Client Shield & Workspace Documentation

1. Introduction & Architectural Overview

Client Shield & Workspace is engineered specifically for WordPress agencies, developers, and freelancers who need to deliver safe, decluttered, and fully branded administration dashboards to their clients.

It bridges the critical operational gap between keeping clients empowered to manage their daily content while safeguarding site stability, responsive layouts, design systems, and core code integrity.

+------------------------------------+------------------------------------+
|        Full Administrator          |         Shielded Client            |
|       (Agency Developers)          |       (Content Managers)           |
+------------------------------------+------------------------------------+
|  * Unrestricted access to all      |  * Lands on Branded Workspace      |
|    menus, tools, and code editors. |  * Critical pages locked & badged. |
|  * Real-time "View as Client"      |  * Developer menus stripped.       |
|    simulation mode switcher.       |  * Direct URL attempts blocked.    |
|  * Full agency settings control.   |  * Safe Form Submissions bridge.   |
|                                    |  * Slide-out agency support desk.  |
+------------------------------------+------------------------------------+
            

2. Installation & Initial Activation

1. Log in to your WordPress administration dashboard with Administrator credentials.
2. Navigate to Plugins → Add New Plugin → Upload Plugin.
3. Select the downloaded client-shield-workspace.zip file and click Install Now.
4. Click Activate Plugin.
5. Upon activation, Client Shield automatically provisions the secure Client Workspace Manager role, registers default options, and initializes the menu shield engine.

3. Module 1: Dynamic Menu Shield & URL Hardening

Unlike naive CSS-hiding plugins where a client can still access settings by typing /wp-admin/options-general.php into the browser address bar, Client Shield operates at the core WordPress admin_menu and load-* hook levels.

• Auto-Detected Third-Party Plugins: Automatically detects ACF, CPT UI, Elementor, WP Rocket, LiteSpeed Cache, Yoast SEO, Rank Math, Code Snippets, and WooCommerce settings.
• Role-Based Menu Toggles: Choose exactly which client roles have dangerous or confusing menus stripped from view.
• Server-Side Direct URL Interception: If a non-administrator attempts to bypass menu removal by entering protected URLs manually, the request is intercepted at the PHP kernel level and redirected to the safe Client Workspace with a polite agency notice.
• Code & File Editor Hardening: Enforces DISALLOW_FILE_EDIT at runtime, disabling Theme & Plugin code editing directly from the WordPress dashboard.

4. Module 2: Critical Page & Layout Shield

Website rebuilds and responsive grid layouts are expensive. The Critical Page Shield prevents non-administrators from trashing, deleting, or altering primary conversion templates.

• Automatic Home & Blog Locking: The active Homepage and Blog Posts page are automatically locked upon shield activation.
• Lock Additional Templates: Add Cart, Checkout, Contact, or bespoke landing pages to the shield list.
• UI & Action Removal: Completely strips the "Trash" row action and "Move to Trash" button for protected pages in list and edit views.
• Page Builder Lock: Disables the "Edit with Elementor" action button on protected pages for client roles, preventing broken container flexbox or responsive styling. Clients can still edit post content, images, and safe custom fields.

5. Module 3: Role Delegation & Safe Capabilities

Historically, delegating access to Elementor Form Submissions or WooCommerce store reports required granting the client manage_options, which gave them the power to delete plugins or disrupt site settings.

• Isolated Form Leads Submenu: Adds a dedicated Client Workspace → Form Leads screen. Clients can review lead submissions, filter by date, and export CSVs safely.
• Safe Capability Mapping: Introduces granular capabilities (csw_access_workspace, csw_view_safe_submissions, csw_export_safe_submissions) that persist across WordPress core updates.

6. Module 4: The Client Workspace Canvas

When shielded clients log in, they land directly on admin.php?page=client-workspace instead of the cluttered default WordPress dashboard widgets.

• Customizable Hero Greeting: Displays dynamic greeting tokens: Hello, [Client Name]! Welcome to your [Site Title] portal.
• Quick-Action Cards: Modern cards for managing Pages, Form Submissions, Media Library, and Blog Posts.
• Agency Announcement Banner: Post maintenance alerts or feature release notices in Info, Warning, or Success styles.
• Embedded Video Hub: Embed custom Loom, YouTube, or Vimeo onboarding tutorials directly inside the dashboard.

7. Module 5: Whitelabeling, Login & Logout Flow

Deliver a cohesive, high-end agency presentation from the moment your client visits the login screen.

• Custom Login Branding: Replace WordPress logo with your agency or client logo, set custom background colors or imagery, and customize button colors.
• Custom Logout Redirect: Automatically redirect logging-out clients to your agency website (e.g. https://youragency.com) with automated allowed_redirect_hosts security registration.
• Admin Bar & Footer Polishing: Removes WordPress logo from admin bar and replaces default footer credits with bespoke agency support text.

8. Module 6: Live Client Simulation Mode

Preview the exact admin experience your client receives without logging out, switching browsers, or managing secondary test accounts.

• Click "View as Client" in the top WordPress admin bar.
• Instantly verify that developer menus are hidden, critical page locks are active, and direct URLs are shielded.
• Click "Exit Client Preview" at any time to return to full Administrator access.

9. Module 7: Slide-Out Agency Support Drawer

A native slide-out help desk accessible from both the top admin bar and the workspace canvas. Clients can submit requests directly without hunting for your email.

• Auto-bundles WordPress version, PHP version, active theme, and current role with the ticket to eliminate back-and-forth debugging questions.
• Full keyboard accessibility with Esc key support and backdrop click dismissal.

10. Developer API Reference (Hooks & Filters)

Client Shield is built for enterprise extensibility by custom themes and agency infrastructure modules:

1. Filter: csw_blocked_menu_slugs

Allows programmatic addition or removal of blocked menu slugs based on runtime conditions:

add_filter( 'csw_blocked_menu_slugs', function ( array $blocked_slugs ): array {
    // Dynamically block a custom plugin menu only on staging environments
    if ( wp_get_environment_type() === 'staging' ) {
        $blocked_slugs[] = 'custom-staging-tool';
    }
    return $blocked_slugs;
} );
            

2. Filter: csw_dashboard_action_cards

Inject custom shortcut cards onto the Client Workspace canvas:

add_filter( 'csw_dashboard_action_cards', function ( array $cards ): array {
    $cards[] = [
        'slug'        => 'agency-kb',
        'title'       => __( 'Agency Knowledge Base', 'agency-toolkit' ),
        'description' => __( 'Browse guides, brand assets, and content style rules.', 'agency-toolkit' ),
        'url'         => 'https://portal.youragency.com/kb',
        'icon'        => 'dashicons-book-alt',
        'category'    => 'resources',
    ];
    return $cards;
} );
            

11. Troubleshooting & Frequently Asked Questions