Changing user permissions in WordPress is one of the most important tasks for site security and workflow. Done correctly, it protects your content, limits risk, and gives each team member exactly the access they need.
This guide shows you how to change permissions safely using the dashboard, code, and plugins, plus when to use horizontal lines for better readability and SEO.
Why Changing User Permissions Matters
WordPress uses roles (like Administrator, Editor, Author) and capabilities (specific actions like edit_posts, manage_options) to control access.
Changing permissions correctly helps you:
Apply the principle of least privilege (give only what’s needed).
Reduce the risk of accidental changes or security breaches.
Improve workflow by matching roles to real responsibilities.
Keep your site compliant with internal policies or client agreements.
Method 1: Change User Role from the WordPress Dashboard
This is the most common and safest method for most sites.
Step 1 – Go to Users → All Users
Log into your WordPress admin dashboard.
In the left menu, click Users, then All Users.
Step 2 – Select the User
Find the user whose permissions you want to change.
You can either:
Click Edit under their name, or
Check the box next to their name to change multiple users at once.
Step 3 – Change the Role
For a single user:
On the profile edit screen, scroll to the Role dropdown.
Choose the new role (e.g., Editor, Author, Contributor).
Click Update User.
For multiple users:
Check the boxes next to all users you want to update.
Above the list, find Change role to….
Select the new role and click Change.
Method 2: Change Default Role for New Registrations
If your site allows user registration, you can set the default role for new users.
Go to Settings → General.
Find New User Default Role.
Choose a safe default (usually Subscriber or Contributor).
Click Save Changes.
Avoid setting the default to Editor or Administrator unless you have a very specific, controlled use case.
Method 3: Add or Remove Capabilities with Code (Advanced)
Sometimes you need more control than default roles provide. You can add or remove capabilities from existing roles or custom roles using PHP.
Example: Add a Capability to a Role
Add this to a custom plugin or your theme’s functions.php (preferably in a small custom plugin):
function my_prefix_add_capability_to_author() {
$role = get_role( 'author' );
if ( $role ) {
$role->add_cap( 'edit_pages' ); // Allow Authors to edit pages
}
}
add_action( 'init', 'my_prefix_add_capability_to_author' );Example: Remove a Capability from a Role
function my_prefix_remove_capability_from_contributor() {
$role = get_role( 'contributor' );
if ( $role ) {
$role->remove_cap( 'upload_files' ); // Prevent Contributors from uploading media
}
}
add_action( 'init', 'my_prefix_remove_capability_from_contributor' );Best practice: run these functions once (e.g., on plugin activation) rather than on every page load.
Method 4: Use a Plugin to Manage Roles and Capabilities
If you prefer a UI instead of code, use a trusted role‑management plugin such as:
User Role Editor
Members
Advanced Access Manager
Typical workflow:
Install and activate the plugin.
Go to Users → User Role Editor (or the plugin’s menu).
Select the role you want to modify.
Check or uncheck capabilities.
Save changes.
Always test changes on a staging site first, especially when modifying powerful roles like Editor or Administrator.
Common Permission Changes and When to Use Them
Demote an Old Administrator
If someone no longer needs full access:
Change their role from Administrator to Editor or a custom role.
Keep at least one trusted Administrator account active.
Upgrade a Trusted Writer
If a Contributor or Author has proven reliable:
Promote them to Author or Editor depending on how much control they need.
Ensure they understand their new responsibilities.
Create a Client‑Safe Role
For clients who need limited access:
Create a custom role (e.g., “Client”) with capabilities like:
readedit_posts(only their own)upload_files(optional)
Remove capabilities like
delete_posts,publish_posts, ormanage_options.
Security Checklist When Changing Permissions
Before and after changing WordPress permissions, run through this quick checklist:
Confirm you still have at least one active Administrator you trust.
Avoid giving Administrator access to freelancers or clients unless absolutely necessary.
Use strong passwords and two‑factor authentication on high‑privilege accounts.
Audit your user list regularly at Users → All Users.
Remove or downgrade inactive accounts.
Document any custom roles or capability changes for future reference.
Are Horizontal Lines SEO‑Friendly? When to Use Them
Horizontal lines (<hr> in HTML, created with the Separator block in the block editor) are SEO‑friendly when used to improve readability and structure. [SEO best practices]
Use a horizontal line when:
You want to visually separate major sections (e.g., between methods or checklists).
The content before and after the line is a distinct topic or step.
It helps users scan long articles more easily. [readability best practices]
Avoid horizontal lines when:
You’re splitting short paragraphs that belong together.
You’re using them purely as decoration with no structural purpose.
They make the page look fragmented or cluttered.
In this article, horizontal lines separate major methods and sections, which improves scanability and user experience—both positive signals for SEO.
Quick Recap
Use the dashboard to change roles for most users.
Use code or a plugin to fine‑tune capabilities or create custom roles.
Always follow least privilege and audit users regularly.
Use horizontal lines to separate major sections and improve readability, not as decoration.
Discover more from WORDPRESS ROLE
Subscribe to get the latest posts sent to your email.