the same as securing secrets?
No. These methods control who can view rendered content, which suits internal docs. They don’t encrypt or securely store anything — real credentials (API keys, passwords) belong in a password manager or secrets vault, never pasted into a post, even a Private one.
