WordPress User Roles
What WordPress User Roles Control
WordPress user roles are preset groups of permissions that decide what each account can do on a site. A role is a label such as Editor or Author. Behind each label is a set of capabilities, the individual actions a user may perform, such as publishing a post, editing other people’s posts or installing a plugin.
Roles let a site owner give each person only the access their job requires. A freelance writer may need to draft posts without publishing them, while a volunteer moderator may need to approve comments without changing the theme.
The Five Built-In Roles From Most to Least Access
- Administrator has full control of a single site, including settings, plugins, themes and other users.
- Editor can publish and manage all posts and pages, including those written by others.
- Author can write, publish and manage only their own posts.
- Contributor can write and submit posts for review but cannot publish them.
- Subscriber can manage a personal profile and read content, with no rights to edit site content.
Multisite networks add a Super Admin role above Administrator, which controls the whole network. Networks are covered in the multisite article.
Why Least Privilege Matters for Editorial Teams
Least privilege means giving each account the smallest set of permissions it needs. Consider a news site with ten writers. Staff who publish their own stories can be Authors, a desk lead can be an Editor, and only one or two people need Administrator access.
The reason is risk. If an Administrator account is compromised, an attacker can change the entire site. If a Contributor account is compromised, the damage is far more limited. Roles also need upkeep: remove or downgrade accounts when people leave or change jobs.
Roles control what an account can do inside WordPress. They do not protect against weak passwords or stolen logins, and plugins can add their own capabilities, so a role is only as safe as the plugins installed. Plugins are explained in the plugins article.
Frequently asked questions
Can I create a custom WordPress user role?
Yes. Developers can add custom roles or change the capabilities of existing ones, usually through code or a role-management plugin. Custom roles are useful when no built-in role fits, but each added permission widens what that role can do, so review them carefully.
What is the difference between a role and a capability?
A role is a named bundle of capabilities. A capability is a single permission, such as edit_posts or manage_options, that WordPress checks before allowing an action. Changing a role changes every account that holds it, while capability checks decide each individual action.