The people who rename pages are often editors or shop managers, and until you choose otherwise only administrators can manage redirects. Under Settings → Who can manage redirects, tick Editors, or Shop managers on a WooCommerce shop, and they get:

the Dashboard, Redirects and Broken links: adding, changing, switching off and deleting redirects, checking destinations, and working through the broken links list, its Never list this again button included;
the Old addresses panel beside every page, post and product they edit.

Settings, the licence, importing and exporting stay with administrators, and so does the choice of who else may come in. Settings is not in their menu or the top bar, and asking for it by its address, or sending its form, is refused.

Every redirect is held to the same refusals whoever writes it: nobody can redirect /wp-admin, the sign-in page or the whole site. Who may redirect to another site depends on their role as well (below).

On a site that has not chosen, the Dashboard asks an administrator once: Let them in ticks Editors (and Shop managers on a shop), Not now leaves administrators alone, as before. Either way it is not asked again, and Settings can change it whenever you like.

Behind it is a capability, trrd_manage_redirects. A role editor plugin, such as Members or User Role Editor, can give it to any other role, or keep it from one, and what it says counts over the ticks. On a network each site decides for itself.

Redirecting to another site#

A redirect to another site needs somebody WordPress lets put any code in a page, scripts included (WordPress calls this posting unfiltered HTML). Such a person can already send a page's visitors anywhere with a script, so the plugin gives them nothing new. Anybody else could otherwise use it to point /checkout/ at a copy of your shop somewhere else.

On a single site, administrators and editors may. Shop managers may not.
On a network, only the network's administrators may. A site's own administrators and editors may not.
With DISALLOW_UNFILTERED_HTML set in wp-config.php, nobody may.

Everybody else who manages redirects can redirect only to addresses on this site, wherever a redirect is made or changed. The Redirects form, and switching a redirect on, refuse a destination on another site with the reason, and the form says so under Send them to before anything is typed. Point it at is not offered when the final address is on another site, and the row says why. Import redirects leaves such rows out and says how many, and Redirects from Other Plugins and Server Redirect Rules list them on the preview as staying behind, with the reason. The Old addresses panel is not affected, because what it adds goes to the page itself.

A redirect to another site that is already there keeps working. Anybody who manages redirects can still switch it off or delete it, or point it at a page here instead. Only somebody who may redirect to another site can change it otherwise, or switch it back on.

An address on this site's own domain is this site, whichever way it is written. So is a domain WordPress is told belongs to this site, as a multilingual plugin with a domain for each language tells it (the allowed_redirect_hosts filter). On a network in folders, every site of it shares the domain, so an address of another site of the network counts as this site.

Behind it is a second capability, trrd_redirect_off_site. A role editor plugin can give it to a role, for example to administrators on a site with DISALLOW_UNFILTERED_HTML, or keep it from one, and what it says counts.

WP-CLI is not affected: wp trrd works as before for whoever runs it.