By default, WordPress allows authors to see all images on your site’s media library. This could be problematic if you invite a lot of guest authors. In this article, we will show you how to restrict WordPress media library access to user’s own uploads.
Why Restrict Media Library Access to User’s Own Uploads?
WordPress allows authors to see all files in the media library. They can also see images uploaded by an administrator, editor, or other authors.
To learn more, see our article on WordPress user roles and permissions.
Let’s say you are creating a new post to announce an upcoming product or deal. Authors and guest authors on your website will be able to see the images you upload to that article in the media library.
Your uploads will also be visible on the ‘Add Media’ popup which users see when adding images to their own articles.
For many websites, this may not be a big deal. However, if you run a multi-author website, then you may want to change this.
Let’s take a look at how to easily restrict media library access to user’s own uploads.
Method 1: Restrict Media Library Access Using a Plugin
This method is easier and is recommended for all users.
First thing you need to do is install and activate the Restrict Media Library Access plugin. For more details, see our step by step guide on how to install a WordPress plugin.
This plugin works out of the box, and there are no settings for you to configure.
Upon activation, it filters the media library query to see if the current user is an administrator or editor. If the user role does not match either of them, then it will only show user’s own uploads.
Users with the administrator or editor user role will be able to see all media uploads as usual.
Method 2: Restrict Media Library Access Manually
The first method would work for most websites as it limits media library access and allows only administrator and editor to view all media uploads.
However, if you want to add a custom user role or simply don’t want to use a plugin, then you can try this method instead. It uses the same code used by the plugin, but you will be able to modify it to meet your needs.
This method requires you to add code to your WordPress files. If you haven’t done this before, then take a look at our guide on how to copy and paste code in WordPress.
You’ll need to add the following code to your WordPress functions.php file or a site-specific plugin.
// Limit media library access
add_filter( 'ajax_query_attachments_args', 'wpb_show_current_user_attachments' );
function wpb_show_current_user_attachments( $query ) {
$user_id = get_current_user_id();
if ( $user_id && !current_user_can('activate_plugins') && !current_user_can('edit_others_posts
') ) {
$query['author'] = $user_id;
}
return $query;
}
This code uses current_user_can function to check if the user has the capability to activate plugins or edit other user’s posts. If they don’t, then it changes the query used to display media files and limit it to user’s ID.
We hope this article helped you learn how to restrict WordPress media library access to user’s own uploads. You may also want to limit authors to their own posts in WordPress admin area.
If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.
Noel Williams
Anyone looking for an update might want to consider the following which takes care of the list and grid issues
// For list view
add_action( ‘pre_get_posts’, ‘wpb_show_current_user_attachments_list_view’ );
function wpb_show_current_user_attachments_list_view( $query ) {
if ( is_admin() && $query->is_main_query() && $query->get(‘post_type’) === ‘attachment’ ) {
$user_id = get_current_user_id();
if ( $user_id && !current_user_can(‘administrator’) ) {
$query->set(‘author’, $user_id);
}
}
}
// For grid view
add_filter( ‘ajax_query_attachments_args’, ‘wpb_show_current_user_attachments_grid_view’ );
function wpb_show_current_user_attachments_grid_view( $query ) {
$user_id = get_current_user_id();
if ( $user_id && !current_user_can(‘administrator’) ) {
$query[‘author’] = $user_id;
}
return $query;
}
WPBeginner Support
Thank you for sharing this
Admin
Bruno
The plugin works, but If you switch to ‘upload.php?mode=list’ it’s possible to see all medias again. It works only on the mode=grid
WPBeginner Support
Thank you for sharing this information
Admin
nathan
Amazing ! Its working !
But if using wordpress app installed from mobile, all users still can access whole media library. Any solutions?
Your help is much appreciated !
WPBeginner Support
We do not have a solution for the app at the moment but we will certainly keep an eye out.
Admin
Alvaro Gomez
Thank you for mentioning my plugin
WPBeginner Support
Thank you for creating the plugin and placing it on the WordPress.org repo
Admin
Daniel
Am looking for away i can make user upload directly from their pc instead of going to media page
kim
This may not be the post I need to be asking this on but….
What if you create a role for say, teacher. Is there a way or plugin that would filter so that one teacher can’t see another teacher media files? If that makes sense?
Teacher-username1- media (only see username1 media files)
Teacher-username2-media (only see username2 media files)
Hugh
Instead of:
!current_user_can(‘activate_plugins’)
&&
!current_user_can(‘edit_others_posts’)
USE:
!current_user_can(‘administrator’)
Because if for example you use the ‘User Role Editor’ plugin, you might want to allow the current user to be able to activate plugins AND/OR edit others posts.
Just a thought, works for me
Thanks for the post!
Peter
Nice post.
And is there a way to disallow uploading files directly to the media library and force users (except admins) to use Add Media button within post/page editor?
WPBeginner Support
Hi Peter,
Yes, there is. You can use Adminimize plugin to hide the Media link from your WordPress admin bar for all user roles except administrators.
Admin