advanced-access-manager
Last commit date
application
16 hours ago
lang
16 hours ago
media
16 hours ago
vendor
16 hours ago
aam.php
16 hours ago
autoloader.php
3 hours ago
index.php
16 hours ago
readme.txt
16 hours ago
readme.txt
216 lines
| 1 | === Advanced Access Manager – Access Governance for WordPress === |
| 2 | Contributors: vasyltech |
| 3 | Tags: security, access governance, user roles, restricted content, api security |
| 4 | Requires at least: 5.8.0 |
| 5 | Requires PHP: 5.6.0 |
| 6 | Tested up to: 7.1.0 |
| 7 | Stable tag: 7.1.3 |
| 8 | |
| 9 | Access Governance for WordPress. Control roles, users, content, admin areas, and APIs to prevent broken access controls and excessive privileges. |
| 10 | |
| 11 | == Description == |
| 12 | |
| 13 | **Advanced Access Manager (AAM)** introduces **Access Governance for WordPress** - a systematic approach to securing your site by controlling who can access what, when, and why. |
| 14 | |
| 15 | Most WordPress security plugins focus on external threats like malware, firewalls, and brute-force attacks. AAM addresses the **root cause of the #1 WordPress security risk: broken access controls, excessive privileges, and misconfigured roles**. |
| 16 | |
| 17 | Instead of reacting to attacks, AAM helps you **design security into your WordPress site**. |
| 18 | |
| 19 | = What Access Governance means in practice = |
| 20 | |
| 21 | - **Mitigate Broken Access Controls**. Ensure roles, users, and permissions are correctly configured to prevent unauthorized actions and privilege escalation. |
| 22 | - **Eliminate Excessive Privileges**. Identify overpowered users and reduce access to critical functionality, admin areas, and APIs. |
| 23 | - **Secure Content by Design**. Control who can view, edit, publish, or delete posts, pages, media, taxonomies, and custom content types. |
| 24 | - **Govern Access with Policy**. Define access rules using JSON Access Policies — portable, auditable, and automation-friendly. |
| 25 | - **Build Custom Security Logic**. Use the AAM PHP Framework to create advanced, programmatic access controls tailored to your application. |
| 26 | |
| 27 | = Key Features = |
| 28 | |
| 29 | - **Security Audit**. Detect risky role assignments, misconfigurations, and compromised accounts. |
| 30 | - **Granular Access Control**. Manage permissions for any user, role, or visitor with precision. |
| 31 | - **Role & Capability Management**. Customize WordPress roles and capabilities beyond defaults. |
| 32 | - **Admin & Menu Control**. Restrict dashboard areas and tailor the admin experience per user or role. |
| 33 | - **API & Endpoint Protection**. Secure REST and XML-RPC access with fine-grained controls. |
| 34 | - **Modern Authentication Options**. Support passwordless and secure login flows. |
| 35 | - **Developer-Ready Framework**. Extend WordPress security using AAM’s powerful SDK. |
| 36 | - **Ad-Free & Transparent**. – No ads, no tracking, no bloat. |
| 37 | |
| 38 | = Built for Security-Conscious WordPress Users = |
| 39 | |
| 40 | AAM is trusted by **150,000+ websites** to deliver enterprise-grade access control without unnecessary complexity. Whether you’re a site owner, agency, developer, or security professional, AAM gives you **full control over WordPress access — by design**. |
| 41 | |
| 42 | Most core features are free. Advanced capabilities are available via premium add-ons. |
| 43 | |
| 44 | No hidden tracking. No data collection. No unwanted changes. |
| 45 | Just **security you can reason about, audit, and trust**. |
| 46 | |
| 47 | == Installation == |
| 48 | |
| 49 | 1. Upload `advanced-access-manager` folder to the `/wp-content/plugins/` directory |
| 50 | 2. Activate the plugin through the 'Plugins' menu in WordPress |
| 51 | |
| 52 | == Screenshots == |
| 53 | |
| 54 | 1. Manage access to backend menu |
| 55 | 2. Manage access to metaboxes & widgets |
| 56 | 3. Manage capabilities for roles and users |
| 57 | 4. Manage access to posts, pages, media or custom post types |
| 58 | 5. Posts and pages access options form |
| 59 | 6. Define access to posts and categories while editing them |
| 60 | 7. Manage access denied redirect rule |
| 61 | 8. Manage user login redirect |
| 62 | 9. Manage 404 redirect |
| 63 | 10. Create your own content teaser for limited content |
