how to allow Contributor users to be able to add/edit/delete list items but prevent them from modifying site pages

Question

I am working on a sharepoint enterprise server 2013 sites mainly of type Team Sites. some of them have the publishing infrastructure enabled and the other do not have these features enabled. and inside the sites i granted some users Contribute Permission to allow them to add/edit/delete list items. but seems the Contributor users will be granted UN-expected permission which i was expecting. For example if a contributor user go to the team site home page (which we have added many web parts and customization inside it) such as http://servername/sites/hr/home.aspx then they can edit this page, add extra web parts, remove others web parts, etc...

so can anyone advice what is the best appraoch to prevent Contributor users from modifying the site pages while allow them to add/edit/delete list items?

now i read about this and i found 2 simiar links:-

Deny "Edit Page" permissions to Contributors on a publishing site?

Prevent Users from Editing Pages while maintaining Inheritance

and both of these links suggest to beak the inheritance of the site pages library and only allow admin users to edit the pages library, while allow other users to Read. while this will technically work (although i did not test it). but i think it will have the following drawbacks , so i am not sure if there is another appraoch which will prevent these drawbacks from happening :-

1. Breaking the permission on lists' levels is always a bad appraoch from performance perspective, as it will create performance overhead.

2. breaking the permission on the Pages library, will not scale well. for example if i do this to the root site, and i create a new sub-site, then i need to do the same process of breaking the inheritance on the Pages Library at the sub-site level also ...

so can anyone advice on this please?

Thanks

Answer 1

Usually when I run into an issue like this I put those users into the visitors group and then create a separate group like "list contributors" and then edit the list permissions and grant the "list contributors" group contribute permissions to that list.

Answer 2

More simpler way is to create a custom permission level.

Got to sitecollection permissions→Permission levels → Add permission levels→ Here you can add what kind of permissions you want and then save it with a name.

Note: In custom permission add → add items, delete items, view items, approve items, view versions, create alerts, manage lists, view pages. that's it, please don't add manage permissions or else manage web sites permission under it.

Go to your group and edit permissions and then instead of original contributor access provide this custom permission.

You can use this same custom permission to different groups too