Skip to content

Plugin Restriction

🔌 Tenant-Level Plugin Restriction

In multitenant mode, the framework supports per-tenant plugin restriction, allowing you to control which plugins are available to each tenant.

By default, all tenants have access to every plugin in the system. However, if you want to limit plugin visibility and access for specific tenants, you can do so by creating a plugins.json file inside that tenant's configuration directory.


📂 How It Works

For any given tenant, the framework looks for a file at:

configs/tenant/{tenant_id}/plugins.json

If this file exists, the framework will only expose the plugins listed in that file to that tenant. All other plugins — whether active or not — will be completely hidden and inaccessible to the tenant. Other tenants will remain unaffected.

If the file is not present, the tenant will have unrestricted access to all available plugins.


✅ Example: plugins.json

json
{
  "seo-toolkit": "seo-toolkit/seo-toolkit.php",
  "contact-form": "contact-form/contact-form.php",
  "custom-analytics": "custom-analytics/analytics.php"
}

Each entry in the array should be the relative plugin path, matching how WordPress expects them — that is, "plugin-folder/plugin-file.php".


📋 Notes

  • You only need to create plugins.json for tenants where restrictions are required.
  • If a tenant does not have a plugins.json, they will have unrestricted access to all plugins.
  • This allows you to selectively control plugin access on a per-tenant basis without affecting the rest of the system.
  • It's recommended to include plugins.json creation as part of your tenant provisioning process if plugin restriction is needed.

This approach gives you fine-grained control over plugin visibility, helps maintain isolation between tenants, and supports flexible per-tenant customization.


⚙️ Optional Toggle: RESTRICT_TENANT_PLUGINS

By default, plugin restriction is enabled in multitenant mode. This means that if a plugins.json file exists for a tenant, the framework will enforce it automatically.

If you want to disable plugin restriction entirely, you can define the constant RESTRICT_TENANT_PLUGINS in your wp-config.php and set it to false:

php

// in wp-config.php

define('RESTRICT_TENANT_PLUGINS', false);

Note: The framework sets this constant to true by default, so you’ll need to explicitly override it with false.

When set to false, all plugins will be available to all tenants, regardless of any existing plugins.json files.

This toggle gives you flexibility — for example, you might choose to disable restrictions in local development or testing environments without removing your tenant configs.

🔹 Default: RESTRICT_TENANT_PLUGINS is treated as true if not explicitly defined.