Build custom WordPress admin pages
Backend Pages Generator lets you create custom wp-admin screens with HTML, CSS, JavaScript and optional PHP, then place them directly inside the WordPress admin menu.
- Create standalone admin menu entries or nested submenu pages.
- Write HTML, CSS, JavaScript and optional PHP in dedicated editors.
- Restrict each page by WordPress role or individual user.
- Keep PHP execution disabled until you explicitly enable it.
What does Backend Pages Generator do?
Backend Pages Generator creates real custom pages inside the WordPress administration area. Each page can contain its own HTML, CSS, JavaScript and optional PHP, use a custom title, slug and Dashicon, and appear as a standalone menu entry or submenu. Access can be opened to every logged-in user or restricted by role or individual user account.
A one-off admin page usually means writing custom code
WordPress gives developers APIs for creating admin pages, but it does not provide a built-in visual interface for creating arbitrary custom wp-admin screens.
A simple page still needs development work
Client instructions, internal dashboards or small administrative tools normally require custom PHP that registers a menu page and renders its output.
The setup can be larger than the page itself
A small internal screen may need only a few lines of markup or JavaScript, yet implementing it traditionally still means creating and maintaining custom plugin or theme code.
Create the page directly inside wp-admin
Backend Pages Generator provides one manager for creating the page, writing its code, choosing its menu position and deciding who can see it.
Four dedicated code editors
Store HTML, CSS, JavaScript and PHP separately for each custom admin page using WordPress's built-in code editor interface.
Real WordPress admin pages
Saved pages are registered through the normal WordPress admin menu APIs and receive their own admin URL and menu entry.
Per-page visibility
Make a page available to every logged-in user, selected WordPress roles or a specific list of user accounts.
Everything needed to build a custom admin screen
The module combines page content, menu registration, visibility and optional server-side execution in one interface.
HTML, CSS, JavaScript and PHP
Every custom page stores four independent code fields, allowing anything from static instructions to an interactive administrative tool.
Flexible menu placement
Create a standalone top-level item, place the page below TheOneWP or attach it below another existing WordPress admin menu.
Custom title, slug and icon
Every page gets its own title, sanitized URL slug and selectable Dashicon. The standard admin page heading can also be hidden.
Role and user targeting
Restrict individual pages to selected roles or specific user IDs, while unrestricted pages remain available to logged-in users.
PHP execution disabled by default
PHP can be stored with a page without being executed. A separate global setting must be explicitly enabled before PHP blocks can run.
Emergency PHP Safe Mode
Defining TOWP_BPG_SAFE_MODE in wp-config.php suspends
PHP execution across all generated pages without requiring access
to the WordPress settings screen.
Give internal tools a proper place in wp-admin
Use custom admin pages for information and utilities that belong inside WordPress but do not justify building a dedicated plugin interface.
Client instructions
Place documentation directly inside the client's WordPress dashboard instead of keeping it in a separate document.
Internal dashboards
Build an administrative screen that presents information or output intended only for authenticated WordPress users.
Small internal tools
Create forms, controls or JavaScript-powered utilities for repetitive administrative workflows.
Role-specific resources
Create separate admin pages for editors, administrators or selected user accounts without exposing them to everyone else.
Less boilerplate for small admin tools
The module handles the WordPress page registration and management interface while leaving the page content under your control.
Built on standard WordPress admin APIs
Custom page data is stored separately from TheOneWP's main settings, while menu registration and code editing use WordPress's existing admin APIs.
One dedicated non-autoloaded option
Generated pages are stored together in
towp_bpg_pages, which the module saves with autoload
disabled.
Native admin menu registration
Generated pages use add_menu_page() and
add_submenu_page() through the normal
admin_menu lifecycle.
WordPress code editor
The manager loads WordPress's built-in code editor support for PHP, JavaScript, CSS and HTML on the Backend Pages Generator screen.
Powerful code, restricted controls
Creating and managing pages is limited to privileged administrators, while page visibility and PHP execution are controlled separately.
Management requires manage_options
The manager page and its save, delete and user-search AJAX
endpoints all verify the manage_options capability.
AJAX requests require a valid nonce
Saving, deleting and searching users all verify the dedicated Backend Pages Generator nonce before continuing.
Visibility is enforced before page output
Access checks run during admin_init. Unauthorized
users opening a generated page directly receive a 403 response
instead of the page content.
PHP requires explicit activation
Saved PHP is not executed while the global
bpg_allow_php_execution setting remains disabled.
PHP errors are contained
PHP execution is wrapped in a try/catch for
Throwable. On failure, partial buffered output is
discarded and the error is shown as an admin notice.
Emergency Safe Mode
TOWP_BPG_SAFE_MODE can suspend PHP execution from
wp-config.php without changing the database.
Uses the APIs wp-admin already provides
The generated pages integrate into WordPress using standard admin hooks, menu functions, user APIs and the built-in code editor.
admin_menu
Manager and generated pages are registered through
add_menu_page() and add_submenu_page().
admin_init
Generated-page access is checked before normal admin page output begins, allowing unauthorized requests to be rejected early.
