WordPress User Roles and Permissions: Who Should Be Able to Do What
Giving everyone an Administrator account is a risk. Learn the default WordPress roles, how capabilities work and how to apply least-privilege access.
The easiest way to give a colleague access to your WordPress site is to make them an Administrator. It is also one of the worst. Administrators can install plugins, change settings, delete content and create other users. If their account is compromised, so is your site. WordPress has a role system designed for giving people just enough access, and using it properly is a basic security and workflow habit.
The default roles
A standard single-site WordPress installation includes five roles, each with a set of capabilities.
| Role | Can do |
|---|---|
| Administrator | Everything on the site: settings, plugins, themes, users, all content |
| Editor | Publish and manage all posts and pages, including other people's; moderate comments |
| Author | Publish and manage their own posts, and upload media |
| Contributor | Write and edit their own posts, but cannot publish them or upload media |
| Subscriber | Manage their own profile; used for sites with registered members |
On a Multisite network there is also the Super Admin, who controls the entire network. Shops add roles too: WooCommerce creates a Customer role and a Shop Manager role for people who manage products and orders without full administrator rights.
How capabilities work
Roles are bundles of capabilities. A capability is a single permission, such as editing published posts, installing plugins or moderating comments. WordPress checks capabilities, not role names, so a plugin can ask whether the current user may edit a post. You can adjust the capabilities of a role with a role editor plugin or code, though changes to the defaults should be made carefully and documented.
Applying least privilege
The principle is simple: give each person the lowest role that lets them do their job.
- A blogger who writes and publishes their own articles needs Author.
- A freelance writer whose work you review before publishing needs Contributor.
- Someone who edits and schedules everyone's content needs Editor.
- A shop assistant who manages orders needs Shop Manager, not Administrator.
- Only the people responsible for the site's technical setup need Administrator, and ideally only one or two.
Practical rules for administrator accounts
- Keep the number of administrators small.
- Do not share accounts. Create a named user for each person, so actions can be traced and access can be removed individually.
- Use strong, unique passwords stored in a password manager, and enable two-factor authentication.
- Avoid the username
admin. - Use a separate account for everyday writing so you do not publish as the administrator by accident.
- Review the user list every few months and delete accounts that are no longer needed.
Working with freelancers and agencies
When external people need access, create temporary named accounts with the necessary role, and remove them when the job ends. If a developer needs administrator access, set an end date. Avoid sharing the owner's login. For hosting access, such as the control panel or SFTP, create separate credentials where the platform allows it.
Membership sites and custom roles
On sites with registration, take care what the default role for new users is. The default should be the lowest practical role, usually Subscriber or Customer. Open registration invites spam accounts, so use email verification, a challenge to block bots and moderation for sensitive sites. Review new registrations occasionally, and delete suspicious ones.
If you collect personal data from registered users, remember your responsibilities for storing and protecting it. This article is general information, not legal advice; check the rules that apply to you.
Custom roles and capabilities
Sometimes the defaults do not fit, for example a role that can edit pages but not posts, or a client who may update content but must not touch plugins. Role editor plugins let you create custom roles or adjust capabilities. Keep a written record of what you changed and why, test with a dummy account of that role, and be careful about granting capabilities such as installing or editing plugins and themes, which are effectively administrator powers.
Auditing and monitoring
An activity log plugin can record who changed what: logins, content edits, plugin activations and role changes. This helps you detect misuse and understand problems. Alerts for new administrator accounts are especially valuable, since attackers often create one after breaking in.
A short review you can do today
Open the Users screen and sort by role. For each administrator, ask whether they truly need that level. Check the last login time if your security plugin records it, and look for accounts with generic names or unfamiliar email addresses. Demote or delete what you do not need, and make a note of the date. Repeat this review every few months, and again whenever someone joins or leaves the team.
Good role hygiene costs almost nothing and pays off whenever a password leaks or a team member moves on. Treat access like keys to a building: only those who need one should hold one, and you should always know who has them.
Roles in everyday hosting setups
WordPress roles control access inside WordPress, but there are other layers: the hosting control panel, SFTP, databases and the domain registrar. Give out the minimum there as well. With WordPress hosting from Zebra Hosting, Plesk lets you manage hosting access separately from WordPress users, and our security page explains how we think about protecting your sites.
