Block a user's WordPress login without deleting the account
Block User Login lets you prevent an entire WordPress role or a specific account from logging in, force blocked users out of active sessions and redirect them to a page or URL you choose.
- Block an entire role or an individual WordPress user.
- End an active session on the blocked user's next regular request.
- Redirect blocked users to a WordPress page or custom URL.
- Give individually blocked accounts their own redirect destination.
Block all users with these roles
Avoid blocking a role assigned to your own administrator account.
Send blocked users to
What does Block User Login do?
When block_user_login is enabled, TheOneWP can prevent
selected WordPress roles or specific user accounts from authenticating.
The module checks successfully authenticated users through the
authenticate filter and also checks existing sessions on
regular requests. A blocked user is logged out when necessary and sent
to the configured WordPress page or custom URL. Individual blocked
accounts can also use their own destination instead of the global one.
Sometimes you need to stop access without deleting anything
Removing a WordPress account is often unnecessary when the real requirement is simply preventing that person from logging in.
Deleting the account affects more than access
A user account can be connected to posts, comments, authorship and other stored data. Removing the account means dealing with those relationships even when you only want to suspend access.
Access may need to stop before the account is removed
Contractors, former team members or suspicious accounts may need their login disabled while their content and user record stay available for review or future use.
Disable login access while keeping the user intact
Block User Login adds a dedicated access state on top of the existing WordPress account, leaving the user and their stored content in place.
Block roles or individual accounts
Apply one rule to an entire WordPress role or block a specific account from that user's edit screen.
Force blocked sessions to end
If a blocked user is already authenticated, the module logs that account out on its next normal page request.
Control the destination
Send blocked users to a published WordPress page or custom URL, with optional per-user overrides.
Focused login controls in a single module
Block User Login handles role-wide restrictions, individual exceptions, active sessions and redirect destinations without changing the underlying account.
Role and user blocking
Toggle login restrictions for registered WordPress roles or block a specific account independently from its assigned roles.
Checked after valid authentication
The module acts on the authenticate filter at priority
25 once WordPress has produced a valid WP_User.
Forced logout for existing sessions
Blocked authenticated users are detected on normal
init requests, logged out and redirected.
WordPress page or custom URL
Use a published page from the current site or enter an external destination URL for blocked accounts.
Per-user redirect destination
Individually blocked users can inherit the global destination or use their own page or custom URL.
Uses registered WordPress roles
Role controls are generated from the roles currently available in WordPress instead of relying on a hard-coded default-role list.
When disabling login access makes sense
The module is useful whenever an account should stay in WordPress but should no longer be able to authenticate.
A contractor or employee leaves
Disable access while keeping the account and its existing authorship relationships intact.
An account needs investigation
Suspend a suspicious account while you review its activity without immediately deleting the user record.
A whole role should stop logging in
Disable authentication for every account assigned to a selected role using one role-level setting.
Separate account data from login permission
Keep the WordPress user record available while independently deciding whether that account can authenticate.
Checks run where access is decided
Authentication blocks and existing-session blocks use separate WordPress lifecycle hooks so each check runs in the context where it is needed.
Authentication-time check
New login attempts are evaluated on the WordPress
authenticate filter only after a valid user has been resolved.
Role settings and user metadata
Role-level blocks come from TheOneWP settings while individual account blocks and redirect overrides are stored in user meta.
Profile assets stay scoped
The individual account-access interface loads its administrative
stylesheet only on user-edit.php.
Access checks built on WordPress authentication
The module works with authenticated WordPress users, protects profile changes with capability and nonce checks, and keeps redirect handling inside WordPress's safe redirect system.
Failed credentials are left to WordPress
The block logic returns immediately unless authentication has
already produced a valid WP_User.
Individual blocking requires permission to edit the user
The account-access controls are rendered only when the current administrator has permission to edit the target user.
Profile updates are nonce protected
Saving an individual user's block state verifies a nonce tied
to that user's ID and checks the relevant
edit_user capability.
Safe redirects support configured external hosts
External redirect hosts configured by the module are added to
WordPress's allowed redirect host list before
wp_safe_redirect() runs.
Built around native WordPress user and authentication APIs
The current implementation uses standard WordPress hooks for authentication, sessions, profiles and redirect handling.
authenticate
Valid users are checked for role-level and individual account blocks at filter priority 25.
init
Existing authenticated sessions are checked on regular requests, excluding AJAX and cron execution.
wp_safe_redirect()
Blocked accounts are redirected using WordPress's safe redirect mechanism, with configured external hosts explicitly allowed.