| 64 | 11. Improve your website security |
| 65 | |
| 66 | == Changelog == |
| 67 | |
| 68 | = 7.1.3 = |
| 69 | * Fixed: Login redirect drops scheme and trailing slash, breaking sites behind a reverse proxy [https://github.com/aamplugin/advanced-access-manager/issues/506](https://github.com/aamplugin/advanced-access-manager/issues/506) |
| 70 | * Fixed: Duplicated role settings [https://github.com/aamplugin/advanced-access-manager/issues/509](https://github.com/aamplugin/advanced-access-manager/issues/509) |
| 71 | * Fixed: Undefined array key "user_id" warning in Service/Jwt.php line 224 [https://github.com/aamplugin/advanced-access-manager/issues/510](https://github.com/aamplugin/advanced-access-manager/issues/510) |
| 72 | * Fixed: PHP Notice: Cannot access non-public member WP_Admin_Bar::$nodes [https://github.com/aamplugin/advanced-access-manager/issues/505](https://github.com/aamplugin/advanced-access-manager/issues/505) |
| 73 | * Changed: Remove AAM Policy post type from REST API [https://github.com/aamplugin/advanced-access-manager/issues/511](https://github.com/aamplugin/advanced-access-manager/issues/511) |
| 74 | * New: Add the ability to track application passwords per user [https://github.com/aamplugin/advanced-access-manager/issues/508](https://github.com/aamplugin/advanced-access-manager/issues/508) |
| 75 | |
| 76 | = 7.1.2 = |
| 77 | * Fixed: "Sorry, you are not allowed to give users that role." when Multi-Role Support is enabled and default_role is not in get_editable_roles() [https://github.com/aamplugin/advanced-access-manager/issues/501](https://github.com/aamplugin/advanced-access-manager/issues/501) |
| 78 | * Fixed: Incorrectly handled aam_issue_refreshable_jwt capability [https://github.com/aamplugin/advanced-access-manager/issues/503](https://github.com/aamplugin/advanced-access-manager/issues/503) |
| 79 | * Fixed: The resource identifier is invalid on the users page [https://github.com/aamplugin/advanced-access-manager/issues/502](https://github.com/aamplugin/advanced-access-manager/issues/502) |
| 80 | |
| 81 | = 7.1.1 = |
| 82 | * Fixed: Incorrectly handled URL with encoded characters [https://github.com/aamplugin/advanced-access-manager/issues/500](https://github.com/aamplugin/advanced-access-manager/issues/500) |
| 83 | * Fixed: Deprecated: Method ReflectionProperty::setAccessible() is deprecated since 8.5, as it has no effect since PHP 8.1 [https://github.com/aamplugin/advanced-access-manager/issues/499](https://github.com/aamplugin/advanced-access-manager/issues/499) |
| 84 | * Fixed: Super-Admin is unable to create users in WordPress Multisite --> subsites, when Multiple Roles Support is enabled [https://github.com/aamplugin/advanced-access-manager/issues/498](https://github.com/aamplugin/advanced-access-manager/issues/498) |
| 85 | |
| 86 | = 7.1.0 = |
| 87 | * Fixed: Warning: Undefined array key "effect" in /../application/Framework/Utility/Misc.php on line 483 [https://github.com/aamplugin/advanced-access-manager/issues/497](https://github.com/aamplugin/advanced-access-manager/issues/497) |
| 88 | * Fixed: Can't reset ConfigPress [https://github.com/aamplugin/advanced-access-manager/issues/493](https://github.com/aamplugin/advanced-access-manager/issues/493) |
| 89 | * Fixed: Incorrect aam_manage_jwts capability [https://github.com/aamplugin/advanced-access-manager/issues/494](https://github.com/aamplugin/advanced-access-manager/issues/494) |
| 90 | * Fixed: Null pointer in Content.php line 792 [https://github.com/aamplugin/advanced-access-manager/issues/495](https://github.com/aamplugin/advanced-access-manager/issues/495) |
| 91 | * Changed: Removing AAM Post List shortcode [https://github.com/aamplugin/advanced-access-manager/issues/496](https://github.com/aamplugin/advanced-access-manager/issues/496) |
| 92 | * New: Ability to add JWT token description [https://github.com/aamplugin/advanced-access-manager/issues/492](https://github.com/aamplugin/advanced-access-manager/issues/492) |
| 93 | |
| 94 | = 7.0.11 = |
| 95 | * Fixed: Advanced Multi-Role setup fails to hide posts [https://github.com/aamplugin/advanced-access-manager/issues/491](https://github.com/aamplugin/advanced-access-manager/issues/491) |
