Last week, WPBeginner released Comment Moderation Role to the WordPress plugin directory. The plugin does a simple job of creating a single user role that can only moderate comments.
The most common use case for such a role — named “WPB Comment Moderator” in the admin — is for larger teams that need a separate user account to tackle moderation. WordPress has no built-in way of handling this. For one of the most extendable CMSs on the planet, this is one area where it has always fallen short.
It almost feels like yesterday. In reality, it was 10 years ago when I stumbled upon a (then) year-old ticket for a bug that was a breaking point in a project I was working on. I needed to grant specific users on a WordPress site permission to moderate comments but not allow them to edit other things in the admin.
Some of you may be thinking that the moderate_comments capability should allow that. And, you would be correct in thinking that it should. However, that is not how it works at all. For users to edit comments, they must also be able to edit posts. It is a bit of a convoluted mess if you do a deep dive into the core code only to find hard-coded permissions checks that are impossible to override without rewriting large chunks of code.
I would run into the same issue multiple times in the years since. I have built a few hacky, one-off workarounds for specific projects, but they were never ideal. And, I was never interested in maintaining a plugin that solved this problem because I knew it had the potential to be a bit of a pain.
While I have seen a few other solutions, each fundamentally flawed, I am happy to see someone tackling this without exposing permissions issues.
WPBeginner’s Comment Moderation Role plugin works in the same way that I think such a plugin should work, at least with the roadblocks that WordPress currently puts in the way.
Site administrators can add WPB Comment Moderator to any account via the user management admin screen. The process is the same as adding or removing any other role in WordPress.
After adding the role to a user, that user can access the Comments admin screen. They can also see both the Dashboard and their own Profile in the admin. Except in the cases where they have another role added via a different plugin, they will not have permission to access other screens.
Because of core WordPress’s hard-coded permissions check, the plugin must create its own comments management screen. Most users will not notice this because it is all under the hood. The plugin only adds it when necessary, and it does not look or function any differently than the default screen. It is just a lot of code work and duplication to fix an 11-year-old reported bug in WordPress.
Until the foundational issue is addressed in core WordPress, Comment Moderation Role is the best plugin for this job. After extensive testing, I can now say that it is now nestled firmly in my toolbox, ready to pull out when needed for a project.
