Keep Your Employee Directory Private: Field-Level Access Control in WordPress
Before an IT or HR team puts employee data on a website, even an internal one, the first question is usually security, not features: who can see this, and can we control it field by field? A phone number that’s fine for internal use might not be appropriate to show publicly. A reporting line might be internal-only, while a name and department are fine for anyone to see.
This guide covers how role-based access and field-level privacy actually work in a WordPress employee directory, and what to plan for before making one live.
Why “public” and “private” aren’t the only two options
Most simple directory plugins treat visibility as a single on/off switch: a profile is either visible to everyone or hidden entirely. That’s rarely how organizations actually want to handle employee data. In practice, most organizations need something more granular:
- Some fields are fine for anyone to see (name, title, department).
- Some fields should be internal-only (direct phone extension, office location).
- Some fields should only be visible to managers or HR (start date, emergency contact, employment status).
- Some data should only be editable by the employee themselves or an administrator, regardless of who can view it.
A directory that can’t distinguish between these ends up either oversharing data it shouldn’t, or hiding useful information that was fine to share, neither is a good outcome.
How role-based access works
Employee Directory includes built-in Employee and Manager roles, so access isn’t all-or-nothing. Administrators control who can view, edit, or manage directory data based on their role, rather than every logged-in user having the same level of access.
This matters most for two situations:
- Self-service editing. Employees can update their own profile (bio, skills, contact info) without needing backend access through Employee Self-Service, but they shouldn’t be able to edit anyone else’s profile or change organization-wide settings.
- Manager oversight. A manager may need visibility into their direct reports’ information that a regular employee shouldn’t have access to, tied to the same reporting relationships that drive your org chart.
How field-level privacy works
Beyond role, Granular Privacy Control lets administrators define visibility per field, not just per profile. That means a single employee profile can show some information to the public, more to logged-in employees, and even more to managers or HR, all from the same underlying profile, without maintaining separate versions of the data.
In practice, this looks like:
- Choosing which fields appear on a public-facing directory (if the directory is public at all)
- Choosing which fields are internal-only, visible to any logged-in employee
- Restricting sensitive fields to specific roles, like HR or management
What to decide before going live
A few questions worth answering with your IT or HR team before publishing a directory:
- Is the directory public-facing, internal-only, or both? This affects the entire privacy configuration, not just individual fields.
- Which fields are genuinely sensitive? Not every organization draws this line the same way, what’s fine to share publicly at one company may be internal-only at another.
- Who should be able to edit what? Self-service editing is convenient, but it’s worth deciding upfront which fields employees can change themselves versus which require administrator approval.
- Does this need to align with an existing data policy? If your organization already has data handling or privacy policies (especially relevant for healthcare, education, or government organizations), the directory’s access settings should match them, not create a separate, inconsistent standard.
Not sure Employee Directory is the right fit at all? See our comparison of employee directory plugins for WordPress by organization size and use case.
Getting started
Employee Directory’s core plugin includes role-based access with built-in Employee and Manager roles, along with Granular Privacy Control for field-level visibility, out of the box. These work alongside the directory’s other core features (search, org charts, self-service editing) rather than as a separate add-on, so privacy and access control are part of the setup from day one, not an afterthought.