| 96 | * Fixed: Security Audit References are incorrectly displayed after page refresh [https://github.com/aamplugin/advanced-access-manager/issues/490](https://github.com/aamplugin/advanced-access-manager/issues/490) |
| 97 | * Fixed: PHP warning when security audit fails due to unexpected error [https://github.com/aamplugin/advanced-access-manager/issues/489](https://github.com/aamplugin/advanced-access-manager/issues/489) |
| 98 | * Fixed: Can't deselect a parent role [https://github.com/aamplugin/advanced-access-manager/issues/488](https://github.com/aamplugin/advanced-access-manager/issues/488) |
| 99 | |
| 100 | = 7.0.10 = |
| 101 | * Fixed: Permalink has empty href when post is password protected [https://github.com/aamplugin/advanced-access-manager/issues/487](https://github.com/aamplugin/advanced-access-manager/issues/487) |
| 102 | * Fixed: Roles & Capabilities are not syncing in multisite [https://github.com/aamplugin/advanced-access-manager/issues/485](https://github.com/aamplugin/advanced-access-manager/issues/485) |
| 103 | |
| 104 | = 7.0.9 = |
| 105 | * Fixed: PHP Parse error in php7.4 [https://github.com/aamplugin/advanced-access-manager/issues/482](https://github.com/aamplugin/advanced-access-manager/issues/482) |
| 106 | * Fixed: Uncaught OutOfRangeException: Cannot find user by identifier 0 in /../Framework/Utility/AccessLevels.php:198 [https://github.com/aamplugin/advanced-access-manager/issues/481](https://github.com/aamplugin/advanced-access-manager/issues/481) |
| 107 | |
| 108 | = 7.0.8 = |
| 109 | * Changed: Move to PHP composer for vendor dependencies [https://github.com/aamplugin/advanced-access-manager/issues/480](https://github.com/aamplugin/advanced-access-manager/issues/480) |
| 110 | |
| 111 | = 7.0.7 = |
| 112 | * Fixed: Uncaught Error: preg_match(): Argument #2 ($subject) must be of type string, array given in /.../Framework/Policy/Typecast.php on line 37 [https://github.com/aamplugin/advanced-access-manager/issues/474](https://github.com/aamplugin/advanced-access-manager/issues/474) |
| 113 | * Fixed: Uncaught Error: Call to a member function get_settings() on null in /.../application/Restful/Roles.php [https://github.com/aamplugin/advanced-access-manager/issues/479](https://github.com/aamplugin/advanced-access-manager/issues/479) |
| 114 | * New: New access policy marker AAM_API [https://github.com/aamplugin/advanced-access-manager/issues/475](https://github.com/aamplugin/advanced-access-manager/issues/475) |
| 115 | * New: Allow function expression anywhere within JSON policy xpath [https://github.com/aamplugin/advanced-access-manager/issues/476](https://github.com/aamplugin/advanced-access-manager/issues/476) |
| 116 | * New: Give the ability to define conditions based on user's OS, device, browser, brand, model, etc. [https://github.com/aamplugin/advanced-access-manager/issues/477](https://github.com/aamplugin/advanced-access-manager/issues/477) |
| 117 | |
| 118 | = 7.0.6 = |
| 119 | * Fixed: Incorrectly handling subpages with policies [https://github.com/aamplugin/advanced-access-manager/issues/473](https://github.com/aamplugin/advanced-access-manager/issues/473) |
| 120 | * Fixed: AAM removes slashes in JSON access policy [https://github.com/aamplugin/advanced-access-manager/issues/472](https://github.com/aamplugin/advanced-access-manager/issues/472) |
| 121 | * Fixed: URL Access service does not handle URLs with query params correctly [https://github.com/aamplugin/advanced-access-manager/issues/470](https://github.com/aamplugin/advanced-access-manager/issues/470) |
| 122 | * Fixed: The aam_backend_login widget is unavailable [https://github.com/aamplugin/advanced-access-manager/issues/469](https://github.com/aamplugin/advanced-access-manager/issues/469) |
| 123 | * Changes: Improve clarity around premium add-on status [https://github.com/aamplugin/advanced-access-manager/issues/471](https://github.com/aamplugin/advanced-access-manager/issues/471) |
| 124 | |
| 125 | = 7.0.5 = |
| 126 | * Fixed: ConfigPress are not taken into consideration before init hook [https://github.com/aamplugin/advanced-access-manager/issues/468](https://github.com/aamplugin/advanced-access-manager/issues/468) |
| 127 | * Fixed: AAM does not display default terms pin anymore [https://github.com/aamplugin/advanced-access-manager/issues/467] (https://github.com/aamplugin/advanced-access-manager/issues/467) |
