How QCFUM Protects Super Users and Administrative Accounts

QCFUM 2.0.4 protects administrative-capability accounts server-side. The Max Frontend User Manager does not rely only on a hand-maintained list of protected Joomla groups; it also detects administrative capabilities and refuses protected targets even when a manual group configuration is too permissive.

This protection is intentionally broader than the group title “Super Users.” QCFUM checks actual Joomla authorization capabilities.

Capability-Based Protection

For Frontend User Manager targets, QCFUM treats accounts with core.admin, core.login.admin, or core.manage authority as protected. The check is performed on the target user on the server before sensitive changes are applied.

Administrative Groups Are Protected Too

QCFUM builds a protected-group set from the administrator’s manual exclusions and then adds Joomla groups that grant global administrative/backend capabilities. It uses Joomla’s group authorization checks, so removing an administrative group from the manual exclusion list does not make that group safe for delegated frontend management.

Group Inheritance Is Included

Protection uses authorized group membership, including ancestor groups in Joomla’s nested group hierarchy. If a selected or automatically protected parent group covers a descendant group, users assigned to that descendant are treated as belonging to the protected authorization path for QCFUM checks.

Where the Protection Applies

  • Protected users are filtered out of Frontend User Manager search results.
  • Direct target actions recheck protection before saving identity, group, status, password, deletion, or other enabled changes.
  • Pending User Manager approval actions recheck that the target is still available and unprotected before applying the approved change.
  • Other QCFUM security-sensitive paths also refuse core.admin targets where relevant, such as approval/temporary-access enforcement.

Manual Lists Are an Additional Layer

The Groups always hidden/protected setting and excluded user IDs let you protect ordinary high-risk accounts in addition to QCFUM’s automatic administrative-capability protection. Use them for service accounts, executives, integration users, or other identities that should never be delegated.

Verify the Safeguard

Using a delegated non-Super-User staff account, confirm an ordinary test member can be managed when intended and a backend-capable administrator cannot be selected or changed. If an administrative account appears manageable, treat that as a configuration or implementation problem rather than widening permissions further.

Community Discussion

Want to compare Joomla user-management safeguards, share practical QCFUM configuration ideas, or discuss how other administrators delegate frontend workflows? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.