How To Remove Administrator Access In WordPress

How to Remove Administrator Access in WordPress: The Ultimate 2026 Security Playbook

Stripped of admin rights, a WordPress user loses the keys to your kingdom—no more plugin installs, theme tweaks, user management, or site-wide settings.

To remove administrator access in WordPress, navigate to Users → All Users, click the target username, swap their role from Administrator to a lesser tier like Editor or Author, and hit Update User. For mass lockdowns, tick multiple boxes, pick Change role to… → Editor, and fire away.

In the wild, too many WordPress sites run with a revolving door of administrators—former devs, ghost freelancers, even that one client who demanded “full control” back in 2019. Each extra admin is a loaded gun: one phished password, one rogue script, and your site’s toast. Pulling admin privileges isn’t just housekeeping; it’s digital self-defense.

This playbook walks you through yanking administrator access the smart way—dashboard tricks, bulk nukes, plugin power moves, command-line sorcery, and even raw database surgery. Plus, we’ll flag the landmines (like locking yourself out) and arm you with a lockdown checklist that’ll make your site hacker-resistant.

Last updated: September 2026

The Brutal Truth: Why Admin Access Is a Ticking Time Bomb

Picture this: your site has five administrators. One’s a ex-agency dev who vanished mid-project. Another’s a VA with a reused password from a breached forum. A third? That “temporary” contractor from last year who never left.

Each admin account is a master key. Compromise one, and attackers can:

Drop malware-laced plugins
Inject backdoors in theme files
Spawn hidden admin accounts for persistence
Nuke your database or redirect traffic to phishing farms

The fix? Ruthless privilege pruning. Strip admin rights from anyone who doesn’t absolutely need them. Your future self (and your hosting bill) will thank you.

Internal post to see: WordPress Role Security Checklist

Administrator vs. The Rest: What You’re Actually Taking Away

Before you demote, know what’s on the chopping block. Admins hold the crown jewels; Editors and Authors get the peasant’s share.

Capability	Administrator	Editor	Author
Install/delete plugins	✅	❌	❌
Edit theme/plugin PHP	✅	❌	❌
Manage all users	✅	❌	❌
Change site settings	✅	❌	❌
Publish/edit any post	✅	✅	❌ (own only)
Moderate all comments	✅	✅	❌ (own only)
Upload media	✅	✅	✅

The takeaway: Editors run the content factory but can’t touch the engine room. Authors write the scripts but can’t rewrite the play.

See the post: WordPress user roles explained

Pre-Op Checklist: Don’t Lock Yourself Out

Removing admin access is surgery. Skip prep, and you might amputate the wrong limb—or worse, trap yourself outside the OR.

1. Count Your Remaining Admins

Rule of thumb: keep 2–3 trusted admins. You (the owner), your lead dev, maybe your agency. Anyone else? Demote time.

2. Audit Their Actual Work

Ask the hard questions:

Do they install plugins, or just write posts?
Are they tweaking settings, or moderating comments?
Could they do their job as an Editor or Author?

If the answer’s “no” to admin-only tasks, they’re ripe for downgrade.

3. Warn the Humans

Nobody likes surprise demotions. Shoot a quick Slack or email:

“Hey, we’re tightening security—swapping your admin role to Editor. You’ll still own your content, just no more plugin installs. Hit me if you need anything.”

4. Back Up. Then Back Up Again.

Roles live in the database. A fat-fingered click can turn your site into a brick. Fire up UpdraftPlus, BlogVault, or your host’s snapshot tool before touching a thing.

Method 1: The Dashboard Demotion (Point-and-Click Simplicity) – 6 Steps

For one-off takedowns, the WordPress dashboard is your scalpel.

Step 1: Log In as the Last Admin Standing

Use an account that’s staying admin. If you’re downgrading yourself, make sure another admin exists first—or you’re locking the door behind you.

Step 2: Users → All Users

Left sidebar, hover Users, click All Users.

Step 3: Hunt Down the Target

Scroll or search for the admin you’re disarming. Pro tip: click the Administrator filter at the top to see only the big guns.

Step 4: Click Edit (Not Delete)

Hover their username, hit Edit. You’re demoting, not deleting.

Scroll to Role, swap Administrator for Editor (content overseer) or Author (lone wolf writer).

Step 6: Update User

Smash Update User at the bottom. Boom—they’re defanged.

When to use: Quick, surgical strikes on single accounts.

Method 2: Bulk Demotion (The Shotgun Approach) – 4 Steps

Got a herd of admins to cull? Bulk actions are your friend.

Step 1: Users → All Users → Filter by Administrator

Click the Administrator link (e.g., “Administrator (7)”) to isolate them.

