Every person who has access to your WordPress site has a user role — a set of permissions that determines exactly what they can see and do in the admin dashboard.
Assign too much access and you risk accidental (or malicious) changes to settings, theme files, or other users' content. Assign too little and your team can't do their work efficiently.
WordPress's role system is elegant and powerful — five built-in roles, each with a carefully defined set of capabilities, plus the ability to create custom roles with exactly the permissions you need. This guide explains every role, when to use each, and how to manage users effectively.
The Five WordPress User Roles
Can Do
- Create, edit, publish, delete any post/page (including others')
- Install, activate, deactivate, delete plugins
- Install, activate, delete themes
- Edit theme and plugin files (if file editing enabled)
- Create, edit, delete users of any role
- Manage all settings (general, reading, writing, permalinks)
- Import and export content, update WordPress core
When to assign: Only to people who genuinely need full control — typically the site owner and trusted lead developer. The fewer Administrators, the better.
Can Do
- Create, edit, publish, delete any post or page (including others')
- Manage categories, tags, and other taxonomies
- Upload and manage media files
- Moderate, edit, delete, approve comments
- Read private posts and pages
Cannot Do
- Install or manage plugins or themes
- Manage settings (permalinks, general, etc.)
- Create, edit, or delete users
- Update WordPress core
When to assign: Managing editors, senior content managers, anyone overseeing the entire content operation. Gives full content control without risking accidental changes to site configuration.
Can Do
- Create, edit, publish, delete their own posts
- Upload and use media files
- Read published and private posts
Cannot Do
- Edit or delete other users' content
- Manage pages (only posts)
- Manage categories or tags
- Access plugins, themes, or settings
When to assign: Regular contributors who publish their own content independently — bloggers, content writers, team members with editorial autonomy over their own posts.
Note: Authors can publish immediately without approval. For content that needs review before publishing, use the Contributor role instead.
Can Do
- Write and edit their own posts (drafts only)
- Read published posts
- Delete their own unpublished drafts
Cannot Do
- Publish posts (submits for review instead)
- Edit posts after publication
- Upload images or media
- Manage pages, categories, or any settings
When to assign: Guest bloggers, new team writers whose work should be reviewed before publishing. The workflow: Contributor writes draft → submits for review → Editor adds images (Contributors can't upload) → publishes.
Can Do
- Log in to WordPress admin (minimal dashboard)
- Read private posts (if granted access)
- Edit their own profile (name, password, email)
Cannot Do
- Create, edit, or delete any content
- Access any settings, plugins, or themes
When to assign: Membership site members, users who need access to private content, WooCommerce customers (My Account area). Only meaningful if your site has private content for registered users.
Additional Roles
Super Admin (Multisite Only)
Exists only on WordPress Multisite networks. Has access to all sites in the network, can install plugins/themes network-wide, and can create/delete sites. The ultimate authority in a Multisite network.
WooCommerce: Customer & Shop Manager
Customer: Same as Subscriber but with WooCommerce order history and account access. Shop Manager: Can manage all WooCommerce aspects (orders, products, coupons, reports) but limited WordPress admin access — appropriate for store managers.
Custom User Roles
For more granular control, plugins like User Role Editor (free) and Members (free + premium) let you create custom roles with precisely defined capabilities.
Example use cases:
SEO Manager: Edit post meta SEO settings but can't delete posts
Product Manager: Manage WooCommerce products but not orders
Support Staff: Read all posts, manage comments, can't publish/delete
Agency Client: Create and edit own posts, upload media, no settings access
Best Practices for User Roles
- Assign the minimum necessary role. Never give Administrator access "just in case." If someone needs to write and publish blog posts, they need Author — not Admin.
- Separate "edit content" from "manage site" roles. Editors and Authors should never need to see WordPress settings, plugins, or themes.
- Require 2FA for all Administrator accounts. Admin accounts are the highest-value target for brute force attacks. Every Admin must have two-factor authentication.
- Audit user accounts monthly. Remove accounts for people who no longer work with you. Demote accounts that no longer need their role level. Former employees with active Admin accounts are a significant security risk.
- Use strong, unique passwords for all accounts. Even Editor and Author accounts should have strong passwords — an attacker with Editor access can insert malicious links into published content.
Advanced: Limit admin logins to specific IP addresses
<Files wp-login.php>
Order Deny,Allow
Deny from All
Allow from YOUR.IP.ADDRESS
</Files>
Capability Reference
| Capability |
Admin |
Editor |
Author |
Contributor |
Subscriber |
| Manage own posts |
|
|
|
|
|
| Manage others' posts |
|
|
|
|
|
| Manage pages |
|
|
|
|
|
| Upload media |
|
|
|
|
|
| Manage categories/tags |
|
|
|
|
|
| Moderate comments |
|
|
|
|
|
| Manage plugins |
|
|
|
|
|
| Manage users |
|
|
|
|
|
How to Add and Manage Users
Adding a new user
Enter username, email address, and password
Select the appropriate role from the dropdown
Click Add New User — they receive a registration email
Changing an existing user's role
Click the user's name → scroll to Role dropdown
Select the new role → click Update User
Bulk role changes
Go to Users → All Users → check boxes next to multiple users
In Change role to dropdown, select the new role → click Change
Frequently Asked Questions
Q: Can I have multiple Administrators?
A: Yes. Most WordPress sites have 2–3 Administrators (site owner + lead developer). Having more than that increases security risk — more Admin accounts means more potential attack vectors.
Q: Can an Author publish immediately without review?
A: Yes — Authors can publish immediately. If you want all content reviewed before publishing, use the Contributor role instead, which submits content for review.
Q: What role should I assign to a client who needs to add blog posts?
A: Author — if they should publish immediately, or Contributor — if you want to review before publishing. Never give clients Administrator or Editor access unless they have a specific need for it.
Q: Can I prevent Administrators from editing theme files?
A: Yes — add define('DISALLOW_FILE_EDIT', true); to wp-config.php. This removes the theme and plugin file editors from the dashboard for all users including Admins.
Final Thoughts
WordPress's user role system is simple enough for any site owner to implement correctly and powerful enough to serve complex multi-team editorial operations. The key principle is minimum necessary access — assign the lowest role that allows someone to do their work, nothing higher.
Review your user list regularly, enforce strong passwords and 2FA for admin accounts, and use custom roles when the built-in five don't perfectly match your needs.
Contact us to discuss WordPress setup and security configuration
