AAM and WordPress Multisite support

Advanced Access Manager 6.3.0 or higher is fully compatible with WordPress multisite network and all the necessary functional aspects are included in the free version. In this article, we would like to touch-base on the WordPress core concept of the Multisite Network, before explaining how AAM works with it, so we can establish the common terminology.

FYI! If you just need to know the short answer to the question “Is AAM compatible with multisite setup”, then YES, it is. In this article we just explaining how it works with this type of WordPress setup and how you can customize AAM behavior.


WordPress doc team already put together the solid documentation about multisite networks and most of the answers can be found there. However, we found challenging and in a way confusing the difference between “site” and “blog” terms. In the WordPress core code, we noted that these two terms are used interchangeably (e.g. is_main_blog is also is_main_site). That is why we would like to be clear about our interpretation of multisite network and here is the visual diagram:

Multisite Network Diagram

WordPress installation may have one or more networks. Think about network as a group of blogs. The default WordPress multisite setup comes with one network and while we did not find any functionality in the core that allows to manage multiple networks, we discovered two plugins that allow to do that WP Multi Network and Networks for WordPress. Both are not actively maintained, which makes us believe that this type of functionality has very low demand.

FYI! The list of all networks is stored in the database table wp_sites.

Each network may have one or more blogs and there is no limit to how many blogs can be created inside a network. However, keep in mind that each blog has its own set of database tables that separates options, posts, settings, comments, and terms.

FYI! The list of all blogs for each network is stored in the database table wp_blogs.

The only information that is shared across all networks and blogs is the list of users where each user may have a different set of metadata per each blog. So roles and capabilities are actually customizable per each blog and are not shared.

Last but not least, each network has one “main” blog. In the diagram above, it is highlighted in light red color. Typically that is the first blog on the list, however, it can be configured. AAM uses the main blog during syncing information across all sites and this is something we are covering below.

Settings synchronization

In AAM 6.2.0 we introduced a new service called “Multisite Settings Sync”. This service basically synchronizing all access settings, AAM configurations, roles and capabilities across all the blogs that belong to the currently managed network.

Multisite Settings Sync

The synchronization occurs automatically each time changes applied to the main blog. You will know which blog is main as AAM displays highlighted notification on the top right corner.

Multisite Network Notification

It is very important to emphasize that during synchronization all the settings on other blogs are replaced with settings from the main blog. For example, if you created a new role “Manager” on the “Blog B” that is not the main blog, next time you create or change any capability on the main blog, it will wipe the “Manager” role from the “Blog B”. That is why it is very important to be aware of this behavior.

If you need to exclude any particular blogs from the syncing process, simply go to that blog and on the AAM page disable the “Multisite Settings Syncing” service. This way AAM will skip it.

Get notified about important updates and new features (no more than one email per month).