Step 2: Tick the Boxes

Check everyone you’re downgrading. Leave yourself and one other admin unchecked.

Step 3: Bulk Actions → Change role to… → Editor

Top dropdown: pick Change role to…, select Editor, hit Change.

Step 4: Watch the Carnage

WordPress churns through the list. In seconds, your seven admins are now seven Editors.

When to use: Post-audit purges, agency handoffs, or “why does this site have 12 admins?!” moments.

Method 3: Plugin-Powered Precision (User Role Editor, Members)

Plugins add finesse—custom roles, capability audits, even scheduled demotions.

User Role Editor: The Swiss Army Knife

Install User Role Editor.
Users → User Role Editor.
Pick the user, uncheck Administrator, check Editor.
Hit Update.

Bonus: Click Capabilities to see exactly what you’re stripping. Want to let them keep, say, moderate_comments? Grant it manually.

Members: Role Management on Steroids

Install Members.
Members → Members → Edit the user.
Swap roles, save.

When to use: When you need granular control or custom hybrid roles (e.g., “Content Admin” who can edit posts but not install plugins).

Learn more here: custom WordPress roles and capabilities

Method 4: WP-CLI (Command-Line Carnage for Pros)

SSH warriors skip the dashboard. One command, one admin gone.

bash

wp user set-role badadmin editor

Replace badadmin with their username. For mass demotions:

bash

wp user list --role=administrator --field=ID | tail -n +2 | xargs -I % wp user set-role % editor

(Translation: grab all admin IDs, skip the first one (you), demote the rest.)

When to use: Managed hosting, agency workflows, or when the dashboard is bricked.

Method 5: Database Nuclear Option (phpMyAdmin Surgery) – 4 Steps

Locked out? Dashboard broken? Time to go full hacker.

Step 1: phpMyAdmin → wp_users

Find the user’s ID (say, 42).

Step 2: wp_usermeta → Find `wp_capabilities`

Edit the row where user_id = 42 and meta_key = 'wp_capabilities'.

Step 3: Replace the Serialized Value

For Editor:

text

a:1:{s:6:"editor";b:1;}

For Author:

text

a:1:{s:6:"author";b:1;}

Step 4: Update `wp_user_level` Too

Set meta_value to 7 for Editor, 2 for Author.

When to use: Last-resort lockdowns, post-hack cleanup, or when you’ve accidentally admin-nuked yourself.

The Aftermath: What Breaks (and What Doesn’t)

Their Content? Safe.

Posts, pages, media—untouched. Only permissions change.

Their Workflow? Adjusted.

Editors can still run the content show—just no more plugin playground.
Authors keep writing, but can’t touch others’ drafts.

Their Ego? Bruised.

Expect questions. Have your “security hardening” pitch ready.

Red Flags: When NOT to Remove Admin Access

They’re the Site Owner

Owners keep the crown. Demote everyone else first.

They Manage Plugins/Themes

If they’re your de facto sysadmin, either keep them as admin or carve a custom role with install_plugins capability.

They’re Mid-Crisis

Don’t demote during a migration, hack cleanup, or big launch. Wait for calm waters.

Troubleshooting: “I Broke It” Moments

“I Demoted Myself and Now I’m Locked Out”

Fix: WP-CLI to the rescue:

bash

wp user set-role myusername administrator

Or phpMyAdmin: revert wp_capabilities to:

text

a:1:{s:13:"administrator";b:1;}

“They Can’t Publish Posts Anymore”

Double-check the role stuck. Clear cache. Re-save the profile.

“WooCommerce Broke for Them”

Shop Managers need their role. Don’t demote e-commerce staff to Author—use Shop Manager or a custom hybrid.

See: WooCommerce role security

The Lockdown Checklist: Your Post-Demotion To-Do

Enable 2FA for remaining admins (Wordfence, WP 2FA).
Audit plugins—delete anything unused.
Set up activity logs (WP Activity Log) to track future role changes.
Schedule quarterly access reviews—no more ghost admins.
Document who has what—spreadsheet or password manager notes.

Discover more here: WordPress maintenance checklist

FAQ: The Questions Everyone’s Too Shy to Ask

Can I remove admin access from myself?

Yes, but keep a backup admin. Or use WP-CLI to undo it.

Will their posts disappear?

Nope. Content stays; permissions shrink.

How do I undo a demotion?

Same steps, reverse the role dropdown.

What if they need some admin powers?

Create a custom role with User Role Editor—grant edit_plugins but not delete_users, for example.

Is this enough to stop hackers?

It’s a massive chunk. Pair it with 2FA, updates, and a firewall (Cloudflare, Wordfence).