How to lock your WordPress admin to a single email domain
If you build and manage sites for clients, there’s a configuration risk that’s easy to overlook: anyone with the right credentials can create an administrator account, regardless of their email address. That includes attackers who gain access via targeted scripting attacks, or clients who accidentally elevate a user they shouldn’t.
ToggleWP’s Security & Authentication module includes an Admin Domain Restriction – a simple rule that limits administrator accounts to specific email domains.
How it works
In the Security & Authentication settings, you specify one or more allowed email domains for admin accounts (e.g. youragency.com). Any user with an @gmail.com, @hotmail.com, or other non-matching address cannot be given or retain administrator role.
What it prevents
- Clients granting admin access to Rogue Marketing Agency
- Compromised or rogue accounts escalating privileges
- Social engineering attacks that get a low-level user promoted to admin
Other authentication protections in the same module
Email-only login – Forces users to log in with their email address instead of username. Usernames are predictable; email addresses are less so.
User enumeration prevention – Blocks the WordPress REST API endpoint (/wp/v2/users) that publicly lists usernames. A common first step in brute-force attacks.
Password reset protection – Returns generic error messages on the password reset form, so attackers can’t confirm whether an email address has an account.
Admin email change protection – Adds a confirmation flow when an admin email address is changed, preventing silent account takeover.
These settings take minutes to configure and address some of the most common WordPress attack vectors. None of them require a dedicated security plugin.