Let Clients Edit WordPress Text Without Breaking It

You deliver a finished WordPress site, and two weeks later the client has moved a column, deleted a button and pasted a font from Word. The cause is not carelessness: the standard Editor and Administrator roles can change everything. This guide shows how to give clients only what they need, which is changing text, swapping images and editing links on specific pages.

Why the standard roles do not fit client handover

WordPress roles control what a user may do in general, such as editing pages or installing plugins. They do not control what a user may change inside a page. An Editor can open any page and restyle it, move blocks or delete sections. For a client who only wants to update opening hours, that is too much power and a real risk to the design you delivered.

Hiding buttons in the editor is a common workaround, but it only changes what the screen shows. A request sent straight to the REST API still goes through. For real protection the check has to happen on the server, every time a page is saved.

What a safe client setup looks like

A good setup has four parts:

1. Page-level access. The client can only open the pages you assign, and cannot create or delete posts.
2. Content-only permissions. Per page you decide whether text, images and links may change. Layout, styling and structure are always locked.
3. Server-side enforcement. Every save is compared with the stored page, and a change that adds, removes, moves or restyles elements is refused.
4. A trail. Allowed changes become normal WordPress revisions and blocked attempts are logged, so you can see what happened.

Dreamfox Client Edit Mode is built around exactly this. The client gets a Client Editor role, and you choose the pages.

Set it up in four steps

1. Install and activate the plugin, then open Client Edit in the admin menu.
2. Protect the pages the client may edit.
3. Create a user under Users, Add New with the Client Editor role, and assign that user to those pages.
4. Per page, choose which categories may change: text, images, links. You can override these per user.

That is the whole configuration. The client logs in and sees a simplified admin with a My Pages screen and an Edit button per assigned page. Irrelevant menus and toolbar items are hidden, and an optional "Edit this page" link appears on their assigned pages.

What the client can and cannot change

Allowed, if you enable the category:

• Text: headings, paragraphs, button labels and similar content
• Images: replacing an image, its alt text or its caption
• Links: URLs and link targets

Never allowed for a Client Editor: adding, removing or moving elements, changing the type of an element and restyling. If a client tries, the whole save is rejected, not partly applied, and the editor explains what was not allowed. The attempt is written to the activity log.

How the enforcement works

The editor is locked down for the role: content-only editing, no style panels and no block inserter. That is for comfort. The protection itself runs on the server on every save route:

• the block editor's REST save, rejected with a per-violation error
• classic admin saves and XML-RPC
• page-level access, so a Client Editor cannot open or delete other content
• Elementor pages: saves and direct writes to the Elementor data are checked against the same text, image and link rules

Even a hand-made REST request with a Client Editor's login cannot change the structure, because the server compares the save with the stored page and returns a 403 with a list of violations.

Works with the block editor and Elementor

Both the block editor and Elementor are supported. In Elementor, Client Editors can open the editor on their assigned pages and every save is validated.

One thing to know for the block editor: blocks get a persistent internal ID when a page is protected. Blocks you add afterwards are read-only for the client until you press Re-sync IDs on the Protected Pages screen. Do this after you change a protected page yourself.

Keep control after handover

• Every allowed save creates a regular revision, so you can compare and restore.
• The activity log records who changed what, linked to the revision, plus every blocked attempt. It stores summaries only, such as element IDs and attribute names, never full content and never IP addresses.
• You can set how long the log is kept.
• On uninstall your data is kept by default. Enable the delete option under Settings, Advanced if you want a clean removal. The Client Editor role is always removed.

Plugin or custom code

You can build a rough version with custom roles and capability filters, but the hard part is the comparison of a saved page against the stored version for each editor type. If you manage many client sites, a tested plugin saves that work. Developers can still adjust behaviour with filters such as `dreamfox_client_edit_permissions` and `dreamfox_client_edit_can_modify`.

Related guides

If you also build stores for clients, see how to edit the WooCommerce checkout page. To learn how visitors use the forms on the site you hand over, read how to find why visitors abandon WordPress forms. Setup details and troubleshooting are in the knowledge base.