Lock the List of Super Admins
Blocks anyone from being granted super admin rights unless their username is on your approved list, protecting the network if a super admin account is compromised.
Opens WPIDE on
Code
if ( ! is_multisite() ) {
return;
}
$wpide_allowed = array( 'admin' ); // Usernames allowed to be super admins.
add_action( 'grant_super_admin', function ( $user_id ) use ( $wpide_allowed ) {
$user = get_userdata( $user_id );
if ( ! $user || ! in_array( $user->user_login, $wpide_allowed, true ) ) {
wp_die( esc_html__( 'This user is not on the approved super admin list.' ), 403 );
}
} );Notes
Add every legitimate super admin to $wpide_allowed before activating, or new grants will be refused.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.