AAM

Advanced Access Manager · WordPress plugin

Control who can do what in WordPress.

Advanced Access Manager (AAM) lets you manage roles and permissions, protect content, control admin and API access, and review risky configurations from one place. It is the access governance layer for WordPress: a way to make every access decision intentional and reviewable.

Get AAM Free Explore what AAM controls

Start free. Explore Premium for advanced controls, policies and audits.

150K+active installations
Since 2011built for WordPress access
One layerroles, content, admin and APIs
AAM access controlsInside your WordPress site
AAM active
WHO IS ACTING
Content editorEditorial team
WHAT CAN THEY DO?
Edit postsNeeded for their work
Allowed
Install pluginsOutside their role
Denied
Example: allow editorial work while limiting sensitive actions.

What AAM does

One plugin. Control across WordPress.

Start with familiar permissions. Extend the same access strategy to content, the admin area, APIs and reusable policies.

04 / REQUESTS

Govern APIs and URLs

Apply access controls to REST API routes and direct URL requests.

Read about API access
05 / EVIDENCE

Review security risks

Use security audits to surface excessive privileges and access issues that need attention.

Read about security audits
06 / POLICY

Reuse access policies

Write portable JSON policies for precise rules you can review and apply across sites.

Read about JSON policies

Inside the plugin

Access governance, where the work happens.

This is AAM inside WordPress: choose a role or user, inspect its access, and apply rules that fit the work. The same system connects everyday permission changes to a broader governance practice.

Watch the roles and capabilities walkthrough
AAM Access Policies screen showing policies available for a selected WordPress user
01 / ACCESS POLICIES Review and attach reusable rules to a user.
01 / 06

Real access decisions

Practical answers to everyday WordPress questions.

CLIENT ACCESS

Can a client edit content without changing plugins?

Give them the permissions their work needs and keep sensitive administrative actions restricted.

EDITORIAL ACCESS

Can editors manage only the content assigned to them?

Apply content rules that reflect your publishing workflow, even when a broad role is not enough.

INTEGRATION ACCESS

Can an integration use an API without full admin rights?

Give its underlying identity limited permissions and govern the routes it can reach.

Built for your workflow

Make access governance work at your scale.

01 / HOSTING

Support the sites you host.

Pair AAM Premium with access expertise for your WordPress customers.

For hosting providers ↗02 / AGENCIES

Bring order to every client site.

Build repeatable access standards across a changing portfolio.

For agencies ↗03 / DEVELOPERS

Build access into the product.

Use the AAM PHP Framework for deeper integrations.

For developers ↗04 / ENTERPRISE

Govern at your own scale.

Work together on coverage, education, audits and strategy.

For enterprise ↗

A new category for WordPress

Access governance connects every permission decision.

WordPress access governance is the practice of knowing who has access, defining what they can do, and reviewing those decisions as a site changes. AAM gives that practice a home inside WordPress.

The security perimeter

Who can get in?

Firewalls, malware scanning, login protection and patching help protect the site from external threats.

The access governance layer

What can they do once they are in?

AAM brings roles, users, content, admin functions and API access into one reviewable access strategy.

Beyond the dashboard

Access decisions happen across WordPress.

A role name alone does not explain what a person or integration can actually do. The access layer has to account for each path into the site.

01
WP

Admin

Human users, roles and capabilities.

02

REST API

Routes, methods and authorization callbacks.

03
</>

XML-RPC

Legacy remote access with real authority.

04
•••

Application Passwords

Long-lived credentials tied to user permissions.

05
$_

WP-CLI

Operational access outside the browser.

06
AI

Agents & MCP

Autonomous systems that can reason and act at machine speed.

New reality

The governance loop

See access. Set the rule. Review the outcome.

Access governance gives your team a repeatable way to understand permissions, apply least privilege and revisit decisions as the site changes.

01

Identify

See every human and machine identity with a path into WordPress.

02

Understand

Evaluate effective permissions - not assumptions based on role names.

03

Govern

Apply least privilege with explicit, reviewable access policies on four distinct access levels.

04

Review

Recheck access as users, plugins and integrations change how your website works.

The WordPress access governance layer

AAM makes governance practical.

Advanced Access Manager connects familiar WordPress controls with policies and audits, so teams can understand, apply and revisit access decisions across the application.

Install AAM
Roles & capabilitieseffective access
Backend & toolbarvisible surfaces
API routes & URLsentry points
Application passwordsmachine identity
Access policiesguardrails
Security auditcontinuous proof

Join the revolution

Learn the discipline. Apply the system. Lead the category.

01

Learn

Think beyond roles.

Understand effective permissions, hidden identities, API authorization and the new risks created by AI agents.

Read the article →
02

Govern

Put least privilege into practice.

Use AAM to build precise access rules, reduce unnecessary authority and make every access decision explainable.

Read the article →
03

Lead

Make governance your advantage.

Help clients move from reactive security to a repeatable access-governance standard across every WordPress property.

Read the article →

WordPress Access Governance

Don't just protect the door.
Govern what is already inside

Start with AAM