| 128 | * Fixed: Uncaught TypeError: array_key_exists(): Argument #2 ($array) must be of type array, null given in /../Framework/Service/Policies.php:661 [https://github.com/aamplugin/advanced-access-manager/issues/466](https://github.com/aamplugin/advanced-access-manager/issues/466) |
| 129 | |
| 130 | = 7.0.4 = |
| 131 | * Change: Making sure that all AAM hooks are triggered only after init [https://github.com/aamplugin/advanced-access-manager/issues/465](https://github.com/aamplugin/advanced-access-manager/issues/465) |
| 132 | |
| 133 | = 7.0.3 = |
| 134 | * Fixed: The Condition block is not handled properly when Operator is OR [https://github.com/aamplugin/advanced-access-manager/issues/464](https://github.com/aamplugin/advanced-access-manager/issues/464) |
| 135 | * Fixed: Can Not Edit Password Protected Block Pages [https://github.com/aamplugin/advanced-access-manager/issues/463](https://github.com/aamplugin/advanced-access-manager/issues/463) |
| 136 | * Fixed: Uncaught Error: Cannot use object of type WP_Post_Type as array in /../Metaboxes.php on line 383 [https://github.com/aamplugin/advanced-access-manager/issues/461](https://github.com/aamplugin/advanced-access-manager/issues/461) |
| 137 | * Feature Request: Re-introduce the "Unified Multisite Configuration Sync" option [https://github.com/aamplugin/advanced-access-manager/issues/462](https://github.com/aamplugin/advanced-access-manager/issues/462) |
| 138 | |
| 139 | = 7.0.2 = |
| 140 | * Fixed: Restricted post with Teaser Message is not enforced [https://github.com/aamplugin/advanced-access-manager/issues/460](https://github.com/aamplugin/advanced-access-manager/issues/460) |
| 141 | * Fixed: The "Redirect to the login page" option does not persist [https://github.com/aamplugin/advanced-access-manager/issues/459](https://github.com/aamplugin/advanced-access-manager/issues/459) |
| 142 | * Fixed: The Reset All AAM settings button does not work [https://github.com/aamplugin/advanced-access-manager/issues/457](https://github.com/aamplugin/advanced-access-manager/issues/457) |
| 143 | * Fixed: Metaboxes for custom taxonomies have the same slug [https://github.com/aamplugin/advanced-access-manager/issues/456](https://github.com/aamplugin/advanced-access-manager/issues/456) |
| 144 | * Fixed: PHP Notice: AAM_Framework_Service_Widgets(): Invalid widget provided in /wp-includes/functions.php [https://github.com/aamplugin/advanced-access-manager/issues/443](https://github.com/aamplugin/advanced-access-manager/issues/443) |
| 145 | * Fixed: AAM labels quote escape [https://github.com/aamplugin/advanced-access-manager/issues/455](https://github.com/aamplugin/advanced-access-manager/issues/455) |
| 146 | * Fixed: List of backend menu items is empty on the Backend Menu tab [https://github.com/aamplugin/advanced-access-manager/issues/454](https://github.com/aamplugin/advanced-access-manager/issues/454) |
| 147 | * Fixed: Issue with clearing buffer [https://github.com/aamplugin/advanced-access-manager/issues/453](https://github.com/aamplugin/advanced-access-manager/issues/453) |
| 148 | * Fixed: Uncaught Error: Call to a member function list() on null in /../Framework/Manager.php:450 [https://github.com/aamplugin/advanced-access-manager/issues/452](https://github.com/aamplugin/advanced-access-manager/issues/452) |
| 149 | * Enhancement: Give the ability to control archive pages [https://github.com/aamplugin/advanced-access-manager/issues/458](https://github.com/aamplugin/advanced-access-manager/issues/458) |
| 150 | |
| 151 | = 7.0.1 = |
| 152 | * Fixed: Access Denied message when aam_access_dashboard capability is created [https://github.com/aamplugin/advanced-access-manager/issues/451](https://github.com/aamplugin/advanced-access-manager/issues/451) |
| 153 | * Fixed: PHP Warning: array_diff(): Expected parameter 1 to be an array, string given in /.../Service/Identity.php on line 245 [https://github.com/aamplugin/advanced-access-manager/issues/449](https://github.com/aamplugin/advanced-access-manager/issues/449) |
| 154 | * Fixed: Framework Manager error handling [https://github.com/aamplugin/advanced-access-manager/issues/448](https://github.com/aamplugin/advanced-access-manager/issues/448) |
