Hide specific files from the roles who don't need them
Media Visibility hides individual media files, or a whole category, from chosen roles — even Administrator — while keeping every file fully reachable by its direct URL.
- A dedicated page lists every file, with per-role visibility controls.
- Hide a whole category in one move, when Media Categories is active.
- The management page always shows everything, even what's hidden.
- Works with any registered role, not just WordPress's built-in five.
Hide from roles
What does Media Visibility do?
When the media_visibility module is active, TOWP_Media_Visibility adds a dedicated admin page listing every media file, where each one, or an entire category when Media Categories is active, can get hidden from chosen roles. Enforcement filters the media library grid, the list view, and the Add Media modal for whichever roles a file is hidden from, using pre_get_posts to exclude those attachments from the query. Because a direct URL to a hidden file still works, this functions as a library-visibility control rather than an access-control mechanism, and the management page itself always shows every file regardless of configuration, so a restriction can always be found and undone.
Every uploaded file ends up visible to every role
Since the library makes no distinction by role, everything uploaded stays visible to everyone who can browse it.
One shared library, no separation by role
WordPress's media library shows the exact same set of files to every role that can access it, whether a specific file is actually relevant to their work or not.
A cluttered library slows everyone down
As a site accumulates internal assets, sensitive drafts, or files meant for one department, every other role still has to scroll past all of it to find what they actually need.
Out of the library, for exactly the roles who don't need it
The module gives every file, and every category, its own visibility setting, enforced consistently across the library.
Hide a file from specific roles, including Administrator
Any role can be excluded from seeing a given file in the library, without any role being automatically exempt.
Hide an entire category in one move
When Media Categories is active, restricting a category hides every file inside it at once, and removes the category itself from the sidebar for those roles.
Never actually unreachable
A hidden file's direct URL still works, and the management page still shows it, so nothing gets permanently lost behind a restriction.
Every file and category, its own visibility rule
Every capability below is present in the supplied PHP class, its view template and the settings registration.
Every file, listed in one place
A standalone admin page lists every media file with search, grid and list views, independent of the standard media library screen.
Any role, including Administrator
Each file's hidden-role list comes from any registered role on the site, not a fixed set, and Administrator isn't exempt from being selected.
One restriction, every file inside it
Hiding a category hides its attachments from the library query, removes the category from its own sidebar, and drops it from the bulk "Move to Category" list, all for the same restricted roles.
The management page never hides anything from itself
A dedicated bypass flag keeps the management page showing every file regardless of restriction, so an administrator can never lock themselves out of undoing a mistake.
Hidden-ID lookups reused, not recalculated
The list of hidden attachment and category IDs for a given role set gets cached in a transient and cleared automatically whenever a restriction or a category assignment changes.
Every visibility change logged
Saving a file or category restriction writes an entry to the audit log, recording what changed and which roles it now applies to.
Where per-role visibility helps most
The module supports any library shared across roles that don't all need to see the same files.
Multi-department or multi-client sites
Keep each department's or client's own assets out of the library view for everyone else, without deleting or moving anything.
Internal or sensitive files that shouldn't clutter every role's view
Hide drafts, internal documents or work-in-progress assets from roles that have no reason to see them yet.
A cleaner library for content editors
Restrict system assets, template images or design files to admin-level roles, so editors browsing the library only see what's relevant to writing content.
A tidier library, nothing ever truly lost
The module combines genuine decluttering with a design that always stays reversible.
Cached lookups, recalculated only when needed
The verified implementation avoids repeating expensive work on every page load.
Hidden-ID lookups cached per role set
The list of files hidden for a given combination of roles gets computed once and cached for 12 hours, not recalculated on every page load.
Cache invalidated only when something actually changes
The cache clears automatically whenever a restriction is saved or an attachment's category changes, keeping it accurate without constant recalculation.
Enforcement adds one targeted exclusion, not a full re-query
Hidden IDs get merged into the existing post__not_in parameter of the standard attachment query, rather than running a separate lookup per page.
Honest about what it is, and what it isn't
The code is explicit that this governs visibility, not access, and never risks locking an administrator out.
A visibility control, not an access-control mechanism
A hidden file's direct URL still works for anyone who has it, since this module governs what appears in the library interface, not who can technically reach a file.
The management page can never lock out an administrator
A dedicated bypass ensures the visibility management page always shows every file, so a mistaken restriction can always be found and reversed.
Every change requires manage_options
Only an administrator can view the management page, save a file's visibility, or restrict a category.
Every action is nonce-verified and logged
Each AJAX request checks a nonce before processing, and every successful change gets recorded in the audit log.
