Every WordPress user has a role that decides what they can do. Giving people more access than they need is one of the most common causes of accidents and security incidents. Use the lowest role that lets each person do their job.
Before you start
- Administrator access to WordPress.
- A list of who works on the site and what they actually do: write posts, edit pages, manage the shop, update plugins.
The default roles
| Role | Can do | Typical user |
|---|---|---|
| Administrator | Everything: plugins, themes, settings, users | Site owner, developer |
| Editor | Publish and edit all posts and pages, moderate comments | Content manager |
| Author | Write, publish and edit their own posts, upload media | Regular writer |
| Contributor | Write their own posts but not publish; no media uploads | Guest writer |
| Subscriber | Manage their own profile only | Registered reader, customer |
Multisite adds a Super Admin who manages the whole network. Plugins add roles too, for example WooCommerce's Shop Manager, who can manage products and orders without touching plugins or users.
Add a user
- Go to Users → Add New User.
- Enter a username, the person's email, and optionally their name.
- Leave Send User Notification ticked so they set their own password.
- Choose the role and click Add New User.
Never share one login between several people. Individual accounts show who changed what and can be removed when someone leaves.
Change a role
In Users → All Users, tick one or more users, choose a role in Change role to… and click Change. You can also edit a user and change Role on their profile.
Remove a user safely
- In Users → All Users hover over the user and click Delete.
- Choose Attribute all content to another user, so their posts are kept.
- Confirm.
Warning: Choosing Delete all content removes every post and page the user wrote. Only use it for spam accounts.
Agencies and developers
- Give clients an Editor (or Shop Manager) account for daily work, and keep Administrator for the people responsible for updates.
- Create temporary administrator accounts for outside developers and delete them when the job is done.
- For your own hosting tools, use cPanel's User Manager rather than sharing the main cPanel password.
Custom roles
If the default roles do not fit, a role editor plugin (such as Members or User Role Editor) lets you create roles with specific capabilities. Change capabilities carefully: removing read or giving edit_users to a low role can lock people out or open security holes.
Audit accounts regularly
- Once a month filter Users → All Users by Administrator and check each account.
- Unknown administrators are a classic sign of a hacked site; investigate immediately.
- Check Settings → General → New User Default Role is Subscriber.
- Enable two-factor authentication for all Administrators and Editors.
Troubleshooting
- "Sorry, you are not allowed to access this page": the role lacks the capability; check the role, or a plugin changed capabilities.
- No administrator left: create one with WP-CLI:
wp user create newadmin you@example.com --role=administrator --prompt=user_pass. - Invitation email not received: set up SMTP, or set a password for the user yourself and share it securely.