bbPress Codex

Super Moderators

Starting with bbPress 2.6.16, the Super Moderators feature allows global forum Moderators and Keymasters to edit users through front-end bbPress profiles without granting them general WordPress user-administration access.

The feature is disabled by default. Administrators can enable it under Settings → Forums → Forum User Settings by selecting Allow Moderators and Keymasters to edit users.

Per-Forum Moderators do not receive this access. Their authority remains limited to the forums assigned to them.

Default permissions

When Super Moderators are enabled, a global Moderator may edit these fields for an ordinary user:

• first name, last name, nickname, and display name;
• website and registered contact methods;
• biographical information and locale;
• email address; and
• bbPress forum role, limited to Participant, Spectator, or Blocked.

A Moderator cannot:

• set another user’s password;
• assign a WordPress site role;
• assign the bbPress Moderator or Keymaster roles;
• edit a bbPress Keymaster, a WordPress administrator, or a super administrator; or
• use the feature to access user management in WordPress administration.

Users retain the normal ability to edit their own profile and password. Their own email-address changes require confirmation. An authorized Super Moderator’s correction to another user’s email address is applied directly.

Keymasters retain broader front-end bbPress profile authority. They may change another ordinary user’s password and assign any bbPress forum role. Assigning WordPress site roles still requires the normal WordPress capabilities.

The available form controls reflect these permissions. bbPress also validates submitted data before WordPress updates the user, so removing or changing a form control does not bypass the policy.

Customizing the policy

Sites can adjust each part of the policy independently:

• bbp_allow_super_mods enables or disables Super Moderators.
• bbp_map_primary_meta_caps changes the capability required to edit a user through a bbPress profile.
• bbp_current_user_can_edit_user_field controls the profile, email, password, site_role, and forum_role field groups.
• bbp_get_user_editable_forum_roles controls which bbPress roles the current user may assign.
• bbp_filter_user_edit_post_data filters submitted profile data before it is passed to WordPress.
• bbp_user_email_change_requires_confirmation controls whether an email-address change requires confirmation from the edited user.

These filters receive the edited user and current user where applicable, allowing a site to account for custom roles, capabilities, and moderation workflows without replacing bbPress’s profile handler.