ThemeRouter separates preview access from administrative configuration. This limits who can create visitor-facing changes while allowing authorized editorial review.
| Action | Default requirement |
|---|---|
| Use private preview | Logged in and able to edit_posts |
| Change ThemeRouter settings | manage_options |
| Save individual theme assignments | Administrator-level access |
| View frontend debug output | Logged in and able to manage_options |
| Use ThemeRouter abilities | manage_options |
Customize access carefully
Developers can change preview access with themerouter_can_user_preview and debug visibility with themerouter_can_user_view_debug. Return a capability-based decision rather than checking usernames or exposing preview access publicly.
Preview link security
Preview links are validated and intended for authorized logged-in users. Do not publish them as public share links or treat them as a replacement for a dedicated external approval system.
Changing a capability filter changes the site security boundary. Review the role model, test unauthorized requests, and document the decision before deploying custom access logic.