Built to integrate cleanly with Media Categories
The supplied code integrates through APIs present in WordPress core and TheOneWP's own modules; this page makes no compatibility claim beyond the verified implementation.
pre_get_posts
The standard WordPress hook for modifying a query before it runs, used here to exclude hidden attachments from the library and the Add Media modal.
Two dedicated cross-module filters
towp_mc_hidden_category_ids and towp_mc_count_excluded_attachment_ids let this module hide categories and correct their counts without Media Categories needing any awareness of it.
towp_user_roles filter respected
Role checks run through the same filter a Multi-Role module can extend, so a user with more than one assigned role gets evaluated against all of them.
TheOneWP versus common alternatives
Compare the verified Media Visibility implementation with a typical single-purpose role-hiding plugin.
| Capability | TheOneWP Media Visibility | Other common solutions |
|---|---|---|
| Hiding files from specific roles | Any registered role, Administrator included | Often limited to a fixed set of roles, or exempts admins automatically |
| Category-level hiding | One restriction covers every file inside, sidebar and bulk actions too | Rarely available; usually file-by-file only |
| Recovering from a mistaken restriction | The management page always shows everything, always | A restriction can sometimes hide a file even from the person who set it |
| Performance under many roles and files | Cached hidden-ID lookups per role set | A naive per-request check can slow down as the library grows |
| Administration | One dedicated page, consistent enforcement everywhere | Requires a mix of plugins for file-level and category-level control |
Restrict a file or category in four steps
Verify the result from the restricted role's own view before considering it done.
Enable Media Visibility
Activate the module from the TheOneWP Content settings tab.
Open the Media Visibility page
Find it as a submenu or standalone menu item, depending on how it's configured.
Hide a file or a category
Use Edit on any file, or the category banner when Media Categories is active, to choose which roles shouldn't see it.
Confirm the restriction from an affected role's view
Log in as, or switch to, the restricted role to confirm the file no longer appears in the library.
Restrict deliberately, track what changes
A little discipline around scope and logging keeps restrictions easy to manage as the library grows.
Restrict categories rather than individual files when possible
A category-level restriction is easier to maintain than hiding dozens of files one at a time.
Remember hidden doesn't mean protected
Anyone with a hidden file's direct URL can still open it, so this isn't the right tool for content that genuinely needs to stay confidential.
Check the audit log after a bulk restriction change
Since every save gets logged, the audit log is the fastest way to confirm exactly what changed and when.
Revisit restrictions as roles change
A role added after a restriction was set won't automatically inherit it, so it's worth reviewing hidden-role lists periodically.
Avoid treating visibility as if it were security
The module is honest about its own limits, and a couple of assumptions are worth double-checking.
Treating a hidden file as securely protected
Since the direct URL still works, hiding a file only removes it from the library interface, not from anyone who already has its address.
Assuming Administrator is automatically exempt
Administrator can be selected like any other role, so it's possible to accidentally hide a file from admins too.
Not checking category-level restrictions after adding a new file
A file added to an already-restricted category inherits that restriction automatically, so it's worth confirming that's the intended outcome.
Media Visibility FAQ
These answers come directly from the verified class, its view template and the settings registration.
What does Media Visibility do?
It hides individual media files, or an entire category, from chosen WordPress roles, while keeping every file's direct URL fully working.
Can I hide a file from Administrators too?
Yes. Any registered role can be selected, including Administrator, since no role is automatically exempt.
Does hiding a file actually protect it from being accessed?
No. A hidden file's direct URL still works; the restriction only removes it from the library interface for the roles it's hidden from.
Can I lock myself out of finding a hidden file?
No. The management page always shows every file, regardless of what's hidden and from whom, so a restriction can always be found and undone.
Does this work with custom roles, not just the default WordPress ones?
Yes. The role list comes from every role actually registered on the site, including custom ones.
What happens when Media Categories is also active?
A whole category can be hidden in one move, which also removes it from the category sidebar and the bulk "Move to Category" list for the restricted roles.
Is every visibility change tracked anywhere?
Yes. Saving a file or category restriction writes an entry to the audit log.
Does hiding a file slow down the media library as it grows?
Not meaningfully, since the hidden-ID lookup for a given role combination gets cached rather than recalculated on every single page load.
Where does the Media Visibility page appear in the admin menu?
As a submenu of TheOneWP settings, or as its own standalone top-level menu item, depending on configuration.
Who can configure media visibility?
Only an administrator with the manage_options capability.
Stop showing every file to every role.Hide what each role doesn't need to see.
Use Media Visibility to hide files or whole categories from chosen roles, with every restriction always reversible from the management page.