Start with named WordPress accounts, strong authentication and the smallest role that can complete a job. Front-desk staff may need to read and transition bookings, while channel managers need the hb_manage_channels capability for iCal source mutations. Do not give every staff account Administrator rights just because a screen is convenient. Pro license, premium updater and OTA credentials belong to a restricted owner group; Aurelia never owns those capabilities.
Every state-changing Admin action must require the relevant capability, a request-token-bound nonce and validated input. The capability check is not a replacement for the nonce, and a nonce is not a replacement for authorization. Review the actor, target booking or source, operation and resulting status in the Activity Timeline where available. Unknown status values should render as a neutral fallback rather than granting an action.
Review checklist
- Remove dormant accounts and rotate credentials when a staff member leaves.
- Separate booking management from payment-provider, license and update access.
- Confirm that export links, customer booking links and iCal tokens are never treated as staff authorization.
- Re-test denied requests after plugin updates and after changing roles.
- Record an emergency administrator account offline and protect its recovery factors.
A theme can place controls and render notices, but it must not create a new capability, bypass a nonce, inspect a Pro license or call private services.