| 155 | * Fixed: Error type E_PARSE in .../Framework/Utility/Misc.php on line 292. Error message: syntax error, unexpected ‘…’ [https://github.com/aamplugin/advanced-access-manager/issues/447](https://github.com/aamplugin/advanced-access-manager/issues/447) |
| 156 | * Fixed: PHP Fatal error. undefined function get_user [https://github.com/aamplugin/advanced-access-manager/issues/446](https://github.com/aamplugin/advanced-access-manager/issues/446) |
| 157 | * Fixed: PHP Fatal error. undefined function wp_is_rest_endpoint [https://github.com/aamplugin/advanced-access-manager/issues/445](https://github.com/aamplugin/advanced-access-manager/issues/445) |
| 158 | * Fixed: v2 api broken [https://github.com/aamplugin/advanced-access-manager/issues/444](https://github.com/aamplugin/advanced-access-manager/issues/444) |
| 159 | * Changed: Default to WordPress default logout redirect [https://github.com/aamplugin/advanced-access-manager/issues/450](https://github.com/aamplugin/advanced-access-manager/issues/450) |
| 160 | |
| 161 | = 7.0.0 = |
| 162 | * Official 7.0.0 |
| 163 | |
| 164 | = 6.9.51 = |
| 165 | * Fixed: PHP Notice: Function _load_textdomain_just_in_time [https://github.com/aamplugin/advanced-access-manager/issues/442](https://github.com/aamplugin/advanced-access-manager/issues/442) |
| 166 | * Fixed: The Access Manager Metabox does not initialize correctly [https://github.com/aamplugin/advanced-access-manager/issues/441](https://github.com/aamplugin/advanced-access-manager/issues/441) |
| 167 | * Fixed: Incorrectly invoked translation function [https://github.com/aamplugin/advanced-access-manager/issues/440](https://github.com/aamplugin/advanced-access-manager/issues/440) |
| 168 | * Fixed: Download audit report issue [https://github.com/aamplugin/advanced-access-manager/issues/438](https://github.com/aamplugin/advanced-access-manager/issues/438) |
| 169 | |
| 170 | = 6.0.0 = |
| 171 | * Complete rewrite of the entire plugin. For more information, check [this article](https://aamplugin.com/article/advanced-access-manager-next-generation) |
| 172 | |
| 173 | = 5.0 = |
| 174 | * Added ACCESS COUNTER option to Posts & Pages |
| 175 | * Added premium MONETIZE option to Posts & Pages |
| 176 | * Added ability to turn off "Secure Login" feature |
| 177 | * Added ability to toggle extension status (active/inactive) |
| 178 | * Added ability for AAM to filter out Admin Top Bar based on restricted admin menus |
| 179 | * Deprecated AAM Role Filter extension and merged it to the AAM core |
| 180 | * Deprecated AAM Payment extension and merged it with AAM E-Commerce extension |
| 181 | * Deprecated ConfigPress options that manage access to AAM UI. All is based on capabilities from now. |
| 182 | * Split UI to three areas: Access, Settings and Extensions |
| 183 | * Fixed over 25+ reported bugs and discovered during internal refactoring |
| 184 | * Removed deprecated "Security" feature. Replaced with Secure Login Widget |
| 185 | * Removed deprecated "Teaser" feature. Replaced with Teaser Message per post base |
| 186 | |
| 187 | = 4.0 = |
| 188 | * Added link Access to category list |
| 189 | * Added shortcode [aam] to manage access to the post's content |
| 190 | * Moved AAM Redirect extension to the basic AAM package |
| 191 | * Moved AAM Login Redirect extension to the basic AAM package |
| 192 | * Moved AAM Content Teaser extension to the basic AAM package |
| 193 | * Set single password for any post or posts in any category or post type |
| 194 | * Added two protection mechanism from login brute force attacks |
| 195 | * Added double authentication mechanism |
| 196 | * Few minor core bug fixings |
| 197 | * Improved multisite support |
| 198 | * Improved caching mechanism |
| 199 | |
| 200 | = 3.0 = |
| 201 | * Brand new and much more intuitive user interface |
| 202 | * Fully responsive design |
| 203 | * Better, more reliable and faster core functionality |
| 204 | * Completely new extension handler |
| 205 | * Added "Manage Access" action to the list of user |
| 206 | * Tested against WP 3.8 and PHP 5.2.17 versions |
| 207 | |
| 208 | = 2.0 = |
| 209 | * New UI |
| 210 | * Robust and completely new core functionality |
| 211 | * Over 3 dozen of bug fixed and improvement during 3 alpha & beta versions |
| 212 | * Improved Update mechanism |
| 213 | |
| 214 | = 1.0 = |
| 215 | * Fixed issue with comment editing |
| 216 | * Implemented JavaScript error catching |