Prevent user creating new users with specific roles

One step is to use the editable_roles filter to remove roles from the dropdown but this doesn't prevent the user from modifying the select value and create a user with "not allowed" role.

Yes it does. This filter is not just for the dropdown. Modifying editable_roles does in fact prevent users from assigning a role they're not allowed to.

This is because edit_user() (the function used for adding new users) calls get_editable_roles() as well and bails when one is not allowed to give users that role.

Here's a simple example of what you can do:

/** * Removes Administrator from roles list if user isn't an admin themselves. * * This way, only admins can make new admins. * * @param array $all_roles List of roles. * @return array Modified list of roles. */ function wpse_293133_filter_editable_roles( $all_roles ) { if ( ! is_super_admin( get_current_user_id() ) ) { unset( $all_roles['administrator'] ); } return $all_roles; } add_filter( 'editable_roles', 'wpse_293133_filter_editable_roles' );