TheOneWP versus common alternatives
Compare Block User Login with common approaches used to restrict WordPress account access.
| Capability | TheOneWP Block User Login | Other common solutions |
|---|---|---|
| Blocking a role | One toggle per registered WordPress role | Often requires changing capabilities, editing roles or using another access-control solution |
| Blocking one user | Available directly from that user's edit screen | Often handled by changing the user's role, credentials or account state |
| Active sessions | Blocked users are signed out on their next regular page request | Session behaviour depends on the method used to restrict the account |
| Destination control | Configurable WordPress page or custom URL, with per-user overrides | Usually requires separate redirect logic or leaves the user at the standard login flow |
| Account data | The user account and its existing content remain intact | Deleting an account requires deciding how its associated content and ownership should be handled |
| Administration | One settings screen plus individual controls on the user edit screen | May require multiple WordPress settings, manual account changes or an additional plugin |
Revoke login access in four steps
Use role-level blocking for groups and individual blocking when a specific account is the exception.
Enable Block User Login
Activate the module from TheOneWP's Login settings.
Configure role restrictions
Select any registered WordPress roles that should no longer be allowed to authenticate.
Set the global destination
Choose the WordPress page or custom URL that blocked accounts should reach after access is denied.
Add individual exceptions
Edit a specific WordPress user when one account needs to be blocked independently or requires its own redirect destination.
Keep access restrictions intentional
Role-wide blocking can affect many accounts at once, while individual blocks are better suited to targeted account restrictions.
Check your own roles before enabling a role-wide block
Blocking a role assigned to your own administrator account can prevent that account from authenticating later.
Prefer individual blocking for isolated cases
If only one account should lose access, use the per-user control instead of affecting every user with the same role.
Use an informative redirect destination
A dedicated page can explain why access is unavailable or tell the user who to contact instead of leaving them without context.
Review dormant accounts regularly
Combine access restrictions with routine user-account review so accounts that are no longer needed do not remain active indefinitely.
Avoid access rules that catch the wrong account
The distinction between role-level and individual blocking matters, especially on sites where users hold multiple roles.
Blocking a role used by your own account
A role-wide restriction applies to every user matching that role, including administrators if that role is assigned to them.
Expecting an open browser to disappear instantly
An already-authenticated blocked user is logged out when their browser makes its next normal WordPress request.
Forgetting an individual redirect override
An individually blocked account can use its own redirect setting instead of the global module destination.
Block User Login FAQ
Answers based on the current Block User Login implementation.
What does Block User Login do?
It prevents selected WordPress roles or individual user accounts from logging in. If a blocked user already has an active session, the module signs them out on their next regular page load and redirects them to the configured destination.
Can I block a single user without blocking their whole role?
Yes. An individual account can be blocked directly from that user's edit screen, independently of the roles assigned to the account.
What happens if a blocked user is already logged in?
The module checks logged-in users during normal page requests. If the current account is blocked, WordPress logs that user out and redirects them to the configured destination.
Can I block myself from my own user profile?
No. The individual Block User Login control is added to the screen used for editing another user and does not appear on your own profile screen. Role-wide blocking is different, so blocking a role assigned to your own account can still prevent you from logging in.
Where do blocked users get redirected?
The global module settings let you choose either a published WordPress page or a custom URL. If no usable destination is configured, the module falls back to the site home page.
Can one blocked user have a different redirect?
Yes. An individually-blocked account can use the global destination or override it with its own WordPress page or custom URL.
Does role blocking work with custom WordPress roles?
Yes. The available role controls are generated from the roles currently registered in WordPress, so compatible custom roles can be included automatically.
Does blocking a user delete their account?
No. Blocking affects login access only. The user account, password, posts and other data remain in WordPress.
Are individual block and unblock changes recorded?
Yes. When an administrator changes the individual block state of a user, the module records the event internally.
When is the login block checked?
The module uses the WordPress authenticate filter at priority 25. It acts only after authentication has produced a valid WP_User object, so failed username or password attempts continue through WordPress normally.
Keep the account. Block the login.
Use Block User Login to suspend access for a role or individual WordPress account without deleting the user or their existing content.