Title: Site access for VIP Support
Author: WordPress VIP Documentation
Published: July 27, 2021
Last modified: September 30, 2025

---

 1. [VIP Support](https://docs.wpvip.com/vip-support/)
 2. Site access for VIP Support

#  Site access for VIP Support

Occasionally users with a `vip_support` [custom user role](https://wordpress.org/support/article/roles-and-capabilities/#special-cases)
will appear in the list of a site’s users. Members of the VIP Support Team will 
create temporary user accounts with the `vip_support` role, granting full access
to a site’s WordPress Admin on an as-needed basis, to assist with issues reported
by customers or by our internal monitoring. These temporary user accounts expire
after 8 hours and are removed automatically.

**Caution**

Blocking the ability for users with a `vip_support` role to be created on a site,
or to obfuscate [the WordPress login portal](https://wordpress.org/support/article/first-steps-with-wordpress/#log-in),
will also block the ability for WordPress VIP to provide comprehensive support in
the event of an issue such as a site outage.

## Sites with restricted permissions

To best support your site, `vip_support` users must have full access to the backend
of the site. When restricting access to certain actions, follow WordPress best practices
and check for capabilities with `[current_user_can()](https://developer.wordpress.org/reference/functions/current_user_can/)`
rather than checking a user’s role.

## Sites with restricted access

Sites with [restricted access](https://docs.wpvip.com/restricting-site-access/) 
implementations, including [reverse proxies](https://docs.wpvip.com/restricting-site-access/reverse-proxies/),
must:

 * Allow new users with the `vip_support` role to be created
 * If necessary, provide instructions for accessing a customized WordPress [log in portal](https://wordpress.org/support/article/first-steps-with-wordpress/#log-in).

### Partial IP allow lists

For sites with [partial IP allow lists](https://docs.wpvip.com/restricting-site-access/partial-restriction-site-access/),
use [the `is_proxied_request()` helper function](https://github.com/Automattic/vip-go-mu-plugins/blob/d001993305ebf9d8551da43701029861d2f7c1db/vip-helpers/vip-utils.php#L1469-L1477)
to ensure that requests made from VIP’s proxy servers have access by checking for
and allowing requests when `true === A8C_PROXIED_REQUEST`.

To manage access for VIP Support, add a version of the following conditional to 
a plugin in the [`/client-mu-plugins` directory](https://docs.wpvip.com/wordpress-skeleton/client-mu-plugins-directory/),
along with an IP check and subsequent actions within the `else` block:

/client-mu-plugins/example-plugin.php

    ```lang-php
    if ( is_proxied_request() ) {

    // The request originates from WordPress VIP and should be allowed

    } else {

    // Restrict site access

    }
    ```

### Single Sign On (SSO)

For [WordPress sites that have Single Sign-On (SSO) enabled](https://docs.wpvip.com/security/wordpress-sso/),
if it is not possible to conditionally disable SSO login for `vip_support` users,
then instructions for bypassing the SSO login must be provided to VIP Support. Enabling
a URL parameter such as `wp-login.php?normal` that directs users to the WordPress
login portal is the simplest method.

Last updated: September 30, 2025