WordPress Code Editor
The manager requests WordPress code editor support for PHP,
JavaScript, CSS and HTML through wp_enqueue_code_editor().
TheOneWP versus common alternatives
Compare Backend Pages Generator with common approaches used to build and maintain custom WordPress admin screens.
| Capability | TheOneWP Backend Pages Generator | Other common solutions |
|---|---|---|
| Create an admin screen | Created and managed directly from wp-admin | Often requires custom PHP or another plugin that registers the admin page |
| Menu placement | Top level, TheOneWP submenu or submenu of another admin menu | Usually requires configuring WordPress menu registration manually in code |
| Custom code | Separate HTML, CSS, JavaScript and PHP editors | Code is commonly maintained in plugin or theme files, snippets or another development tool |
| Visibility | Built-in rules for logged-in users, roles or selected users | Often requires custom capability or user-access logic |
| PHP execution | Disabled by default with an additional wp-config.php Safe Mode | Safety and execution controls depend on the implementation being used |
| Page management | Add, edit, view and delete pages from one manager | Often requires editing source files or managing the page through a separate plugin or development workflow |
Create a custom admin page in four steps
Start with client-side code and enable PHP only when the page actually needs server-side execution.
Enable Backend Pages Generator
Activate the module from TheOneWP settings. Keep PHP execution disabled unless you know the page requires it.
Create the page
Add a title and slug, choose a Dashicon and menu position, then write the HTML, CSS and JavaScript required by the page.
Choose visibility
Allow every logged-in user, select one or more roles, or choose individual WordPress users.
Save and open the page
Saving registers the custom page in wp-admin so you can open it immediately and verify its layout and behaviour.
Keep custom pages predictable and maintainable
Backend Pages Generator can execute arbitrary administrator-provided code, so the same care used for custom plugin code still matters.
Leave PHP disabled when you do not need it
Documentation pages and many small interfaces only require HTML, CSS and JavaScript.
Review PHP before enabling execution
PHP entered into Backend Pages Generator runs dynamically with administrator-controlled code, so treat it with the same care as any other trusted server-side code.
Keep reusable logic outside page-specific code
If the same logic is needed in several places, keep it in an appropriate reusable component instead of duplicating it across multiple generated pages.
Restrict visibility to the real audience
If a page exists only for editors or one client account, limit it to those roles or users instead of making it available to every authenticated user.
Avoid the shortcuts that create unnecessary risk
Most problems come from treating a generated admin page as ordinary content when it can contain executable code.
Enabling PHP when the page does not need it
Keep the global PHP execution toggle disabled unless at least one generated page genuinely requires server-side PHP.
Forgetting the generated slug prefix
Backend Pages Generator registers page URLs using the
towp-bpg- prefix before the sanitized page slug.
Confusing page visibility with WordPress capabilities
Backend Pages Generator applies its own role and user visibility rules. Those rules are separate from editing a role's WordPress capabilities.
Backend Pages Generator FAQ
Answers based on the current Backend Pages Generator implementation.
What does Backend Pages Generator do?
It lets an administrator create custom WordPress admin pages with HTML, CSS, JavaScript and optional PHP, then register each page as a real WordPress admin menu or submenu entry.
Where are the custom pages stored?
They are stored in the dedicated towp_bpg_pages WordPress option, separately from TheOneWP general settings.
Can I use PHP inside a custom admin page?
Yes. PHP can be stored with each page, but execution is controlled by a separate global "Allow PHP execution" setting that is disabled by default.
How is PHP code executed?
When PHP execution is enabled, the saved PHP block is executed dynamically with eval() while the custom admin page is being rendered. Because this is powerful functionality, it should only be enabled on trusted sites where administrators are trusted to manage code.
Can I disable PHP execution without opening WordPress?
Yes. Defining TOWP_BPG_SAFE_MODE as true in wp-config.php suspends PHP execution on all Backend Pages Generator pages, even if the WordPress admin cannot be reached.
What happens if PHP code throws an error?
The module catches Throwable errors, discards partial PHP output and displays the error as an inline WordPress admin notice instead of allowing that error to terminate the rest of the page rendering.
Is PHP execution recorded?
Yes. Backend Pages Generator records PHP execution events and execution errors through TheOneWP internal audit logging system.
Who can see a custom page?
You can make a page available to every logged-in user, restrict it to one or more WordPress roles, or allow only specific user accounts.
Does hiding a page also block its direct URL?
Yes. Backend Pages Generator checks access during admin_init. Users who do not match the page visibility rules are blocked with a 403 response even if they try to open the admin URL directly.
Can a page appear outside the TheOneWP menu?
Yes. A custom page can be a standalone top-level WordPress admin menu item, a submenu of TheOneWP, or a submenu of another existing top-level admin menu.
Can I hide the WordPress page title?
Yes. Each custom page has its own option for hiding the standard WordPress admin page title.
Who can create, edit or delete custom pages?
The Backend Pages Generator manager and its save, delete and user-search AJAX actions require the manage_options capability and a valid module nonce.
Stop building boilerplate for one admin page. Create it directly inside WordPress.
Use Backend Pages Generator to create custom wp-admin screens, choose where they appear and control who can access them.