Quick answer: WordPress user roles control what each person who logs in can do. The built-in roles are Administrator (full control of the site), Editor (manage and publish all content), Author (publish and manage their own posts), Contributor (write posts but not publish them), Subscriber (manage their own profile only) and, on multisite networks, Super Admin. Plugins such as WooCommerce add roles like Shop Manager and Customer. Give each person the lowest role that lets them do their job, and keep the number of Administrators as small as possible.
How roles and capabilities work
Every role is a bundle of capabilities. A capability is a single permission, such as edit_posts, publish_posts, install_plugins or manage_options. When someone tries to do something in the dashboard, WordPress checks whether their role includes the needed capability.
This system means:
- Roles are not fixed. Plugins and developers can add, change or remove capabilities.
- New roles can be created for specific jobs.
- Plugins can add their own capabilities, for example to control who can see form entries or SEO settings.
The built-in roles
Super Admin
Exists only on WordPress multisite networks. A Super Admin manages the whole network: creating sites, installing plugins and themes for all sites and managing network users. On a normal single site, this role does not appear.
Administrator
Full control of a single site. Administrators can:
- Install, activate and delete plugins and themes
- Change any setting
- Add, edit and delete users, including other Administrators
- Edit theme and plugin files from the dashboard, unless disabled
- Publish, edit and delete any content
- Run updates
Because an Administrator account can do anything, it is the main target for attackers. Every extra Administrator is another account that could be compromised.
Editor
Editors manage all content but not the site’s setup. They can:
- Publish, edit and delete any post or page, including other people’s
- Moderate comments
- Manage categories, tags and links
- Upload files
They cannot install plugins, change themes, change most settings or manage users. Editor is the right role for most marketing managers and content leads.
Author
Authors manage their own content. They can:
- Write, edit, publish and delete their own posts
- Upload files
They cannot edit other people’s posts, create pages or moderate comments beyond their own posts. Suited to regular in-house writers you trust to publish.
Contributor
Contributors can write and edit their own posts but cannot publish them. Their drafts go to an Editor or Administrator for review. They also cannot upload images by default, which can surprise new users.
Suited to guest writers, freelancers or new team members whose work needs approval first.
Subscriber
Subscribers can log in and edit their own profile. That is all. This role is used for sites that require registration to comment, membership sites and customer accounts. Our guide to WordPress membership sites covers how roles are used there.
Quick comparison
| Task | Admin | Editor | Author | Contributor | Subscriber |
|---|---|---|---|---|---|
| Install plugins and themes | Yes | No | No | No | No |
| Change site settings | Yes | No | No | No | No |
| Manage users | Yes | No | No | No | No |
| Publish any post or page | Yes | Yes | No | No | No |
| Edit others’ posts | Yes | Yes | No | No | No |
| Publish own posts | Yes | Yes | Yes | No | No |
| Upload files | Yes | Yes | Yes | No | No |
| Write drafts | Yes | Yes | Yes | Yes | No |
| Edit own profile | Yes | Yes | Yes | Yes | Yes |
Roles added by plugins
Many plugins add roles that fit their purpose:
- WooCommerce adds Shop Manager, who can manage products, orders, coupons and reports without full Administrator access, and Customer, given to people who create an account when ordering.
- SEO plugins may add roles such as SEO Manager or SEO Editor, with access to SEO settings but not the rest of the site.
- Learning, membership and forum plugins often add roles for instructors, members or moderators.
Shop Manager is very useful. Store staff who handle orders rarely need to install plugins or change themes.
Choosing the right role for each person
Ask what the person actually needs to do, then pick the lowest role that allows it.
- Business owner: Administrator, but consider a separate Editor account for day-to-day content work.
- Developer or agency: Administrator, ideally with an account in their own name, not a shared login.
- Marketing manager: Editor.
- In-house writer: Author.
- Freelance or guest writer: Contributor.
- Store staff: Shop Manager.
- Customers and members: Customer or Subscriber.
When training clients on their new site, we usually walk through which accounts exist and why. Our article on WordPress client training covers what that handover includes.
Creating custom roles
Sometimes no built-in role fits. For example, you might want someone who can edit pages but not posts, or view form entries without seeing anything else.
Options:
- Role management plugins such as Members or User Role Editor let you create roles and tick capabilities in the dashboard.
- Code, using
add_role()andadd_cap()in a custom plugin, gives developers precise control and keeps changes in version control. Our guide to WordPress hooks explains how such code is usually attached.
Be careful when editing capabilities. Removing the wrong capability from the Administrator role can lock everyone out of parts of the dashboard. Test on staging and keep a backup.
Security practices for user accounts
- Limit Administrators. Review the list every few months and downgrade or remove accounts that no longer need full access.
- One person, one account. Shared logins make it impossible to tell who did what and hard to remove access when someone leaves.
- Strong passwords and two-factor authentication, especially for Administrators and Editors. See our guide to two-factor authentication.
- Remove access promptly when staff, freelancers or agencies finish working with you. Reassign their content to another user when deleting the account.
- Avoid the username “admin”. It is the first one attackers try.
- Turn off open registration unless you need it, and make sure the default role for new users is Subscriber, not anything higher. Check Settings > General.
- Disable file editing in the dashboard so even an Administrator account cannot edit plugin and theme code from the browser.
- Keep an activity log with a plugin so you can see who changed what.
These steps work alongside a good update routine. Our article on plugin vulnerabilities covers that side, and our WordPress security guide brings it together.
Content workflow with roles
Roles also support an editorial process:
- Contributors write drafts and submit them for review.
- Editors review, edit and schedule or publish.
- Authors publish their own work directly when trusted to do so.
WordPress keeps revisions of each change, so Editors can see what was altered and restore earlier versions. For more complex approval steps, editorial workflow plugins can add custom statuses and notifications.
FAQ
What is the difference between an Editor and an Author?
An Editor can publish and edit everyone’s content. An Author can only publish and edit their own posts.
Can a Contributor upload images?
Not by default. If your guest writers need to add images, either upload them on their behalf or give them a custom role with upload permission.
How many Administrators should a site have?
As few as practical. Often one for the business owner and one for the developer.
What role should new users get when they register?
Subscriber, or Customer on WooCommerce stores. Never set the default role to Administrator or Editor.
The right access for each person
User roles are a simple but powerful way to keep a WordPress site organised and secure. Give each person the access they need and no more, review accounts regularly and protect the powerful ones well. If you want a WordPress site that is set up cleanly for your team and built to convert visitors, see our Turn visitors into customers service.
