Is there any way in which I can restrict users from editing certain sections of their profiles (under preferences) like their website and location ?
Hide them via CSS, you can set that up in Admin, Customize.
Can’t a client edit that css ?
Client can edit the css using developer tools but he cannot save that CSS on the website. As soon as the page is reloaded the CSS will go away. So in simple terms, client cannot save that CSS, only the admins can through admin dashboard.
Okay. I get that.
But the client can submit that form (revealed by changing the css) and change his/her location/website.
How to handle that without changing the core code but via plugins? Any hints on how to start?
Create user custom fields with the stuff you want control over. Hide the built in ones you don’t. If the built in fields you don’t want are hidden from everyone then it didn’t matter if someone could contrive to set them.