I ask this in the context of a sharing content site, let's say a forum. This doesn't seem to be a recommended practice, and I wish to know if there is a particular reason:

I plan to let non staff, but registered site visitors to access the CP, to post content in specific allowed categories of my site. Access to the cp is a HUGE time saver: user can post entries, with all the CSS/JS work done, which means that they can benefit from autocomplete tags and all the goodies from the CP. They can see a list of all their entries, edit them etc etc....

Why should I bother doing custom forms if all can be done with CP access ? Any reason ? I don't believe there is a security concern since the CMS allows very precise control of permissions and what user in a group can do in the CP.

1 Answer 1


You're right: there's no technical reason why you couldn't do what you're asking. When users start to add content for a site, they're now content contributors. And it can certainly make sense—depending on the site. When I think of "content sharing site", Craft could be used like a Wiki, for example.

The short answer? If you find yourself reinventing what Craft can already do, just give someone access to the CP.

A longer answer and reasons not to do it? Control. User experience. And trust/security all come to mind.

I just created a site for a client where individual teachers are able to post their class schedules and such and people are able to buy those classes (via Stripe). The client loved the CP. All the teachers were impressed about how easy it was to add their schedules. The CP was definitely a plus in this area.

However, the client properly scrutinizes everyone who wants to use the site (and their credentials) and there's a training period where we show people how to use the site, where to login, etc. Your use case might be a little more streamlined if you have computer savvy users, etc.

While Craft is straightforward, if not downright intuitive, the CP might be overkill for someone just casually posting content once in awhile. There still is a lot going on. And it really depends on what content you're managing.

From a traditional web context, the CP is a still little "disconnected" from the actual website. You still have to find the page you want to edit, or create a new one, preview it, and publish. (That's why, IMO, things like "in-place" editors on are still popular with other CMS.... though I hate those things!)

Having the CP be disconnected is partially due to security. If you trust and properly vett your authors, or there's not much on the line, I see no reason why you couldn't open up the backend.

As always, take good backups in case you have to roll back to something. That's true of any server, though. No software is perfect; if there's a vulnerability found for, say privilege escalation where a user could somehow become an administrator, the more users that have access to the CP, the more chances someone has to breach the site. Craft is relatively niche so you won't have the brute-force drive-bys that something like WordPress has. But as a site administrator, you can never be too vigilant.

  • I think you hit a point when you mention de "disconnection" effect when forcing user to use the CP. But it can be kind of mitigated, if for example, you add direct link to post form right in the cp so user don't need to go in there, then find the link to post. Then you might put a redirect to original page after user has finished posting.
    – Benj
    Jan 14, 2016 at 18:27
  • @Benj: absolutely, whatever works for a particular site. I don't think there's a wrong answer here ;) Jan 14, 2016 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.